From 2835cf912ebeff160cd0b16f1e2108a0ff999b15 Mon Sep 17 00:00:00 2001 From: AWOOOI CD Date: Fri, 10 Jul 2026 15:47:28 +0800 Subject: [PATCH 1/3] chore(cd): deploy 7134ff3 [skip ci] --- k8s/awoooi-prod/06-deployment-api.yaml | 4 ++-- k8s/awoooi-prod/kustomization.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/k8s/awoooi-prod/06-deployment-api.yaml b/k8s/awoooi-prod/06-deployment-api.yaml index b324eef18..447312164 100644 --- a/k8s/awoooi-prod/06-deployment-api.yaml +++ b/k8s/awoooi-prod/06-deployment-api.yaml @@ -84,12 +84,12 @@ spec: - name: AWOOOI_BUILD_COMMIT_SHA # 2026-06-29 Codex: CD rewrites this to the deployed image tag so # production deploy readback does not rely on a stale static snapshot. - value: "3b1c659f14c82eb6128cb234e3aab2744c5034fa" + value: "7134ff338e7c7d393dee96de58b08fbd69c27f5a" - name: AWOOOI_DESIRED_API_IMAGE_TAG # 2026-06-30 Codex: CD rewrites this alongside AWOOOI_BUILD_COMMIT_SHA. # Production readback compares runtime image truth against this # GitOps desired tag instead of doing a slow Gitea raw fetch. - value: "3b1c659f14c82eb6128cb234e3aab2744c5034fa" + value: "7134ff338e7c7d393dee96de58b08fbd69c27f5a" - name: DATABASE_POOL_SIZE # 2026-07-01 Codex: production role `awoooi` currently has a low # connection limit. Keep API pool conservative until DB role diff --git a/k8s/awoooi-prod/kustomization.yaml b/k8s/awoooi-prod/kustomization.yaml index 49125516d..e1add3c1f 100644 --- a/k8s/awoooi-prod/kustomization.yaml +++ b/k8s/awoooi-prod/kustomization.yaml @@ -41,7 +41,7 @@ resources: images: - name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/api - newTag: 3b1c659f14c82eb6128cb234e3aab2744c5034fa + newTag: 7134ff338e7c7d393dee96de58b08fbd69c27f5a - name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/web - newTag: 3b1c659f14c82eb6128cb234e3aab2744c5034fa + newTag: 7134ff338e7c7d393dee96de58b08fbd69c27f5a From a049c909e270a225300b6780f079472c47ec149d Mon Sep 17 00:00:00 2001 From: ogt Date: Fri, 10 Jul 2026 15:48:10 +0800 Subject: [PATCH 2/3] fix(iwooos): compact security cockpit --- apps/web/messages/en.json | 11 ++ apps/web/messages/zh-TW.json | 11 ++ apps/web/src/app/[locale]/iwooos/page.tsx | 225 +++++++++++++++++++--- 3 files changed, 222 insertions(+), 25 deletions(-) diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index ec263187a..76b2c4cae 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -21829,6 +21829,7 @@ "domainStatusLabel": "狀態", "p0Title": "P0 優先順序", "p0Intro": "以下是下一階段真正能降低即時風險的順序；每一項都需要脫敏證據與 owner acceptance，不能靠 UI 可見或一般批准跳過。", + "p0More": "Show remaining {count} P0 items and evidence requirements", "requiredEvidenceLabel": "需要證據", "boundaryTitle": "不可假綠燈規則", "status": { @@ -21876,6 +21877,16 @@ }, "review": { "title": "為什麼還沒有完成資安管理閉環", + "p0Queue": "Next P0 queue", + "toolRail": "External security tools", + "aiLoop": "AI automation loop", + "rootCauseDetails": "Show root causes and closure gates", + "cockpit": { + "findingCount": "Findings", + "p0Count": "P0", + "toolCount": "Tools", + "aiStageCount": "AI stages" + }, "diagnosis": { "controlPlaneRuntimeGap": "控制面已建立，runtime 防護閉環未完成", "unknown": "需要重新讀回診斷狀態" diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index cd6d47e6a..2e82ae560 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -21829,6 +21829,7 @@ "domainStatusLabel": "狀態", "p0Title": "P0 優先順序", "p0Intro": "以下是下一階段真正能降低即時風險的順序；每一項都需要脫敏證據與 owner acceptance，不能靠 UI 可見或一般批准跳過。", + "p0More": "展開其餘 {count} 個 P0 與證據要求", "requiredEvidenceLabel": "需要證據", "boundaryTitle": "不可假綠燈規則", "status": { @@ -21876,6 +21877,16 @@ }, "review": { "title": "為什麼還沒有完成資安管理閉環", + "p0Queue": "下一步 P0 queue", + "toolRail": "外部資安工具軌", + "aiLoop": "AI 自動化閉環", + "rootCauseDetails": "展開根因與 closure 條件", + "cockpit": { + "findingCount": "根因", + "p0Count": "P0", + "toolCount": "工具", + "aiStageCount": "AI 階段" + }, "diagnosis": { "controlPlaneRuntimeGap": "控制面已建立，runtime 防護閉環未完成", "unknown": "需要重新讀回診斷狀態" diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index dd141ba42..93668bf5c 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -8770,6 +8770,37 @@ function IwoooSSecurityControlCoverageBoard() { ] const domains = data?.domains ?? [] const p0Actions = data?.p0_next_actions ?? [] + const orderedP0Actions = review?.priority_work_items ?? p0Actions + const p0Preview = orderedP0Actions.slice(0, 4) + const p0Remainder = orderedP0Actions.slice(4) + const toolTracks = review?.security_tool_integration_matrix ?? [] + const aiLoopStages = review?.ai_automation_closure_loop ?? [] + const cockpitStats = review ? [ + { + key: 'findingCount', + value: String(review.root_cause_summary.length), + icon: FileWarning, + tone: 'warn' as const, + }, + { + key: 'p0Count', + value: String(review.priority_work_items.length), + icon: ListChecks, + tone: 'warn' as const, + }, + { + key: 'toolCount', + value: String(toolTracks.length), + icon: SearchCheck, + tone: 'steady' as const, + }, + { + key: 'aiStageCount', + value: String(aiLoopStages.length), + icon: Workflow, + tone: 'steady' as const, + }, + ] : [] return (
- - + + {t('review.title')}
- + {t(`review.diagnosis.${securityReviewDiagnosisKey(review.completion_diagnosis.diagnosis)}` as never)}
-
- {reviewFindings.map(finding => ( + +
+ {cockpitStats.map(item => { + const Icon = item.icon + return ( +
+
+ + {t(`review.cockpit.${item.key}` as never)} + + +
+
+ {item.value} +
+
+ ) + })} +
+ +
+
+
+ + {t('review.p0Queue')} +
+
+ {p0Preview.map(action => ( +
+ {action.priority} + {action.title} +
+ ))} +
+
+ +
+
+
+ + {t('review.toolRail')} +
+
+ {toolTracks.slice(0, 8).map(tool => ( + + {tool.tool_id} + + ))} +
+
+ +
+
+ + {t('review.aiLoop')} +
+
+ {aiLoopStages.map(stage => ( +
+ {stage.stage_id} +
+ ))} +
+
+
+
+ +
+ + {t('review.rootCauseDetails')} + +
+ {reviewFindings.map(finding => (
- {finding.severity} - {finding.title} + {finding.severity} + {finding.title}
-

