wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

docs(security): add github target owner request packet

Browse Source
This commit is contained in:
Your Name
2026-05-18 14:23:11 +08:00
parent 434d87d129
commit 7be8868e5a
30 changed files with 252 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
scripts/security/source-control-owner-response-guard.py
View File

@@ -42,6 +42,13 @@ LANES = [
"keep_waiting_owner_response",
],
"expected_request_packet_id": "s4_9_gitea_owner_attestation_response_request",
"expected_request_template_ids": [
"response-public-only-vs-local-gitea-gap",
"response-org-user-endpoint-identity",
"response-internal-110-adjacent-scope",
"response-repo-owner-canonical-scope",
"response-legacy-or-inaccessible-disposition",
],
"expected_collection_checks": [
"collection-request-packet-displayed",
"collection-read-only-submission-mode",
@@ -92,6 +99,16 @@ LANES = [
"secret_value_collection_allowed",
"action_buttons_allowed",
],
"expected_request_packet_id": "s4_10_github_target_owner_decision_response_request",
"expected_request_template_ids": [
"target-awoooi-refs-blocked",
"target-clawbot-v5-refs-blocked",
"target-wooo-aiops-refs-blocked",
"target-wooo-infra-config-internal-remote",
"target-ewoooc-private-or-new",
"target-bitan-pharmacy-private-or-new",
"target-tsenyang-website-private-or-new",
],
},
{
"lane_id": "s4_11_ref_truth_owner_response",
@@ -364,6 +381,7 @@ def validate(root: Path) -> None:
expected_request_packet_id = lane.get("expected_request_packet_id")
if expected_request_packet_id is not None:
request_packet = snapshot["owner_response_request_packet"]
expected_request_template_ids = lane["expected_request_template_ids"]
assert_equal(
f"{lane['lane_id']}.owner_response_request_packet_count",
summary["owner_response_request_packet_count"],
@@ -382,13 +400,7 @@ def validate(root: Path) -> None:
assert_equal(
f"{lane['lane_id']}.owner_response_request_template_ids",
request_packet["requested_template_ids"],
[
"response-public-only-vs-local-gitea-gap",
"response-org-user-endpoint-identity",
"response-internal-110-adjacent-scope",
"response-repo-owner-canonical-scope",
"response-legacy-or-inaccessible-disposition",
],
expected_request_template_ids,
)
assert_equal(
f"{lane['lane_id']}.owner_response_request_awooop_display_mode",