From 7960247e0b5c7a48a74f2bbd520091fa42471bf5 Mon Sep 17 00:00:00 2001
From: Matt Miller <mattmiller@comfy.org>
Date: Tue, 25 Aug 2026 23:48:56 -0700
Subject: [PATCH] feat(public-repo-hygiene): scan the PR title and description
 too (BE-9652)

PR text is a leak surface with no guard at all. It is published on a public repo
the moment it is typed, and no file scan can ever see it -- the checker walks
tracked files, and a PR title and body are neither.

Both motivating leaks are real and happened on a public PR of THIS repo: an
internal collaboration-tool permalink pasted into a description (exposing a
workspace and a channel id), and a non-public org repo named in a body. Neither
is caught anywhere today.

This adds PR title and description as a third surface, alongside a file's
contents and (since #231) its tracked path. All three go through the one
`_line_findings` matcher rather than a fork of it, for the reason #231 already
gives: a second matcher is a second place to forget an allowlist entry.

CATEGORIES 2 AND 3 ONLY -- NEVER CATEGORY 1

The ticket category is deliberately excluded from this surface, and that is a
policy decision, not an oversight. This org's commit convention REQUIRES a
`(BE-####)` Linear suffix on the PR title, so a ticket id in a public PR title
is deliberate org-wide practice rather than a leak: half of this repo's own
recent merged PR titles carry one. Scanning for it here would fail roughly
every second PR on every enrolled repo, and a required check that fires on
CORRECT behaviour does not get fixed -- it gets switched off, taking the two
categories that catch real leaks with it. A test pins this, in both directions:
the same string is still flagged in a tracked file.

TWO PROPERTIES THAT ARE SECURITY, NOT STYLE

Read from the EVENT, never from a workflow input. A caller that could supply the
text being judged could supply different text -- the same reasoning that loads
the checker from `workflows_ref` rather than the caller's checkout.

Passed to the checker as FILE PATHS, never as argv values, and interpolated only
into an `env:` value, never into a `run:` body. A PR title and body are
attacker-controlled strings; `${{ ... }}` inside a shell script is textual
substitution before the shell sees it, so `$(...)` in a PR title would execute
on the runner. The workflow writes them from `env:` to RUNNER_TEMP -- outside
the scanned tree -- and passes `--scan-text 'LABEL=PATH'`.

Surface findings are reported BEFORE file findings so `MAX_FINDINGS_TOTAL`
cannot truncate away the highest-signal, cheapest-to-fix ones. A surface named
but unreadable FAILS (exit 2) rather than scanning an empty string: a green run
over text nobody read is the silent pass this checker exists to deny.

TWO LIMITATIONS, DOCUMENTED RATHER THAN IMPLIED

A repo named WITHOUT the org prefix is not caught on any surface -- a bare name
in prose is indistinguishable from an ordinary word without a list of non-public
names, and that list is exactly what cannot live in a public repo. Of the three
real leaks above, this catches two.

PR text is only re-scanned when the caller's `on:` includes `edited`; GitHub's
default `pull_request` types do not fire on a title or body edit, so without it
a PR can go green and then have a link pasted in. The reusable cannot enforce
this -- `on:` belongs to the caller and a workflow cannot read the trigger types
it was configured with -- so the caller guide now carries it, with the `types:`
line marked load-bearing in the copy-pasteable example.

Verified: 196 tests pass (184 upstream + 12 new), workflow-pins lint clean,
actionlint reports only the two pre-existing findings on this file, and the
checker was run end to end against the real leaked PR text.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/public-repo-hygiene/README.md         |  31 ++++
 .../check_public_repo_hygiene.py              | 169 +++++++++++++++++-
 .../tests/test_check_public_repo_hygiene.py   | 126 +++++++++++++
 .github/workflows/public-repo-hygiene.yml     |  57 ++++++
 docs/callers/public-repo-hygiene.md           |  16 ++
 5 files changed, 393 insertions(+), 6 deletions(-)

