wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(iwooos): 新增監控告警事故回讀 gate
All checks were successful
Code Review / ai-code-review (push) Successful in 12s
Details
CD Pipeline / tests (push) Successful in 1m45s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m41s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m45s
Details

Browse Source
This commit is contained in:
Your Name
2026-06-16 11:07:34 +08:00
parent dfee85c034
commit d89f271af3
16 changed files with 17430 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files

284
scripts/security/security-mirror-progress-guard.py
View File

@@ -185,6 +185,9 @@ def validate(root: Path) -> None:
monitoring_owner_response_acceptance = load_json(
security_dir / "monitoring-owner-response-acceptance.snapshot.json"
)
monitoring_post_incident_readback_plan = load_json(
security_dir / "monitoring-post-incident-readback-plan.snapshot.json"
)
ai_provider_owner_response_acceptance = load_json(
security_dir / "ai-provider-owner-response-acceptance.snapshot.json"
)
@@ -3306,12 +3309,12 @@ def validate(root: Path) -> None:
assert_equal(
"high_value_config_coverage.coverage_categories.monitoring.coverage_percent",
monitoring_category["coverage_percent"],
68,
70,
)
assert_equal(
"high_value_config_coverage.coverage_categories.monitoring.coverage_status",
monitoring_category["coverage_status"],
"alert_chain_no_false_green_backfill_ready_needs_live_evidence_receipt",
"post_incident_readback_plan_ready_needs_monitoring_owner_evidence",
)
for evidence_ref in [
"docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md",
@@ -3320,6 +3323,8 @@ def validate(root: Path) -> None:
"docs/security/monitoring-owner-request-draft.snapshot.json",
"docs/security/MONITORING-OWNER-RESPONSE-ACCEPTANCE.md",
"docs/security/monitoring-owner-response-acceptance.snapshot.json",
"docs/security/MONITORING-POST-INCIDENT-READBACK-PLAN.md",
"docs/security/monitoring-post-incident-readback-plan.snapshot.json",
"docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json",
]:
assert_contains(
@@ -5979,6 +5984,241 @@ def validate(root: Path) -> None:
f"monitoring_owner_response_acceptance.{item['acceptance_candidate_id']}.{false_key}",
item[false_key],
)
assert_equal(
"monitoring_post_incident_readback_plan.schema",
monitoring_post_incident_readback_plan["schema_version"],
"monitoring_post_incident_readback_plan_v1",
)
assert_equal(
"monitoring_post_incident_readback_plan.status",
monitoring_post_incident_readback_plan["status"],
"post_incident_readback_plan_ready_no_runtime_action",
)
assert_equal(
"monitoring_post_incident_readback_plan.source_schema_version",
monitoring_post_incident_readback_plan["source_schema_version"],
"monitoring_owner_response_acceptance_v1",
)
assert_equal(
"monitoring_post_incident_readback_plan.source_status",
monitoring_post_incident_readback_plan["source_status"],
"owner_response_acceptance_ledger_ready_no_runtime_action",
)
for source_path in [
"docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md",
"docs/security/monitoring-alerting-observability-inventory.snapshot.json",
"docs/security/MONITORING-OWNER-REQUEST-DRAFT.md",
"docs/security/monitoring-owner-request-draft.snapshot.json",
"docs/security/MONITORING-OWNER-RESPONSE-ACCEPTANCE.md",
"docs/security/monitoring-owner-response-acceptance.snapshot.json",
]:
assert_contains(
"monitoring_post_incident_readback_plan.source_paths",
monitoring_post_incident_readback_plan["source_paths"],
source_path,
)
expected_monitoring_post_incident_summary = {
"source_acceptance_candidate_count": 60,
"source_write_capable_acceptance_candidate_count": 11,
"source_live_evidence_required_candidate_count": 60,
"source_acceptance_field_count": 38,
"source_required_owner_field_count": 14,
"source_reviewer_check_count": 23,
"source_outcome_lane_count": 12,
"source_blocked_action_count": 34,
"source_owner_response_accepted_count": 0,
"source_alert_chain_health_accepted_count": 0,
"source_receiver_receipt_proof_accepted_count": 0,
