Enforce private-by-default enablement templates

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

tools/check_private_defaults.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+"""Fail when an enablement template creates a public Kubernetes path."""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+
+
+FORBIDDEN = {
+    "Ingress resource": re.compile(r"(?m)^\s*kind:\s*(Ingress|IngressRoute)\s*$"),
+    "public Service type": re.compile(r"(?m)^\s*type:\s*(LoadBalancer|NodePort)\s*$"),
+    "direct kubectl apply": re.compile(r"\bkubectl\s+(?:[^\n]*\s)?apply\b"),
+    "direct helm deployment": re.compile(r"\bhelm\s+(upgrade|install)\b"),
+}
+
+
+def violations(paths: list[Path]) -> list[str]:
+    found: list[str] = []
+    for path in paths:
+        text = path.read_text(encoding="utf-8")
+        for label, pattern in FORBIDDEN.items():
+            if pattern.search(text):
+                found.append(f"{path}: {label}")
+    return found
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("paths", nargs="*", type=Path)
+    args = parser.parse_args()
+    paths = args.paths or sorted(Path("workflows").glob("*.yaml"))
+    problems = violations(paths)
+    if problems:
+        print("\n".join(problems), file=sys.stderr)
+        return 1
+    print(f"private-default template check passed: {len(paths)} file(s)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())