jimy-r

Redaction Check Action — Git skill for Claude Code

Git community

GitHub Action that scans a PR's added lines for the shapes of private content before agent-written material merges.

How to install Redaction Check Action

This entry records only its repository, not the path inside it, so there is no exact command to give. Open jimy-r/redaction-check-action and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Redaction Check Action does

GitHub Action that scans a PR's added lines for the shapes of private content before agent-written material merges.

Alternatives in Git

Claude.md Template For Users — Attribution: Behavioral patterns adapted from obra/superpowers by Jesse Vincent (@obra), MIT License 6.8k ★
Claude Code Action — A general-purpose Claude Code action for GitHub PRs and issues that can answer questions and implement code ch 6.6k ★
CCometixLine — A high-performance Claude Code statusline tool written in Rust with Git integration and real-time usage tracki 2.4k ★

README

redaction-check-action

A composite GitHub Action that scans a pull request's added lines for the shapes of private content before they merge. It looks for email addresses, absolute home paths, credential and token prefixes, private-IP and hostname shapes, and filenames that are almost always meant to stay untracked.

It works entirely off the diff, against the *shape* a leak tends to take rather than a live denylist of real secrets (this is a public action, so it can't ship one). That keeps it fast and dependency-free, and it keeps the gate honest about its own scope. Catching common-shaped mistakes is not the same as guaranteeing privacy.

What it catches

Email addresses - flagged unless the domain is a known placeholder (example.com, *.example, GitHub's own users.noreply.github.com, and a short list of common doc-placeholder domains).
Absolute home paths - POSIX (/home/, /Users/) and Windows (C:\Users\ or C:/Users/), unless is an obvious placeholder (alice, example, the GitHub-hosted runner's own account, and similar).
Credential and token prefixes - Anthropic, OpenAI-shaped, AWS, GitHub, Slack, Google, and Stripe keys, plus a PEM private-key block. Each pattern matches a documented, high-entropy shape the issuer publishes, not a guess.
Private and link-local IPs, and .local hostnames - the RFC 1918 ranges, RFC 3927 link-local, and mDNS-style name.local hosts, any of which can fingerprint a specific home or office network.
Secret-shaped filenames - .env and its variants, SSH private keys, .pem/.key/.pfx/.p12 files, credentials.json-style files, .netrc, .npmrc, .pgpass, and secrets.{yaml,json,toml}. Checked once per file added, not per line, since the finding is "this file shouldn't be here" rather than anything about a specific line in it.