"source_runtime_gate_count": 0,
"readback_candidate_count": 60,
"write_capable_readback_candidate_count": 11,
"live_evidence_required_readback_candidate_count": 60,
"alert_rule_readback_candidate_count": 13,
"deploy_or_reload_readback_candidate_count": 6,
"receiver_receipt_review_required_candidate_count": 60,
"stale_silence_review_required_candidate_count": 60,
"freshness_alert_chain_review_required_candidate_count": 60,
"no_false_green_required_candidate_count": 60,
"readback_field_count": 39,
"required_readback_field_count": 30,
"reviewer_check_count": 28,
"outcome_lane_count": 11,
"blocked_action_count": 53,
"post_incident_readback_received_count": 0,
"post_incident_readback_accepted_count": 0,
"actor_attribution_accepted_count": 0,
"change_or_outage_time_window_accepted_count": 0,
"intent_or_break_glass_accepted_count": 0,
"before_after_alert_state_accepted_count": 0,
"rule_datasource_scrape_state_accepted_count": 0,
"receiver_route_state_accepted_count": 0,
"reload_or_no_reload_accepted_count": 0,
"receiver_receipt_readback_accepted_count": 0,
"stale_pending_resolved_review_accepted_count": 0,
"silence_mute_dedup_inhibit_review_accepted_count": 0,
"dashboard_trace_log_freshness_accepted_count": 0,
"notification_delivery_metadata_accepted_count": 0,
"alert_chain_health_readback_accepted_count": 0,
"cross_project_sync_accepted_count": 0,
"rollback_or_disable_validation_accepted_count": 0,
"post_change_monitoring_accepted_count": 0,
"postcheck_readback_accepted_count": 0,
"recurrence_guard_accepted_count": 0,
"no_false_green_accepted_count": 0,
"prometheus_reload_authorized_count": 0,
"alertmanager_reload_authorized_count": 0,
"grafana_dashboard_apply_authorized_count": 0,
"signoz_rule_apply_authorized_count": 0,
"sentry_deploy_authorized_count": 0,
"langfuse_config_change_authorized_count": 0,
"otel_collector_reload_authorized_count": 0,
"receiver_route_change_authorized_count": 0,
"silence_policy_change_authorized_count": 0,
"telegram_send_authorized_count": 0,
"notification_route_change_authorized_count": 0,
"webhook_receiver_change_authorized_count": 0,
"remote_write_change_authorized_count": 0,
"exporter_deploy_authorized_count": 0,
"live_alert_fire_authorized_count": 0,
"alert_chain_smoke_authorized_count": 0,
"secret_value_collection_allowed_count": 0,
"host_write_authorized_count": 0,
"active_scan_authorized_count": 0,
"production_write_authorized_count": 0,
"runtime_gate_count": 0,
"action_button_count": 0,
"coverage_percent_after_readback_plan": 70,
}
for key, expected in expected_monitoring_post_incident_summary.items():
assert_equal(
f"monitoring_post_incident_readback_plan.summary.{key}",
monitoring_post_incident_readback_plan["summary"][key],
expected,
)
for key, value in monitoring_post_incident_readback_plan["execution_boundaries"].items():
if key == "not_authorization":
assert_true(f"monitoring_post_incident_readback_plan.execution_boundaries.{key}", value)
else:
assert_false(f"monitoring_post_incident_readback_plan.execution_boundaries.{key}", value)
assert_equal(
"monitoring_post_incident_readback_plan.readback_candidates.count",
len(monitoring_post_incident_readback_plan["readback_candidates"]),
60,
)
monitoring_post_incident_ids = [
item["post_incident_readback_candidate_id"]
for item in monitoring_post_incident_readback_plan["readback_candidates"]
]
for post_incident_readback_candidate_id in [
"monitoring_post_incident_readback:alertmanager_receiver_config",
"monitoring_post_incident_readback:deploy_alertmanager_config_script",
"monitoring_post_incident_readback:telegram_gateway_service",
"monitoring_post_incident_readback:fire_live_alert_script",
"monitoring_post_incident_readback:sentry_self_hosted_deploy",
"monitoring_post_incident_readback:langfuse_compose",
]:
assert_contains(
"monitoring_post_incident_readback_plan.readback_candidates",
monitoring_post_incident_ids,
post_incident_readback_candidate_id,
)
assert_equal(
"monitoring_post_incident_readback_plan.reviewer_checks.count",