diff --git a/.github/public-repo-hygiene/README.md b/.github/public-repo-hygiene/README.md
index b7a27b7..9ef696e 100644
--- a/.github/public-repo-hygiene/README.md
+++ b/.github/public-repo-hygiene/README.md
@@ -29,6 +29,35 @@ string is scanned in place of the file body. A regular file is read up to `MAX_F
 and no further, and what is *derived* from those bytes is capped too — `MAX_FINDINGS_PER_FILE`
 (200), `MAX_FINDINGS_TOTAL` (2000) and a `MAX_EXCERPT_CHARS` (200) bound on the echoed line, since
 a category-2 finding copies the matched line and the scanned repo controls how long that is.
+
+## Surfaces scanned
+
+Three surfaces, all sharing one matcher (`_line_findings`) so they can never drift apart: a
+tracked file's **contents**, its tracked **path** string (BE-9399), and the **PR title and
+description** (BE-9652).
+
+PR text is scanned when the triggering event carries a pull request. It is published the moment it
+is typed and no file scan can ever see it — both leaks that motivated this were on a public PR of
+`github-workflows` itself: an internal collaboration-tool permalink in a description, and a
+non-public org repo named in a body.
+
+Three properties are deliberate:
+
+- **Categories 2 and 3 only — never category 1.** This org's commit convention *requires* a
+  `(BE-####)` Linear suffix on PR titles, so ticket ids there are org-wide practice, not a leak;
+  half of this repo's own recent merged PR titles carry one. Flagging them would fail roughly every
+  second PR, and a required check that fires on correct behaviour does not get fixed — it gets
+  switched off, taking the two categories that catch real leaks with it. A test pins this.
+- **Read from the event, never from a workflow input.** A caller that could supply the text being
+  judged could supply *different* text. Same reasoning as loading this checker from `workflows_ref`
+  rather than the caller's checkout.
+- **Passed to the checker as file paths, never as argv values.** PR text is unbounded,
+  author-controlled and full of shell metacharacters; the workflow writes it from `env:` to
+  `RUNNER_TEMP` and passes `--scan-text '<label>=<path>'`. Interpolating it into a `run:` body would
+  be the classic Actions script-injection shape.
+
+Findings from these surfaces are reported **before** file findings, so `MAX_FINDINGS_TOTAL` can
+never truncate away the highest-signal, cheapest-to-fix ones.
 Hitting a cap adds a `::warning::` and never softens the verdict: the run still fails.
 
 **Three surfaces, one matcher.** A tracked file publishes *three* strings, not one: its contents,
@@ -175,6 +204,8 @@ category 3 host-aware, which removed the `huggingface.co/Comfy-Org/<model>` fals
 `github.com/` spellings.
 
 - **The scan is line-oriented.** A reference split across two lines is not matched.
+- **A non-public repo named WITHOUT the org prefix is not caught, on any surface.** Category 3 keys on `Comfy-Org/<name>`; a bare `<name>` in prose is indistinguishable from an ordinary word without a list of non-public repo names — and such a list is exactly what cannot live in a public repo. That is the whole reason the allowlist is default-deny over *public* names. Worked example: of the three real leaks that motivated the PR-text surface, it catches the collaboration-tool permalink and the prefixed reference, but **not** a bare `` `<repo>` `` in the same body.
+- **PR text is only re-scanned when the caller's `on:` includes `edited`.** GitHub's default `pull_request` types (`opened`, `synchronize`, `reopened`) do not fire on a title or body edit, so without it a PR can go green and *then* have an internal link pasted into its description. The reusable cannot enforce this — `on:` belongs to the caller, and a workflow cannot read the trigger types it was configured with — so it is documented in [the caller guide](../../docs/callers/public-repo-hygiene.md) instead.
 - **The model-host list is a list, so a new one starts out over-flagging.** Only `huggingface.co` and `hf.co` clear a `Comfy-Org/<name>` reference today. A second model or package host publishing under the same org name is a false positive until it is added to `MODEL_HOST_PREFIX_RE` — the same one-line edit, in the same caller-unreachable file, that adding a repo name is. The routes between host and owner are enumerated for the same reason, so `huggingface.co/somewhere/Comfy-Org/x` is a finding. Both fail toward flagging, never toward silence.
 - **The host has to be the URL's authority, and a userinfo spelling is the accepted cost.** `_AUTHORITY_L` asks for a delimiter (or line start) before the host and consumes the scheme separator, so the one real spelling it turns away is `https://user@huggingface.co/…`, whose host genuinely is allowlisted: `@` is not a delimiter. That fails toward flagging and no corpus instance exists. One residual is documented rather than closed, because closing it costs a real false positive: a host embedded in a **query string** (`?u=huggingface.co/Comfy-Org/x`) still clears, since `=` has to stay a delimiter or a bare `VAR=huggingface.co/…` assignment over-flags.
 - **The markdown-label skip reads a BOUNDED link destination.** The destination is capped (`_MD_LINK_DEST_MAX`), and a capture that reaches the cap is treated as an incomplete read: a name running to the cut is not a whole-segment match, so it does not clear the label. Declining an over-long destination outright would be the wrong direction — real Hugging Face file URLs pass the cap routinely — so a long destination whose name ends before the cut still clears, and a destination whose real length is exactly the cap is reported as cut when it is not, over-flagging on that one length. **Reference-style links are not handled at all**: `[Comfy-Org/<model>][ref]` with the URL defined on another line stays a finding, because resolving link definitions across lines is not something a line-oriented scan can do.
diff --git a/.github/public-repo-hygiene/check_public_repo_hygiene.py b/.github/public-repo-hygiene/check_public_repo_hygiene.py
index 683a70f..606b295 100644
--- a/.github/public-repo-hygiene/check_public_repo_hygiene.py
+++ b/.github/public-repo-hygiene/check_public_repo_hygiene.py
@@ -668,6 +668,35 @@
 PARTIAL_READ = "read only up to the size cap"
 PARTIAL_FINDINGS = "reported only up to the per-file findings cap"
 