+

{finding.required_closure}

- ))} -
+ ))} +
+ ) : null} @@ -8952,18 +9102,43 @@ function IwoooSSecurityControlCoverageBoard() { {t('p0Intro')}

- {p0Actions.map(action => ( -
-
- {action.priority} - {action.title} + {p0Preview.map(action => ( +
+
+ {action.priority} + {action.title} +
-

- {t('requiredEvidenceLabel')}：{action.required_evidence} -

-
- ))} + ))}
+ {p0Remainder.length > 0 ? ( +
+ + {t('p0More', { count: p0Remainder.length })} + +
+ {p0Remainder.map(action => ( +
+
+ {action.priority} + {action.title} +
+

+ {t('requiredEvidenceLabel')}：{action.required_evidence} +

+
+ ))} +
+
+ ) : null}
Date: Fri, 10 Jul 2026 15:54:49 +0800 Subject: [PATCH 3/3] chore(cd): deploy a049c90 [skip ci] --- k8s/awoooi-prod/06-deployment-api.yaml | 4 ++-- k8s/awoooi-prod/kustomization.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/k8s/awoooi-prod/06-deployment-api.yaml b/k8s/awoooi-prod/06-deployment-api.yaml index 447312164..cb346db6d 100644 --- a/k8s/awoooi-prod/06-deployment-api.yaml +++ b/k8s/awoooi-prod/06-deployment-api.yaml @@ -84,12 +84,12 @@ spec: - name: AWOOOI_BUILD_COMMIT_SHA # 2026-06-29 Codex: CD rewrites this to the deployed image tag so # production deploy readback does not rely on a stale static snapshot. - value: "7134ff338e7c7d393dee96de58b08fbd69c27f5a" + value: "a049c909e270a225300b6780f079472c47ec149d" - name: AWOOOI_DESIRED_API_IMAGE_TAG # 2026-06-30 Codex: CD rewrites this alongside AWOOOI_BUILD_COMMIT_SHA. # Production readback compares runtime image truth against this # GitOps desired tag instead of doing a slow Gitea raw fetch. - value: "7134ff338e7c7d393dee96de58b08fbd69c27f5a" + value: "a049c909e270a225300b6780f079472c47ec149d" - name: DATABASE_POOL_SIZE # 2026-07-01 Codex: production role `awoooi` currently has a low # connection limit. Keep API pool conservative until DB role diff --git a/k8s/awoooi-prod/kustomization.yaml b/k8s/awoooi-prod/kustomization.yaml index e1add3c1f..8069b562d 100644 --- a/k8s/awoooi-prod/kustomization.yaml +++ b/k8s/awoooi-prod/kustomization.yaml @@ -41,7 +41,7 @@ resources: images: - name: 192.168.0.110:5000/library/api:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/api - newTag: 7134ff338e7c7d393dee96de58b08fbd69c27f5a + newTag: a049c909e270a225300b6780f079472c47ec149d - name: 192.168.0.110:5000/library/web:IMAGE_TAG_PLACEHOLDER newName: 192.168.0.110:5000/awoooi/web - newTag: 7134ff338e7c7d393dee96de58b08fbd69c27f5a + newTag: a049c909e270a225300b6780f079472c47ec149d