chore(gha): update mobsuccess.yml GitHub workflow

[ms-bot]

Why is this needed?

This pull request has been created by a robot to update the mobsuccess.yml GitHub workflow.

[maximus-agents]

🤖 fix-approve-merge

Outcome: BLOCKED ⛔
Head commit: 9673015

Replied to and resolved the Copilot thread without modifying the generated workflow-sync PR; required CI has Prettier failing, and no Linear check is present.

Next: Upstream policy owners must fix the fail-closed workflow and regenerate the PR (or otherwise make Prettier pass) before approval and merge.

[Copilot]

Pull request overview

This PR updates the repository’s mobsuccess.yml workflow (used for Mobsuccess compliance checks) to add a PR-only checkout and a guard step that detects dangerous cases where a tracked file/symlink can replace an ignored directory (and where tracked symlinks escape the repo), preventing silent data loss on merge/checkout.

Changes:

• Add a PR-only actions/checkout with full history and blob:none filtering to enable commit-graph-based checks while keeping blob download on-demand.
• Add a PR-only “Ignored directory replacement” step that scans the PR diff/tree to detect ignored-directory replacement scenarios and symlinks pointing outside the repository.

Suppressed comments (2)

.github/workflows/mobsuccess.yml:105

• ignored() treats any non-zero from git check-ignore as “not ignored”. That means a real git error (e.g. repo init/config issue) can be misinterpreted as a safe result, which contradicts the “fail closed” intent. Capture the exit code and hard-fail on unexpected values.

          ignored() {
            git -c core.excludesFile=/dev/null -C "$sandbox" \
              check-ignore -q --no-index -- "$1"
          }

.github/workflows/mobsuccess.yml:101

• The script aims to be fail-closed, but the sandbox exclude-file reset is not guarded. A redirection failure here could make the ignore verdict depend on runner-global excludes (or later git behavior) and still pass the check.

          : > "$sandbox/.git/info/exclude"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.