+# The three checks, nameable so a SURFACE can select a subset -- the same idea
+# as `url_suppressors` on `_line_findings`, one level up: what a surface means
+# decides which checks apply to it, not just how one check reads.
+CAT_TICKET = "ticket"
+CAT_MARKER = "marker"
+CAT_REPO = "repo"
+ALL_CATEGORIES = frozenset({CAT_TICKET, CAT_MARKER, CAT_REPO})
+
+# What a PR's TITLE and DESCRIPTION are scanned for (BE-9652). Deliberately not
+# all three, and that is a policy decision rather than an oversight.
+#
+# The ticket category is left OUT because this org's commit convention REQUIRES
+# a `(BE-####)` Linear suffix on the PR title (`AGENTS.md`, "Commit style"). A
+# ticket id in a public PR title is therefore deliberate org-wide practice, not
+# a leak: half of this repo's own recent merged PR titles carry one. Scanning
+# for it here would fail roughly every second PR on every enrolled repo -- and a
+# required check that fires on CORRECT behaviour does not get fixed, it gets
+# switched off, taking the two categories that catch real leaks with it.
+#
+# Those two are what this surface is for, and both are drawn from live incidents
+# on a public PR of THIS repo: an internal collaboration-tool permalink pasted
+# into a description (exposing a workspace and channel id), and a PRIVATE
+# `Comfy-Org/<repo>` named in a body. Neither has a convention arguing for it,
+# and neither is caught anywhere else -- no file scan can see PR text.
+#
+# If a repo ever wants tickets checked here, that is a new input, not a default
+# flip: the default has to stay the one that keeps the check switched on.
+SURFACE_CATEGORIES = frozenset({CAT_MARKER, CAT_REPO})
+
 
 class ConfigError(Exception):
     """A value passed by the caller is unusable (exit 2, not a finding)."""
@@ -1449,7 +1478,13 @@ def _codeowners_lines(text):
 
 
 def _line_findings(
-    location, line, ticket_allowlist, owner_span, *, url_suppressors=True
+    location,
+    line,
+    ticket_allowlist,
+    owner_span,
+    *,
+    url_suppressors=True,
+    categories=ALL_CATEGORIES,
 ):
     """Yield LINE's findings, each prefixed with LOCATION.
 
