wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add gitea owner response preflight

Browse Source
This commit is contained in:
Your Name
2026-05-18 09:55:48 +08:00
parent 68e0cd7b2e
commit 835820b58b
27 changed files with 197 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
scripts/security/source-control-owner-response-guard.py
View File

@@ -26,6 +26,14 @@ LANES = [
"github_primary_switch_authorized",
"action_buttons_allowed",
],
"expected_preflight_checks": [
"preflight-known-attestation-item",
"preflight-required-owner-fields",
"preflight-allowed-decision",
"preflight-redacted-evidence-only",
"preflight-no-execution-request",
"preflight-all-five-items-before-accepted",
],
},
{
"lane_id": "s4_10_github_target_owner_decision_response",
@@ -155,6 +163,30 @@ def validate(root: Path) -> None:
assert_equal(f"{lane['lane_id']}.rejected_response_count", summary["rejected_response_count"], 0)
assert_equal(f"{lane['lane_id']}.acceptance_check_count", summary["acceptance_check_count"], 8)
assert_equal(f"{lane['lane_id']}.rejection_rule_count", summary["rejection_rule_count"], 10)
expected_preflight_checks = lane.get("expected_preflight_checks")
if expected_preflight_checks is not None:
intake_preflight_checks = snapshot["intake_preflight_checks"]
assert_equal(
f"{lane['lane_id']}.intake_preflight_check_count",
summary["intake_preflight_check_count"],
len(expected_preflight_checks),
)
assert_equal(
f"{lane['lane_id']}.intake_preflight_check_ids",
[item["check_id"] for item in intake_preflight_checks],
expected_preflight_checks,
)
assert_equal(
f"{lane['lane_id']}.intake_preflight_display_order",
[item["display_order"] for item in intake_preflight_checks],
list(range(1, len(expected_preflight_checks) + 1)),
)
for item in intake_preflight_checks:
assert_true(f"{lane['lane_id']}.{item['check_id']}.required", item["required"])
assert_false(
f"{lane['lane_id']}.{item['check_id']}.execution_authorized",
item["execution_authorized"],
)
assert_false(f"{lane['lane_id']}.runtime_execution_authorized", snapshot["runtime_execution_authorized"])
assert_false(f"{lane['lane_id']}.rollup_execution_authorized", rollup_lane["execution_authorized"])
assert_equal(