wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

docs(security): add gitea owner response template status ledger

Browse Source
This commit is contained in:
Your Name
2026-05-18 11:49:06 +08:00
parent 903578995a
commit d1c7ca66a3
32 changed files with 309 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

54
scripts/security/source-control-owner-response-guard.py
View File

@@ -50,6 +50,13 @@ LANES = [
"collection-no-approval-language",
"collection-audit-metadata-only",
],
"expected_template_statuses": [
"response-public-only-vs-local-gitea-gap",
"response-org-user-endpoint-identity",
"response-internal-110-adjacent-scope",
"response-repo-owner-canonical-scope",
"response-legacy-or-inaccessible-disposition",
],
},
{
"lane_id": "s4_10_github_target_owner_decision_response",
@@ -179,6 +186,53 @@ def validate(root: Path) -> None:
assert_equal(f"{lane['lane_id']}.rejected_response_count", summary["rejected_response_count"], 0)
assert_equal(f"{lane['lane_id']}.acceptance_check_count", summary["acceptance_check_count"], 8)
assert_equal(f"{lane['lane_id']}.rejection_rule_count", summary["rejection_rule_count"], 10)
expected_template_statuses = lane.get("expected_template_statuses")
if expected_template_statuses is not None:
template_statuses = snapshot["owner_response_template_statuses"]
assert_equal(
f"{lane['lane_id']}.owner_response_template_status_count",
summary["owner_response_template_status_count"],
len(expected_template_statuses),
)
assert_equal(
f"{lane['lane_id']}.owner_response_template_status_ids",
[item["template_id"] for item in template_statuses],
expected_template_statuses,
)
assert_equal(
f"{lane['lane_id']}.owner_response_template_status_display_order",
[item["display_order"] for item in template_statuses],
list(range(1, len(expected_template_statuses) + 1)),
)
for item in template_statuses:
assert_equal(
f"{lane['lane_id']}.{item['template_id']}.collection_status",
item["collection_status"],
"waiting_owner_response",
)
assert_equal(
f"{lane['lane_id']}.{item['template_id']}.request_status",
item["request_status"],
"request_ready_not_sent",
)
assert_equal(f"{lane['lane_id']}.{item['template_id']}.received_response_count", item["received_response_count"], 0)
assert_equal(f"{lane['lane_id']}.{item['template_id']}.accepted_response_count", item["accepted_response_count"], 0)
assert_equal(f"{lane['lane_id']}.{item['template_id']}.rejected_response_count", item["rejected_response_count"], 0)
assert_equal(
f"{lane['lane_id']}.{item['template_id']}.latest_outcome_lane",
item["latest_outcome_lane"],
"keep_waiting_owner_response",
)
assert_equal(
f"{lane['lane_id']}.{item['template_id']}.awooop_display_mode",
item["awooop_display_mode"],
"display_template_status_only",
)
assert_false(
f"{lane['lane_id']}.{item['template_id']}.execution_authorized",
item["execution_authorized"],
)
assert_true(f"{lane['lane_id']}.{item['template_id']}.not_approval", item["not_approval"])
expected_request_packet_id = lane.get("expected_request_packet_id")
if expected_request_packet_id is not None:
request_packet = snapshot["owner_response_request_packet"]