len(monitoring_post_incident_readback_plan["reviewer_checks"]),
28,
)
assert_equal(
"monitoring_post_incident_readback_plan.outcome_lanes.count",
len(monitoring_post_incident_readback_plan["outcome_lanes"]),
11,
)
assert_equal(
"monitoring_post_incident_readback_plan.blocked_actions.count",
len(monitoring_post_incident_readback_plan["blocked_actions"]),
53,
)
for item in monitoring_post_incident_readback_plan["readback_candidates"]:
assert_equal(
f"monitoring_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.readback_fields",
len(item["readback_fields"]),
39,
)
assert_equal(
f"monitoring_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.required_readback_fields",
len(item["required_readback_fields"]),
30,
)
assert_equal(
f"monitoring_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.reviewer_checks",
len(item["reviewer_checks"]),
28,
)
assert_equal(
f"monitoring_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.outcome_lanes",
len(item["outcome_lanes"]),
11,
)
assert_equal(
f"monitoring_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.blocked_actions",
len(item["blocked_actions"]),
53,
)
assert_true(
f"monitoring_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.not_approval",
item["not_approval"],
)
for false_key in [
"post_incident_readback_received",
"post_incident_readback_accepted",
"actor_attribution_accepted",
"change_or_outage_time_window_accepted",
"intent_or_break_glass_accepted",
"before_after_alert_state_accepted",
"rule_datasource_scrape_state_accepted",
"receiver_route_state_accepted",
"reload_or_no_reload_accepted",
"receiver_receipt_readback_accepted",
"stale_pending_resolved_review_accepted",
"silence_mute_dedup_inhibit_review_accepted",
"dashboard_trace_log_freshness_accepted",
"notification_delivery_metadata_accepted",
"alert_chain_health_readback_accepted",
"cross_project_sync_accepted",
"rollback_or_disable_validation_accepted",
"post_change_monitoring_accepted",
"postcheck_readback_accepted",
"recurrence_guard_accepted",
"no_false_green_accepted",
"prometheus_reload_authorized",
"alertmanager_reload_authorized",
"grafana_dashboard_apply_authorized",
"signoz_rule_apply_authorized",
"sentry_deploy_authorized",
"langfuse_config_change_authorized",
"otel_collector_reload_authorized",
"receiver_route_change_authorized",
"silence_policy_change_authorized",
"telegram_send_authorized",
"notification_route_change_authorized",
"webhook_receiver_change_authorized",
"remote_write_change_authorized",
"exporter_deploy_authorized",
"live_alert_fire_authorized",
"alert_chain_smoke_authorized",
"ssh_read_authorized",
"ssh_write_authorized",
"kubectl_action_authorized",
"secret_value_collection_allowed",
"host_write_authorized",
"active_scan_authorized",
"production_write_authorized",
"runtime_gate",
"action_buttons_allowed",
]:
assert_false(
f"monitoring_post_incident_readback_plan.{item['post_incident_readback_candidate_id']}.{false_key}",
item[false_key],
)
assert_equal(
"ai_provider_owner_response_acceptance.schema",
ai_provider_owner_response_acceptance["schema_version"],
@@ -7442,6 +7682,8 @@ def validate(root: Path) -> None:
"docs/schemas/backup_restore_escrow_inventory_v1.schema.json",
"docs/security/monitoring-alerting-observability-inventory.snapshot.json",
"docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md",
"docs/security/monitoring-post-incident-readback-plan.snapshot.json",
"docs/security/MONITORING-POST-INCIDENT-READBACK-PLAN.md",
"docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json",
"docs/security/public-runtime-config-change-evidence-acceptance.snapshot.json",
"docs/security/PUBLIC-RUNTIME-CONFIG-CHANGE-EVIDENCE-ACCEPTANCE.md",
@@ -7922,6 +8164,24 @@ def validate(root: Path) -> None:
"monitoring_owner_response_acceptance_cross_project_notification_accepted_count": 0,
"monitoring_owner_response_acceptance_runtime_gate_count": 0,
"monitoring_owner_response_acceptance_coverage_percent_after_backfill": 68,
"monitoring_post_incident_readback_plan_candidate_count": 60,