@@ -1481,8 +1516,13 @@ def _line_findings(
     green, which is the leak this surface was added to catch. The allowlists,
     the ticket knobs, the npm-scope crossing and the homoglyph handling are
     NOT syntax and reach both surfaces unchanged. (BE-9399 review.)
+
+    CATEGORIES selects which of the three checks run, defaulting to all of them
+    so both tracked-file surfaces are unchanged. It exists for the PR-text
+    surface, which runs `SURFACE_CATEGORIES` -- see there for why a ticket id in
+    a PR title is convention rather than a leak. (BE-9652.)
     """
-    for match in TICKET_RE.finditer(line):
+    for match in TICKET_RE.finditer(line) if CAT_TICKET in categories else ():
         token = match.group(0).upper()
         if token in ticket_allowlist:
             continue
@@ -1496,7 +1536,7 @@ def _line_findings(
             f"{match.group(0)!r}"
         )
 
-    for pattern in INTERNAL_MARKER_RES:
+    for pattern in INTERNAL_MARKER_RES if CAT_MARKER in categories else ():
         if pattern.search(line):
             yield (
                 f"{location}: internal collaboration-tool marker: "
@@ -1515,7 +1555,7 @@ def _line_findings(
     # the common case now allocates nothing at all; when one does, the scan
     # still runs exactly once.
     model_host_ends = None if url_suppressors else frozenset()
-    for match in REPO_REF_RE.finditer(line):
+    for match in REPO_REF_RE.finditer(line) if CAT_REPO in categories else ():
         if model_host_ends is None:
             model_host_ends = frozenset(
                 m.end() for m in MODEL_HOST_PREFIX_RE.finditer(line)
@@ -1739,6 +1779,54 @@ def _path_findings(rel, ticket_allowlist):
     return findings, warnings, partial
 
 
+def check_text(label, text, ticket_allowlist, categories=SURFACE_CATEGORIES):
+    """Return (findings, warnings) for one free-text surface (PR title/body).
+
+    The third surface, alongside a file's CONTENTS and its tracked PATH, and
+    built the same way as the other two: through `_line_findings`, never a
+    second matcher. A PR description publishes an internal link exactly as
+    loudly as a committed file does, so the same regexes, allowlists and
+    suppressors have to reach it -- and a forked matcher is a second place to
+    forget an allowlist entry. What differs is only WHICH categories apply
+    (`SURFACE_CATEGORIES`) and that there is no CODEOWNERS reading to do: a PR
+    body is prose, so `owner_span` is None and the `\\n`-only line model does not
+    apply. (BE-9652.)
+
+    LABEL stands in for the path in the finding line, so it must read as a
+    surface and not as a path -- `<PR title>`, not `PR-title`. Line numbers are
+    still reported, which is what makes a finding in a 40-line body locatable.
+
+    Capped exactly as a file and a path are: PR text is author-controlled and
+    unbounded, so a body of repeated `Comfy-Org/x` must not be fully enumerated
+    only to throw the tail away.
+    """
+    findings = list(
+        itertools.islice(
+            (
+                finding
+                for lineno, line in enumerate(text.splitlines(), start=1)
+                for finding in _line_findings(
+                    f"{label}:{lineno}",
+                    line,
+                    ticket_allowlist,
+                    None,
+                    categories=categories,
+                )
+            ),
+            MAX_FINDINGS_PER_FILE + 1,
+        )
+    )
+    warnings = []
+    if len(findings) > MAX_FINDINGS_PER_FILE:
+        del findings[MAX_FINDINGS_PER_FILE:]
+        warnings.append(
+            f"{label}: produced more than {MAX_FINDINGS_PER_FILE} findings; "
+            f"only the first {MAX_FINDINGS_PER_FILE} are listed -- the run "
+            f"still FAILS"
+        )
+    return findings, warnings
+
+
 def check_file(root, rel, ticket_allowlist):
     """Return (findings, warnings, skip_kind, partial) for one file.
 
@@ -1769,9 +1857,13 @@ def check_file(root, rel, ticket_allowlist):
     return findings, warnings, skip_kind, partial
 
 
-def run_checks(root, excludes=(), extra_ticket_allow=()):
+def run_checks(root, excludes=(), extra_ticket_allow=(), texts=()):
     """Scan `root`, returning a `ScanResult`.
 
