exclude certain paths from diff checking in repo guard

.github/repo-guard.toml

@@ -1,3 +1,3 @@
 # Single source of truth for repo-guard policy. See scripts/repo-guard.ts and
 # .github/workflows/repo-guard.yml for the checks that consume this file.
 #
@@ -95,3 +95,13 @@
   ".github/workflows/repo-guard.yml",
   "scripts/repo-guard.ts",
 ]
+
+# Directories whose *content* is excluded from the heuristic diff scan.
+# Name-level tracking (files = [...] above) is unaffected. These hold only
+# content the heuristics cannot meaningfully scan (PDFs, images, compiled
+# .so), and large text-misdetected files here crash the guard's diff buffer.
+exclude_paths = [
+  "audits/",
+  "docs/.gitbook/assets/",
+  "verifiable-builds/",
+]

scripts/repo-guard.ts

@@ -1,3 +1,3 @@
 // Repository Guard for the futarchy programs repo.
 //
 // Reads .github/repo-guard.toml as policy and runs the checks below.
@@ -48,6 +48,7 @@
   packageMinAgeDays: number;
   actionShaAllowlist: Map<string, Set<string>>;
   sensitiveFiles: Set<string>;
+  excludePaths: string[];
 };
 
 type CargoViolation = {
@@ -258,6 +259,12 @@
     for (const f of sd) sensitiveFiles.add(f);
   }
 
+  const excludePaths: string[] = [];
+  const ep = toml["sensitive_diff"]?.["exclude_paths"];
+  if (Array.isArray(ep)) {
+    for (const p of ep) excludePaths.push(p);
+  }
+
   const workflowSolanaCli = new Map<string, string>();
   for (const [k, v] of Object.entries(
     toml["toolchain.workflow_solana_cli"] ?? {},
@@ -283,6 +290,7 @@
     packageMinAgeDays: requireNumber("cargo", "package_min_age_days"),
     actionShaAllowlist: allowlist,
     sensitiveFiles,
+    excludePaths,
   };
 }
 
@@ -292,6 +300,7 @@
   return execFileSync(command, args, {
     cwd: ROOT,
     encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024, // 16 MiB — clears every realistic PR (worst case ~7.5 MB raw)
   }).trim();
 }
 
@@ -1137,6 +1146,9 @@
     "--unified=0",
     "--no-color",
     `${diffBase}...HEAD`,
+    "--",
+    ".",
+    ...config.excludePaths.map((p) => `:(exclude)${p}`),
   ]);
 
   const findings: SensitiveFinding[] = [];