wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
6,737 Commits 219 Branches 2 Tags
5c0c5f6da2e373a37457a94de8966c8c8252286b
Commit Graph

20 Commits

Author SHA1 Message Date
ogt
ff8d917247 fix(telegram): bind product alerts to canonical routes
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
2026-07-15 01:08:05 +08:00
ogt
d41a1d37fe fix(ci): keep workflows on Gitea supply chain
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details
2026-07-11 00:35:10 +08:00
Your Name
ed31bed5c8 fix(awooop): route workflow telegram alerts through ai receipts
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / tests (push) Has been cancelled
Details
2026-07-02 14:38:37 +08:00
Your Name
7672a9bcdc fix(ci): keep secrets out of gitea run logs
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Failing after 31s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
2026-06-30 08:24:27 +08:00
Your Name
b754e8a1a4 fix(runner): align workflows to non110 labels 2026-06-28 21:14:06 +08:00
Your Name
b3a3233d2a ci(runner): guard gitea pressure triggers [skip ci] 2026-06-28 19:13:36 +08:00
ogt
5f37de539c fix(ci): isolate 110 runner labels and gate host pressure [skip ci] 2026-06-27 19:38:15 +08:00
Your Name
ee2cc2bfc3 fix(alerts): 收斂 Telegram 告警到 SRE 戰情室
Some checks failed
CD Pipeline / tests (push) Failing after 1m23s
Details
CD Pipeline / build-and-deploy (push) Has been skipped
Details
CD Pipeline / post-deploy-checks (push) Has been skipped
Details
Code Review / ai-code-review (push) Successful in 15s
Details
2026-06-12 11:06:16 +08:00
Your Name
9f2974f4c5 fix(ci): guard gitea workflow secret surfaces
Some checks failed
Code Review / ai-code-review (push) Failing after 10s
Details
2026-05-18 09:39:13 +08:00
Your Name
146cf411ae fix(ci): retry migrations on permission denied
Some checks failed
Code Review / ai-code-review (push) Successful in 10s
Details
run-migration / migrate (push) Failing after 9s
Details
CD Pipeline / tests (push) Successful in 1m21s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
2026-05-13 09:48:56 +08:00
Your Name
49ffb5bb19 fix(ci): repair migration audit json literal
All checks were successful
Code Review / ai-code-review (push) Successful in 9s
Details
2026-05-13 03:59:22 +08:00
Your Name
feda8a0b4b fix(ci): harden migration audit seed
All checks were successful
Code Review / ai-code-review (push) Successful in 10s
Details
2026-05-13 03:40:41 +08:00
Your Name
f318fd3a89 fix(ci): harden migration workflow audit
All checks were successful
Code Review / ai-code-review (push) Successful in 11s
Details
2026-05-12 23:29:54 +08:00
Your Name
ad8ead2546 fix(awooop): route ci notifications through event mirror
Some checks failed
Code Review / ai-code-review (push) Successful in 14s
Details
CD Pipeline / tests (push) Successful in 1m18s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
2026-05-12 13:58:08 +08:00
Your Name
08097f4070 fix(ci): harden migration audit logging
All checks were successful
Code Review / ai-code-review (push) Successful in 11s
Details
2026-05-07 10:32:41 +08:00
Your Name
fcf93aac11 fix(ci): retry owner-required migrations safely
All checks were successful
Code Review / ai-code-review (push) Successful in 11s
Details
2026-05-06 16:31:04 +08:00
Your Name
6ec3f116fd fix(ci): normalize migration database url for psql
All checks were successful
CD Pipeline / tests (push) Successful in 1m30s
Details
Code Review / ai-code-review (push) Successful in 27s
Details
CD Pipeline / build-and-deploy (push) Successful in 13m20s
Details
CD Pipeline / post-deploy-checks (push) Successful in 3m36s
Details
2026-05-01 13:30:32 +08:00
Your Name
f154ac022e feat(playbook): version generated playbooks
All checks were successful
CD Pipeline / tests (push) Successful in 1m34s
Details
Code Review / ai-code-review (push) Successful in 28s
Details
Type Sync Check / check-type-sync (push) Successful in 1m10s
Details
CD Pipeline / build-and-deploy (push) Successful in 10m19s
Details
CD Pipeline / post-deploy-checks (push) Successful in 3m1s
Details
2026-04-30 23:59:39 +08:00
Your Name
95110971f3 fix(telegram): close remaining DM alert routes
Some checks failed
CD Pipeline / tests (push) Successful in 1m27s
Details
Code Review / ai-code-review (push) Successful in 29s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
2026-04-30 23:02:17 +08:00
OG T
2d43751729 feat(ops): ADR-090-B 零信任收尾範本 — wrapper / sudoers / migrator / CI
Some checks failed
CD Pipeline / build-and-deploy (push) Successful in 12m17s
Details
run-migration / migrate (push) Failing after 14s
Details 
2026-04-18 台北時區 —— ogt + Claude Opus 4.7 (1M)

本 commit 響應本 Session 兩次憑證外洩事故
(feedback_secrets_leak_incidents_2026-04-18.md),
交付統帥可直接部署的零信任基礎設施範本.

檔案清單:

1. scripts/host-ops/awoooi-hosts-add.sh
   - 110 主機 /etc/hosts 白名單 wrapper
   - 只允許預定義主機名,idempotent,帶 IP 格式驗證
   - 安裝: /usr/local/bin/awoooi-hosts-add (root:root 0755)

2. scripts/host-ops/awoooi-wrapper.sudoers
   - 配套 sudoers 規則 (NOPASSWD for wrapper + SIGHUP only)
   - 安裝: /etc/sudoers.d/awoooi-wrapper (root:root 0440)
   - 禁 tee / bash / sh 這類 generic shell access

3. apps/api/migrations/adr090b_awoooi_migrator_role.sql
   - PG 限權角色 awoooi_migrator
   - 只能 DDL (CREATE/ALTER/DROP/INDEX/COMMENT)
   - 明確 REVOKE 所有 DML + default privileges 鎖死
   - 本檔由統帥執行 (需 superuser),不由 Claude 執行

4. k8s/awoooi-prod/awoooi-migrator-secret.template.yaml
   - K8s Secret patch 範本
   - 新增 MIGRATION_DATABASE_URL key (awoooi_migrator 連線串)
   - 與應用 DATABASE_URL 拆開

5. .gitea/workflows/run-migration.yml
   - CI 自動套用新 migration (單 transaction + ON_ERROR_STOP)
   - 用 Gitea secret MIGRATION_DATABASE_URL,不走明碼
   - 每次成功寫一筆 asset_discovery_run (audit trail)

零信任三層防線 (對應 feedback_secrets_leak_incidents):
  L1 對話無密碼 -> wrapper 內建白名單
  L2 操作經 wrapper -> sudoers + awoooi_migrator
  L3 顯示強制遮蔽 -> CI 走 secret,不走 env

本 Session 發現的 3 次憑證外洩全部在 feedback_secrets_leak
memory 登記,並有對應 P0 輪替計畫.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-18 13:23:39 +08:00