[lucas-koontz]

User story

As a contributor to a public repository, I want restricted public text checked automatically so accidental disclosures are caught before merge and after text edits.

Why this matters

Copied ticket text can expose restricted names or private dependencies in PR descriptions, branches, commits and comments. This adds a shared scanner with separate PR and text-audit callers. The check runs after publication and does not erase earlier revisions.

Acceptance criteria

• Same-repository PRs scan current metadata, every commit message, current added text and paths, including release trains.
• Supported issue, comment and review events read current text on reruns and use a separate audit result.
• Missing configuration, incomplete data and concurrent changes fail without echoing text, paths or errors.
• Fork exceptions are explicitly unscanned; generic deployment terminology remains allowed.
• Operators configure the private pattern and verify the live event matrix and actual required-check context.

How to test

Run uv run --with pyyaml --with pytest --python 3.12 -m pytest tests/ -q, actionlint, the workflow graph check and the advisory security audit. After merge and operator configuration, follow docs/public-text.md using only its synthetic canary. Verify description edits, audit reruns, missing-secret failure and the fork exception.

Notes for the reviewer

• Only trusted shared code executes. The scanner checkout uses the called workflow's SHA, receives only the named secret and uses a read-only token. Contributor text stays API data.
• A clean comment cannot satisfy the PR check. Callers have different job names and concurrency groups. Metadata edits run independently of application builds.
• Complete scans can block release trains. API collection caps and unavailable text patches fail. Mode-only changes require unchanged blob identity; binary content and intermediate commit file content are outside scope.
• A private regex does not infer context. Review must still catch unqualified private release details, and public results can reveal whether a guessed term matches.
• Bootstrap precedes activation. The initial PR cannot resolve its new @main reusable until merge. Existing CI and local verification support bootstrap review; do not require the new context yet. Notifications and event delivery have documented limitations.

Verified locally

Check	Result
Shared pytest suite	295 passed, including 58 guard cases
Failing-first checks	Seven prototype failures and three review findings reproduced before fixes
actionlint	Pass
Workflow graph	17 workflows pass
Targeted zizmor audit	No findings; four existing-policy suppressions
Read-only live API probes	One PR in each of four repositories: synthetic clean pattern passes, broad positive pattern fails, stderr remains empty
Independent bounded review	Reported defects fixed and checked; no remaining finding in the final correction
Pre-PR sweep and diff integrity	Pass

Ships with

Callers in mindsdb/anton, mindsdb/cowork-server and mindsdb/cowork are prepared separately.

Merge order: this PR first, then the application callers. Promote callers to their default branches before expecting issue/comment coverage. Operator configuration and live canary checks complete activation. No application deployment is part of this PR.