+    `texts` is an optional [(label, text)] of free-text surfaces -- a PR title
+    and body -- scanned with `SURFACE_CATEGORIES` alongside the tracked files.
+    Empty by default, so a caller that passes nothing behaves exactly as before.
+
     `exclusions` is [(pattern, files_skipped)] in the caller's order, INCLUDING
     patterns that skipped nothing -- a typo'd exclusion that matches no file has
     to be visible in the log, not silently inert. `skipped` is the same
@@ -1829,6 +1921,17 @@ def run_checks(root, excludes=(), extra_ticket_allow=()):
     skipped = collections.Counter()
     partial = collections.Counter()
     findings, warnings = [], []
+
+    # PR-text surfaces go FIRST, before any file finding can reach the per-run
+    # report cap. There are at most two of them, they are the highest-signal
+    # findings this checker produces (already PUBLISHED on a public PR page,
+    # not merely committed), and they are the ones an author fixes in fifteen
+    # seconds. Ordering them behind a flood of file findings would let
+    # `MAX_FINDINGS_TOTAL` truncate exactly the ones worth acting on.
+    for _label, _text in texts:
+        _found, _warn = check_text(_label, _text, ticket_allowlist)
+        findings.extend(_found)
+        warnings.extend(_warn)
     scanned = 0
     truncated_report = False
     suppressed_warnings = 0
@@ -2060,11 +2163,56 @@ def main(argv=None):
             "single value may be comma- or newline-separated."
         ),
     )
+    parser.add_argument(
+        "--scan-text",
+        action="append",
+        default=[],
+        metavar="LABEL=PATH",
+        help=(
+            "Also scan a free-text surface (a PR title or description) read "
+            "from PATH, reported under LABEL. Repeatable. Scanned for internal "
+            "collaboration-tool links and non-public Comfy-Org repo references "
+            "only -- NOT ticket ids, which this org's commit convention "
+            "requires in public PR titles."
+        ),
+    )
     args = parser.parse_args(argv)
 
     excludes = _split_values(args.exclude)
     ticket_allow = _split_values(args.ticket_allow)
 
+    # A FILE, never an argv value. A PR title and body are author-controlled
+    # text of unbounded length that routinely contains newlines, quotes and
+    # shell metacharacters; passing them through argv would put them on the
+    # command line of a job that runs on every PR, against ARG_MAX, and would
+    # force the workflow to interpolate untrusted text into a `run:` block --
+    # the classic Actions script-injection shape. The workflow writes them to
+    # files from `env:` instead and passes paths.
+    texts = []
+    for spec in args.scan_text:
+        label, sep, path = spec.partition("=")
+        if not sep or not label or not path:
+            msg = f"--scan-text expects LABEL=PATH, got '{_esc_cmd(spec)}'"
+            print(f"FAIL: {msg}")
+            print(f"::error::public-repo-hygiene: {msg}")
+            return 2
+        try:
+            with open(path, "r", encoding="utf-8", errors="replace") as handle:
+                texts.append((label, handle.read()))
+        except OSError as exc:
+            # A surface NAMED but unreadable is a FAILURE, not an empty scan.
+            # Treating it as "" would report a green run over text nobody read
+            # -- the same not-evidence principle this checker applies to a tree
+            # it cannot enumerate.
+            msg = (
+                f"cannot read the {_esc_cmd(label)} surface "
+                f"({_esc_cmd(exc)}); refusing to report a green run over text "
+                f"that was never read"
+            )
+            print(f"FAIL: {msg}")
+            print(f"::error::public-repo-hygiene: {msg}")
+            return 2
+
     print(f"Scanning tracked files in '{_esc_cmd(args.root)}' for internal-only references...")
     # Echo the CONFIGURED knobs, not only their effect: a caller-side tuning
     # value has to be visible in the run log of the check it tunes.
@@ -2072,10 +2220,19 @@ def main(argv=None):
         print("Exclusions: " + ", ".join(_esc_cmd(p) for p in excludes))
     if ticket_allow:
         print("Extra ticket allowlist: " + ", ".join(_esc_cmd(t) for t in ticket_allow))
+    if texts:
+        # Name the surfaces AND their sizes. "Scanned the PR title" over an
+        # empty string is the failure mode worth seeing: a PR with no
+        # description is legitimately 0 chars, but so is a mis-wired `env:`,
+        # and only the count tells them apart at a glance.
+        print(
+            "Also scanning: "
+            + ", ".join(f"{_esc_cmd(l)} ({len(t)} chars)" for l, t in texts)
+        )
     print()
 
