wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): align gitea attestation approval lane [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-05-17 21:01:48 +08:00
parent 9513dd9116
commit 57b4298be3
14 changed files with 111 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/security/SECURITY-FOLLOWUP-RUNTIME-GATE.md
View File

@@ -2,7 +2,7 @@
| 項目 | 內容 |
|------|------|
| 日期 | 2026-05-13 |
| 日期 | 2026-05-17 |
| 狀態 | 草案 |
| Schema | `docs/schemas/security_followup_runtime_gate_v1.schema.json` |
| Snapshot | `docs/security/security-followup-runtime-gate.snapshot.json` |
@@ -33,7 +33,7 @@
|----------|------|----------|
| Redacted finding ingestion | MEDIUM | 只準備 ingestion adapter 的 redaction / audit 前置條件 |
| Safe web crawl scope | MEDIUM | 只準備 TLS/header/basic crawl 的低噪音 scope |
| Gitea read-only inventory | MEDIUM | 只準備 read-only token 或 redacted export inventory |
| Gitea owner attestation + read-only inventory | MEDIUM | 先準備 S4.7 owner scope decision，再準備 read-only token 或 redacted export inventory |
| GitHub target decision | HIGH | 只準備 owner / visibility / canonical / workflow parity 決策 |
| Ref truth review | HIGH | 只準備 refs truth / deprecated / release tag 人工判定 |
| Credentialed scan exception | HIGH | 只準備人工 exception、credential lifecycle 與停用方式 |
@@ -61,3 +61,5 @@
S3.4 是「批准後仍不能直接做事」的保險絲。
它讓未來真正進 runtime 前的資料門檻先被定義清楚，但仍維持初期低摩擦：目前只顯示、只準備、只留痕，不執行。
2026-05-17 S4.8 追加：Gitea follow-up runtime gate 已要求 S4.7 owner coverage attestation 先完成。即使未來 read-only inventory 被批准，仍要先看 public-only / local remote gap、org/user endpoint、110 adjacent source、canonical owner 與 legacy/inaccessible disposition 的 owner decision；未完成前不得執行 inventory。