"monitoring_post_incident_readback_plan_write_capable_candidate_count": 11,
"monitoring_post_incident_readback_plan_live_evidence_required_candidate_count": 60,
"monitoring_post_incident_readback_plan_alert_rule_candidate_count": 13,
"monitoring_post_incident_readback_plan_deploy_or_reload_candidate_count": 6,
"monitoring_post_incident_readback_plan_required_readback_field_count": 30,
"monitoring_post_incident_readback_plan_reviewer_check_count": 28,
"monitoring_post_incident_readback_plan_outcome_lane_count": 11,
"monitoring_post_incident_readback_plan_blocked_action_count": 53,
"monitoring_post_incident_readback_plan_post_incident_readback_received_count": 0,
"monitoring_post_incident_readback_plan_post_incident_readback_accepted_count": 0,
"monitoring_post_incident_readback_plan_receiver_receipt_readback_accepted_count": 0,
"monitoring_post_incident_readback_plan_stale_pending_resolved_review_accepted_count": 0,
"monitoring_post_incident_readback_plan_silence_mute_dedup_inhibit_review_accepted_count": 0,
"monitoring_post_incident_readback_plan_alert_chain_health_readback_accepted_count": 0,
"monitoring_post_incident_readback_plan_runtime_gate_count": 0,
"monitoring_post_incident_readback_plan_action_button_count": 0,
"monitoring_post_incident_readback_plan_coverage_percent_after_readback_plan": 70,
}
for key, expected in expected_monitoring_alerting_observability_projection_summary.items():
assert_equal(
@@ -17874,7 +18134,7 @@ def validate(root: Path) -> None:
"monitoring_alerting_observability_inventory_reload_owner_accepted_count=0",
"monitoring_alerting_observability_inventory_receiver_owner_accepted_count=0",
"monitoring_alerting_observability_inventory_route_smoke_accepted_count=0",
"monitoring_alerting_observability_coverage_percent=68",
"monitoring_alerting_observability_coverage_percent=70",
"monitoring_owner_response_acceptance_reviewer_check_count=23",
"monitoring_owner_response_acceptance_outcome_lane_count=12",
"monitoring_owner_response_acceptance_blocked_action_count=34",
@@ -17884,6 +18144,22 @@ def validate(root: Path) -> None:
"monitoring_owner_response_acceptance_silence_or_dedup_review_accepted_count=0",
"monitoring_owner_response_acceptance_post_reload_readback_plan_accepted_count=0",
"monitoring_owner_response_acceptance_runtime_gate_count=0",
"monitoring_post_incident_readback_plan_candidate_count=60",
"monitoring_post_incident_readback_plan_write_capable_candidate_count=11",
"monitoring_post_incident_readback_plan_live_evidence_required_candidate_count=60",
"monitoring_post_incident_readback_plan_alert_rule_candidate_count=13",
"monitoring_post_incident_readback_plan_deploy_or_reload_candidate_count=6",
"monitoring_post_incident_readback_plan_required_readback_field_count=30",
"monitoring_post_incident_readback_plan_reviewer_check_count=28",
"monitoring_post_incident_readback_plan_outcome_lane_count=11",
"monitoring_post_incident_readback_plan_blocked_action_count=53",
"monitoring_post_incident_readback_plan_post_incident_readback_received_count=0",
"monitoring_post_incident_readback_plan_post_incident_readback_accepted_count=0",
"monitoring_post_incident_readback_plan_receiver_receipt_readback_accepted_count=0",
"monitoring_post_incident_readback_plan_stale_pending_resolved_review_accepted_count=0",
"monitoring_post_incident_readback_plan_silence_mute_dedup_inhibit_review_accepted_count=0",
"monitoring_post_incident_readback_plan_alert_chain_health_readback_accepted_count=0",
"monitoring_post_incident_readback_plan_runtime_gate_count=0",
"docker_compose_action_authorized=false",
"systemctl_action_authorized=false",
"repair_bot_execution_authorized=false",
@@ -18179,7 +18455,7 @@ def validate(root: Path) -> None:
assert_text_contains(
f"web_messages.{locale}.iwooos.criticalConfigPriority.items.publicRuntime.body.redaction",
public_runtime_body,
"不得暴露 raw namespace",
"不得暴露原始命名空間",
)
assert_contains(
"web_messages.zh-TW.iwooos.highValueConfigControlCoverage",