     try:
-        result = run_checks(args.root, excludes, ticket_allow)
+        result = run_checks(args.root, excludes, ticket_allow, texts)
     except ConfigError as exc:
         msg = _esc_cmd(exc)
         print(f"FAIL: {msg}")
diff --git a/.github/public-repo-hygiene/tests/test_check_public_repo_hygiene.py b/.github/public-repo-hygiene/tests/test_check_public_repo_hygiene.py
index 129dec8..ca90d60 100644
--- a/.github/public-repo-hygiene/tests/test_check_public_repo_hygiene.py
+++ b/.github/public-repo-hygiene/tests/test_check_public_repo_hygiene.py
@@ -2958,5 +2958,131 @@ def test_multi_value_inputs_are_split(self):
         )
 
 
+class PrTextSurfaceTest(CheckerTestCase):
+    """The PR title/description surface (BE-9652).
+
+    Both cases below are real leaks that happened on a public PR of this repo
+    and that the tracked-file scan structurally cannot see, because PR text is
+    never a tracked file.
+    """
+
+    def surface(self, text, label="<PR description>"):
+        return self.run_checks(texts=[(label, text)]).findings
+
+    def test_internal_collaboration_link_in_a_pr_body_is_flagged(self):
+        found = self.surface(
+            "Anne asked for this.\n"
+            "See the [thread](https://comfy-organization.slack.com"
+            "/archives/C09BAQDNDG8/p1787705844771499).\n"
+        )
+        self.assertEqual(len(found), 1, found)
+        self.assertIn("internal collaboration-tool marker", found[0])
+        # Line numbers are reported for a surface exactly as for a file, which
+        # is what makes a finding in a long PR body locatable.
+        self.assertTrue(found[0].startswith("<PR description>:2:"), found[0])
+
+    def test_private_repo_reference_in_a_pr_body_is_flagged(self):
+        found = self.surface("Commit it to Comfy-Org/github-workflows-ops first.\n")
+        self.assertEqual(len(found), 1, found)
+        self.assertIn("github-workflows-ops", found[0])
+
+    def test_a_known_public_repo_reference_is_not_flagged(self):
+        self.assertEqual(
+            self.surface("See Comfy-Org/github-workflows for the bumper.\n"), []
+        )
+
+    def test_ticket_ids_are_NOT_flagged_on_this_surface(self):
+        # The load-bearing one. This org's commit convention REQUIRES a
+        # `(BE-####)` suffix on PR titles, so flagging tickets here would fail
+        # roughly every second PR -- and a required check that fires on correct
+        # behaviour gets switched off, taking the two categories that catch real
+        # leaks with it. If someone ever "fixes" this by passing ALL_CATEGORIES,
+        # this test is what says no.
+        self.assertEqual(
+            self.surface(
+                "ci(rosters): add a leak-safe roster shape probe (BE-9651)",
+                label="<PR title>",
+            ),
+            [],
+        )
+        # ...while the very same string in a tracked FILE still is flagged, so
+        # this is a per-surface policy and not a hole in the category itself.
+        self.repo.write("README.md", "ci(rosters): probe (BE-9651)\n")
+        self.assertEqual(len(self.findings()), 1)
+
+    def test_surfaces_do_not_disturb_the_file_scan(self):
+        self.repo.write("README.md", "clean\n")
+        result = self.run_checks(texts=[("<PR title>", "clean title")])
+        self.assertEqual(result.findings, [])
+        # `scanned` counts FILES; a surface is not one, so coverage accounting
