wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(iwooos): 強化前台敏感資訊防洩漏 guard
All checks were successful
Code Review / ai-code-review (push) Successful in 13s
Details
CD Pipeline / tests (push) Successful in 1m38s
Details
CD Pipeline / build-and-deploy (push) Successful in 3m44s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m28s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-15 15:46:29 +08:00
parent b16f4c7332
commit 65f2d50d69
14 changed files with 395 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
scripts/security/security-mirror-progress-guard.py
View File

@@ -87,6 +87,39 @@ def validate(root: Path) -> None:
str(root / "scripts" / "security" / "public-frontend-env-guard.py")
)
public_frontend_env_guard["validate"](root)
public_frontend_sensitive_surface = load_json(
security_dir / "public-frontend-sensitive-surface-guard.snapshot.json"
)
assert_equal(
"public_frontend_sensitive_surface.schema_version",
public_frontend_sensitive_surface["schema_version"],
"public_frontend_sensitive_surface_guard_v1",
)
assert_equal(
"public_frontend_sensitive_surface.summary.public_surface_file_count",
public_frontend_sensitive_surface["summary"]["public_surface_file_count"],
225,
)
assert_equal(
"public_frontend_sensitive_surface.summary.forbidden_pattern_count",
public_frontend_sensitive_surface["summary"]["forbidden_pattern_count"],
12,
)
assert_equal(
"public_frontend_sensitive_surface.summary.allowlisted_match_count",
public_frontend_sensitive_surface["summary"]["allowlisted_match_count"],
2,
)
assert_equal(
"public_frontend_sensitive_surface.summary.violation_count",
public_frontend_sensitive_surface["summary"]["violation_count"],
0,
)
assert_equal(
"public_frontend_sensitive_surface.summary.runtime_gate_count",
public_frontend_sensitive_surface["summary"]["runtime_gate_count"],
0,
)
manifest = load_json(security_dir / "security-supply-chain-contract-manifest.snapshot.json")
readiness = load_json(security_dir / "security-mirror-readiness.snapshot.json")
@@ -2714,7 +2747,7 @@ def validate(root: Path) -> None:
assert_equal(
"high_value_config_coverage.summary.average_coverage_percent",
high_value_config_coverage["summary"]["average_coverage_percent"],
69,
70,
)
assert_equal(
"high_value_config_coverage.summary.needs_live_evidence_count",
@@ -3104,18 +3137,19 @@ def validate(root: Path) -> None:
assert_equal(
"high_value_config_coverage.coverage_categories.public_runtime_config.coverage_percent",
public_runtime_config_category["coverage_percent"],
64,
66,
)
assert_equal(
"high_value_config_coverage.coverage_categories.public_runtime_config.coverage_status",
public_runtime_config_category["coverage_status"],
"change_evidence_acceptance_ready_needs_runtime_config_owner_evidence",
"frontend_sensitive_surface_guard_ready_needs_runtime_config_owner_evidence",
)
for evidence_ref in [
"docs/HARD_RULES.md",
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
"docs/security/PUBLIC-RUNTIME-CONFIG-CHANGE-EVIDENCE-ACCEPTANCE.md",
"docs/security/public-runtime-config-change-evidence-acceptance.snapshot.json",
"docs/security/public-frontend-sensitive-surface-guard.snapshot.json",
]:
assert_contains(
"high_value_config_coverage.coverage_categories.public_runtime_config.evidence_refs",
@@ -6346,6 +6380,7 @@ def validate(root: Path) -> None:
"docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json",
"docs/security/public-runtime-config-change-evidence-acceptance.snapshot.json",
"docs/security/PUBLIC-RUNTIME-CONFIG-CHANGE-EVIDENCE-ACCEPTANCE.md",
"docs/security/public-frontend-sensitive-surface-guard.snapshot.json",
]:
assert_contains(
"iwooos_projection.source_paths.config_inventory",
@@ -6370,7 +6405,7 @@ def validate(root: Path) -> None:
"high_value_config_control_coverage_category_count": 14,
"high_value_config_control_coverage_c0_category_count": 8,
"high_value_config_control_coverage_c1_category_count": 4,
"high_value_config_control_coverage_average_percent": 69,
"high_value_config_control_coverage_average_percent": 70,
"high_value_config_control_coverage_needs_live_evidence_count": 10,
"high_value_config_control_coverage_owner_response_required_count": 14,
"high_value_config_control_coverage_owner_response_received_count": 0,
@@ -6378,6 +6413,12 @@ def validate(root: Path) -> None:
"high_value_config_control_coverage_runtime_gate_count": 0,
"high_value_config_control_coverage_action_button_count": 0,
"high_value_config_control_coverage_lowest_category_count": 4,
"public_admin_api_runtime_config_coverage_percent": 66,
"public_frontend_sensitive_surface_guard_file_count": 225,
"public_frontend_sensitive_surface_guard_forbidden_pattern_count": 12,
"public_frontend_sensitive_surface_guard_allowlisted_match_count": 2,
"public_frontend_sensitive_surface_guard_violation_count": 0,
"public_frontend_sensitive_surface_guard_runtime_gate_count": 0,
}
for key, expected in expected_high_value_config_coverage_summary.items():
assert_equal(
@@ -16286,7 +16327,7 @@ def validate(root: Path) -> None:
"high_value_config_control_coverage_category_count=14",
"high_value_config_control_coverage_c0_category_count=8",
"high_value_config_control_coverage_c1_category_count=4",
"high_value_config_control_coverage_average_percent=69",
"high_value_config_control_coverage_average_percent=70",
"high_value_config_control_coverage_needs_live_evidence_count=10",
"high_value_config_control_coverage_owner_response_required_count=14",
"high_value_config_control_coverage_owner_response_received_count=0",
@@ -16301,7 +16342,11 @@ def validate(root: Path) -> None:
"k8s_production_gitops_coverage_percent=64",
"secret_metadata_coverage_percent=68",
"gitea_workflow_runner_source_control_coverage_percent=72",
"public_admin_api_runtime_config_coverage_percent=64",
"public_admin_api_runtime_config_coverage_percent=66",
"public_frontend_sensitive_surface_guard_file_count=225",
"public_frontend_sensitive_surface_guard_forbidden_pattern_count=12",
"public_frontend_sensitive_surface_guard_violation_count=0",
"public_frontend_sensitive_surface_guard_runtime_gate_count=0",
"public_runtime_config_change_evidence_acceptance_candidate_count=6",
"public_runtime_config_change_evidence_acceptance_c0_candidate_count=5",
"public_runtime_config_change_evidence_acceptance_c1_candidate_count=1",
@@ -16578,7 +16623,10 @@ def validate(root: Path) -> None:
"nginx_public_gateway_nginx_test_evidence_count=0",
"secret_metadata_coverage_percent=68",
"gitea_workflow_runner_source_control_coverage_percent=72",
"public_admin_api_runtime_config_coverage_percent=64",
"public_admin_api_runtime_config_coverage_percent=66",
"public_frontend_sensitive_surface_guard_file_count=225",
"public_frontend_sensitive_surface_guard_forbidden_pattern_count=12",
"public_frontend_sensitive_surface_guard_violation_count=0",
"public_runtime_config_change_evidence_acceptance_candidate_count=6",
"public_runtime_config_change_evidence_acceptance_c0_candidate_count=5",
"public_runtime_config_change_evidence_acceptance_write_capable_candidate_count=6",