wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(web): show owner response validation contracts

Browse Source
This commit is contained in:
Your Name
2026-05-21 12:21:51 +08:00
parent 701294ceda
commit 747d07e578
8 changed files with 351 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

99
scripts/security/security-mirror-progress-guard.py
View File

@@ -45,6 +45,22 @@ def assert_text_not_contains(label: str, text: str, forbidden: str) -> None:
raise SystemExit(f"BLOCKED {label}: forbidden {forbidden!r}")
def collect_string_values(value: Any) -> list[str]:
if isinstance(value, str):
return [value]
if isinstance(value, list):
collected: list[str] = []
for item in value:
collected.extend(collect_string_values(item))
return collected
if isinstance(value, dict):
collected = []
for item in value.values():
collected.extend(collect_string_values(item))
return collected
return []
def validate(root: Path) -> None:
security_dir = root / "docs" / "security"
@@ -291,6 +307,7 @@ def validate(root: Path) -> None:
"s2_71_awooop_run_detail_traditional_chinese_wording_guard",
"s2_72_awooop_home_owner_response_validation_rollup",
"s2_73_awooop_work_items_owner_response_validation_candidate",
"s2_74_awooop_contracts_owner_response_validation_candidate",
]
assert_equal(
"progress_delta_ledger.delta_ids",
@@ -395,6 +412,11 @@ def validate(root: Path) -> None:
[item["action_id"] for item in rollup["next_safe_actions"] if isinstance(item, dict)],
"show_awooop_contracts_github_primary_readiness_candidate",
)
assert_contains(
"rollup.next_safe_actions.action_ids",
[item["action_id"] for item in rollup["next_safe_actions"] if isinstance(item, dict)],
"show_awooop_contracts_owner_response_validation_candidate",
)
assert_contains(
"rollup.next_safe_actions.action_ids",
[item["action_id"] for item in rollup["next_safe_actions"] if isinstance(item, dict)],
@@ -520,6 +542,30 @@ def validate(root: Path) -> None:
forbidden,
)
zh_awooop_contracts_value_text = "\n".join(collect_string_values(web_messages_zh["awooop"]["contracts"]))
for forbidden in [
"secret value",
"workflow / secret",
"runtime gate",
"runtime enforcement",
"候選 repo",
"範圍內 repo",
"repo 建立",
"repo / refs",
"refs 變更",
"refs 動作",
"sync / delete / force push",
"received / accepted",
"received / accepted / rejected",
"waiting owner response",
"未 complete",
]:
assert_text_not_contains(
"web_messages.zh-TW.awooop_contracts_wording",
zh_awooop_contracts_value_text,
forbidden,
)
zh_awooop_home_security_text = json.dumps(
{
"securityMirror": web_messages_zh["awooop"]["home"]["securityMirror"],
@@ -5761,6 +5807,10 @@ def validate(root: Path) -> None:
assert_text_contains("awooop_contracts_page.security_contract_candidate_panel", awooop_contracts_page, "SecurityContractCandidatePanel")
assert_text_contains("awooop_contracts_page.iwooos_link", awooop_contracts_page, 'href="/iwooos"')
assert_text_contains("awooop_contracts_page.project_header_traditional_chinese", awooop_contracts_page, "專案 ID")
assert_text_contains("awooop_contracts_page.hash_header_traditional_chinese", awooop_contracts_page, "雜湊")
assert_text_not_contains("awooop_contracts_page.project_header_english", awooop_contracts_page, "Project ID")
assert_text_not_contains("awooop_contracts_page.hash_header_english", awooop_contracts_page, ">Hash<")
for text in [
"contract_publish_authorized=false",
"contract_mutation_authorized=false",
@@ -5844,6 +5894,55 @@ def validate(root: Path) -> None:
key,
)
assert_text_contains(
"awooop_contracts_page.owner_response_validation_candidate_panel",
awooop_contracts_page,
"OwnerResponseValidationContractCandidatePanel",
)
for text in [
"owner_response_validation_received_count=0",
"owner_response_validation_accepted_count=0",
"approval_record_created=false",
"repo_creation_authorized=false",
"refs_sync_authorized=false",
"workflow_modification_authorized=false",
"secret_value_collection_allowed=false",
"github_primary_switch_authorized=false",
"runtime_execution_authorized=false",
"action_buttons_allowed=false",
]:
assert_text_contains("awooop_contracts_page.owner_response_validation_boundary", awooop_contracts_page, text)
for text in [
"source_control_owner_response_validation_rollup_v1",
"gitea_inventory_owner_attestation_response_v1",
"github_target_owner_decision_response_v1",
"source_control_ref_truth_owner_response_v1",
"source_control_workflow_secret_name_owner_response_v1",
]:
assert_text_contains("awooop_contracts_page.owner_response_validation_refs", awooop_contracts_page, text)
for key in [
"title",
"subtitle",
"badge",
"contractRefsTitle",
"boundaryLabel",
"boundaryTitle",
"boundaryDetail",
"openIwooos",
"metrics",
"contractRefs",
]:
assert_contains(
"web_messages.zh-TW.awooop.contracts.ownerResponseValidationCandidate",
list(web_messages_zh["awooop"]["contracts"]["ownerResponseValidationCandidate"].keys()),
key,
)
assert_contains(
"web_messages.en.awooop.contracts.ownerResponseValidationCandidate",
list(web_messages_en["awooop"]["contracts"]["ownerResponseValidationCandidate"].keys()),
key,
)
assert_text_contains("iwooos_bridge.component", iwooos_bridge, "IwoooSReadOnlyBridge")
assert_text_contains("iwooos_bridge.testid", iwooos_bridge, 'data-testid="iwooos-read-only-bridge"')
assert_text_contains("iwooos_bridge.iwooos_link", iwooos_bridge, 'href="/iwooos"')