+        # is unchanged and a green run still means the same thing it did.
+        self.assertEqual(result.scanned, 1)
+
+    def test_no_surfaces_is_byte_identical_to_before(self):
+        self.repo.write("README.md", "See Comfy-Org/github-workflows-ops.\n")
+        self.assertEqual(self.run_checks(), self.run_checks(texts=[]))
+
+    def test_a_surface_is_capped_like_a_file(self):
+        body = "Comfy-Org/nope-private\n" * (checker.MAX_FINDINGS_PER_FILE + 25)
+        found = self.surface(body)
+        self.assertEqual(len(found), checker.MAX_FINDINGS_PER_FILE)
+        self.assertTrue(
+            any("still FAILS" in w for w in self.run_checks(
+                texts=[("<PR description>", body)]
+            ).warnings)
+        )
+
+    def test_findings_are_reported_before_file_findings(self):
+        # A surface finding is the highest-signal thing this checker emits (it
+        # is already published on a public PR page) and the cheapest to fix, so
+        # it must never be the thing `MAX_FINDINGS_TOTAL` truncates away.
+        self.repo.write("a.md", "Comfy-Org/some-private-repo\n")
+        found = self.run_checks(
+            texts=[("<PR description>", "Comfy-Org/other-private-repo\n")]
+        ).findings
+        self.assertTrue(found[0].startswith("<PR description>:"), found)
+
+
+class ScanTextCliTest(CheckerTestCase):
+    def _write(self, name, text):
+        path = os.path.join(self.repo.root, name)
+        with open(path, "w", encoding="utf-8") as handle:
+            handle.write(text)
+        return path
+
+    def test_label_equals_path_is_parsed_and_scanned(self):
+        self.repo.write("README.md", "clean\n")
+        path = self._write("title.txt", "Comfy-Org/github-workflows-ops\n")
+        self.assertEqual(
+            checker.main(["--root", self.repo.root, f"--scan-text=<PR title>={path}"]),
+            1,
+        )
+
+    def test_a_malformed_spec_is_a_config_error(self):
+        self.repo.write("README.md", "clean\n")
+        self.assertEqual(
+            checker.main(["--root", self.repo.root, "--scan-text=no-separator"]), 2
+        )
+
+    def test_an_unreadable_surface_fails_rather_than_scanning_nothing(self):
+        # "A lookup we could not perform is not evidence." Treating a missing
+        # file as an empty surface would report a green run over text nobody
+        # read -- which is exactly the silent pass this checker exists to deny.
+        self.repo.write("README.md", "clean\n")
+        missing = os.path.join(self.repo.root, "does-not-exist.txt")
+        self.assertEqual(
+            checker.main(["--root", self.repo.root, f"--scan-text=<PR title>={missing}"]),
+            2,
+        )
+
+    def test_a_path_containing_an_equals_sign_survives(self):
+        self.repo.write("README.md", "clean\n")
+        path = self._write("od=d.txt", "clean text\n")
+        self.assertEqual(
+            checker.main(["--root", self.repo.root, f"--scan-text=<PR title>={path}"]),
+            0,
+        )
+
+
 if __name__ == "__main__":
     unittest.main()
diff --git a/.github/workflows/public-repo-hygiene.yml b/.github/workflows/public-repo-hygiene.yml
index 298cdcb..12eb30d 100644
--- a/.github/workflows/public-repo-hygiene.yml
+++ b/.github/workflows/public-repo-hygiene.yml
@@ -251,11 +251,56 @@ jobs:
         with:
           python-version: '3.12'
 
+      - name: Capture the PR title and description
+        # The tracked-file scan cannot see PR text, and PR text is published on
+        # a public repo the moment it is typed — so it is a leak surface with no
+        # guard at all today. Two real ones, both on a public PR of THIS repo:
+        # an internal collaboration-tool permalink in a description (exposing a
+        # workspace and channel id), and a PRIVATE `Comfy-Org/<repo>` named in
+        # the body. Neither is caught anywhere else. (BE-9652)
+        #
+        # Only when the triggering event actually carries a pull request. The
+        # payload is read from the EVENT, never taken as a workflow input: an
+        # input is something the caller supplies, and a caller that can supply
+        # the text being judged can supply different text. Same reasoning as
+        # loading the checker from `workflows_ref` rather than the caller's
+        # checkout — a PR must not get to choose what the check reads.
+        if: github.event.pull_request != null
+        env:
+          # Interpolated into an `env:` VALUE, never into the `run:` body.
+          # A PR title and description are attacker-controlled strings, and
+          # `${{ … }}` inside a shell script is textual substitution before the
+          # shell ever sees it — `$(…)` in a PR title would execute on the
+          # runner. As an env var the shell only ever sees data. This is the
+          # single most important line in the step.
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          set -euo pipefail
+          # RUNNER_TEMP, deliberately NOT the workspace: anything written into
+          # the workspace would sit inside the tree the scan walks. Untracked,
+          # so `git ls-files` would not list it — but writing the text being
+          # judged into the directory being judged is a trap waiting for the
+          # first future change that scans untracked files too.
+          dir="$RUNNER_TEMP/hygiene-pr-text"
+          mkdir -p "$dir"
+          # `printf '%s'`, not `echo`: a body beginning with `-n` or containing
+          # backslashes is mangled by echo on some shells, and this text has to
+          # reach the checker byte-for-byte or the scan is over something the
+          # reader never saw. A null body (no description) arrives as the empty
+          # string, which is a legitimate 0-byte surface, not an error.
+          printf '%s' "$PR_TITLE" > "$dir/title.txt"
+          printf '%s' "$PR_BODY"  > "$dir/body.txt"
+
       - name: Scan for internal-only references
         env:
           HYGIENE_CHECK_ROOT: ${{ github.workspace }}
           TICKET_ALLOWLIST: ${{ inputs.ticket_allowlist }}
           EXCLUDE_PATHS: ${{ inputs.exclude_paths }}
+          # Empty on a non-PR event (push, schedule, dispatch), which is what
+          # makes the surface scan additive rather than a new failure mode for
+          # callers that do not run this on pull_request.
+          PR_TEXT_DIR: ${{ github.event.pull_request != null && format('{0}/hygiene-pr-text', runner.temp) || '' }}
         run: |
           # Each optional flag is added ONLY when the caller set a non-blank
           # value, so a caller that never heard of these inputs runs the exact
@@ -270,5 +315,17 @@ jobs:
           if [ -n "$(printf '%s' "$TICKET_ALLOWLIST" | tr -d '[:space:]')" ]; then
             args+=("--ticket-allow=$TICKET_ALLOWLIST")
           fi
+          # The two PR surfaces, when the event carried one. The labels read as
+          # surfaces rather than paths (`<PR title>`, not `PR-title`) so a
+          # finding line cannot be mistaken for a file in the tree.
+          #
+          # Passed as PATHS, never as values: the title and body are unbounded
+          # author-controlled text, and putting them on the command line would
+          # count against ARG_MAX and force them back through the shell. The
+          # previous step already wrote them, from `env:`, as bytes.
+          if [ -n "$PR_TEXT_DIR" ]; then
+            args+=("--scan-text=<PR title>=$PR_TEXT_DIR/title.txt")
+            args+=("--scan-text=<PR description>=$PR_TEXT_DIR/body.txt")
+          fi
           python3 "$GITHUB_WORKSPACE/_public_repo_hygiene/.github/public-repo-hygiene/check_public_repo_hygiene.py" \
             "${args[@]}"
diff --git a/docs/callers/public-repo-hygiene.md b/docs/callers/public-repo-hygiene.md
index 5b68f4e..5648dbb 100644
--- a/docs/callers/public-repo-hygiene.md
+++ b/docs/callers/public-repo-hygiene.md
@@ -45,6 +45,8 @@ name: Public Repo Hygiene
 
 on:
   pull_request:
+    # `edited` is LOAD-BEARING, not tidiness — see below.
+    types: [opened, synchronize, reopened, edited]
   push:
     branches: [main]        # or [master] — your default branch
 
@@ -57,6 +59,20 @@ jobs:
       workflows_ref: <same-full-commit-sha>
 ```
 
+### Why `types:` must include `edited`
+
+The scan covers the PR **title and description** as well as tracked files, because
+both are published the moment they are typed and no file scan can see them.
+
+GitHub's default `pull_request` types are `opened`, `synchronize` and `reopened` —
+and **none of them fire when someone edits the title or body**. Without `edited`,
+a PR can be opened clean, go green, and then have an internal link pasted into its
+description with the required check still showing a pass over text it never read.
+
+The reusable cannot enforce this: `on:` belongs to your caller, and a workflow has
+no way to read the trigger types it was configured with. So it is on this page,
+and it is the one line of the example you should not simplify away.
+
 Then ask a maintainer to add your repo to the `PUBLIC_REPO_HYGIENE_CALLERS` roster secret — the
 pin does not move on its own, and a stale pin means a stale allowlist.