Files
awoooi/docs/security/telegram-notification-egress-inventory.snapshot.json
Your Name b191f8e9fe
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Failing after 2m6s
CD Pipeline / build-and-deploy (push) Has been skipped
CD Pipeline / post-deploy-checks (push) Has been skipped
fix(telegram): close ops direct sender gaps
2026-07-02 19:32:36 +08:00

354 lines
9.9 KiB
JSON
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"schema_version": "telegram_notification_egress_inventory_v1",
"generated_at": "2026-07-02T19:23:57+08:00",
"git_commit": "ca95b95bb",
"status": "inventory_ready_no_runtime_action",
"mode": "repo_only_scan_no_secret_value_no_telegram_send",
"scan_roots": [
".gitea/workflows",
"scripts/ops",
"scripts/ci",
"apps/api/src"
],
"summary": {
"scanned_file_count": 637,
"direct_bot_api_file_count": 0,
"direct_bot_api_call_count": 0,
"workflow_direct_bot_api_call_count": 0,
"ops_script_direct_bot_api_call_count": 0,
"ci_script_direct_bot_api_call_count": 0,
"api_direct_bot_api_call_count": 0,
"gateway_normalized_callsite_count": 57,
"gateway_final_exit_formatter_present_count": 1,
"required_owner_field_count": 18,
"reviewer_check_count": 14,
"outcome_lane_count": 9,
"blocked_action_count": 22,
"owner_response_received_count": 0,
"owner_response_accepted_count": 0,
"formatter_convergence_accepted_count": 0,
"redaction_contract_accepted_count": 0,
"delivery_receipt_accepted_count": 0,
"direct_bot_api_migration_authorized_count": 0,
"telegram_send_authorized_count": 0,
"bot_api_call_authorized_count": 0,
"workflow_modification_authorized_count": 0,
"script_modification_authorized_count": 0,
"secret_value_collection_allowed_count": 0,
"raw_payload_storage_allowed_count": 0,
"production_write_authorized_count": 0,
"runtime_gate_count": 0,
"action_button_count": 0
},
"execution_boundaries": {
"runtime_execution_authorized": false,
"telegram_send_authorized": false,
"bot_api_call_authorized": false,
"workflow_modification_authorized": false,
"script_modification_authorized": false,
"secret_value_collection_allowed": false,
"secret_hash_collection_allowed": false,
"partial_token_collection_allowed": false,
"raw_payload_storage_allowed": false,
"chat_route_change_authorized": false,
"bot_token_change_authorized": false,
"workflow_dispatch_authorized": false,
"production_deploy_authorized": false,
"action_buttons_allowed": false,
"not_authorization": true
},
"direct_bot_api_calls": [],
"gateway_normalized_callsite_refs": [
{
"path": "apps/api/src/api/v1/gitea_webhook.py",
"line": 426,
"line_hash": "2bba62c7403eeae5"
},
{
"path": "apps/api/src/api/v1/signoz_webhook.py",
"line": 619,
"line_hash": "980d3a75c1e608db"
},
{
"path": "apps/api/src/jobs/capacity_forecaster_job.py",
"line": 385,
"line_hash": "a7c5d5a21624db48"
},
{
"path": "apps/api/src/jobs/compliance_scanner_job.py",
"line": 528,
"line_hash": "a5cb293e694f4319"
},
{
"path": "apps/api/src/jobs/coverage_evaluator_job.py",
"line": 344,
"line_hash": "9d0733502b37bfed"
},
{
"path": "apps/api/src/jobs/hermes_rule_quality_job.py",
"line": 366,
"line_hash": "ad448bc99ba96d49"
},
{
"path": "apps/api/src/services/ai_router.py",
"line": 1333,
"line_hash": "202458f20c188326"
},
{
"path": "apps/api/src/services/approval_execution.py",
"line": 1191,
"line_hash": "5fc34226f6f9d1c7"
},
{
"path": "apps/api/src/services/converged_alert_recurrence_notifier.py",
"line": 169,
"line_hash": "891a543abef76ca8"
},
{
"path": "apps/api/src/services/decision_manager.py",
"line": 1220,
"line_hash": "f8477e7b398f9d72"
},
{
"path": "apps/api/src/services/drift_adopt_service.py",
"line": 475,
"line_hash": "59870f376c6ba34a"
},
{
"path": "apps/api/src/services/drift_remediator.py",
"line": 227,
"line_hash": "a9a6af0cb71e69f0"
},
{
"path": "apps/api/src/services/failover_alerter.py",
"line": 261,
"line_hash": "34684a93372ce6d7"
},
{
"path": "apps/api/src/services/failure_watcher.py",
"line": 752,
"line_hash": "7673481130594095"
},
{
"path": "apps/api/src/services/failure_watcher.py",
"line": 784,
"line_hash": "ccb72a2e0a9ec582"
},
{
"path": "apps/api/src/services/gitea_webhook_service.py",
"line": 409,
"line_hash": "03ec3600dd9b7e8a"
},
{
"path": "apps/api/src/services/k3s_monitor_service.py",
"line": 222,
"line_hash": "b8fe78845628308a"
},
{
"path": "apps/api/src/services/notifications/telegram.py",
"line": 7,
"line_hash": "a5baed9efe0e0f85"
},
{
"path": "apps/api/src/services/notifications/telegram.py",
"line": 67,
"line_hash": "13a52baf484abbec"
},
{
"path": "apps/api/src/services/notifications/telegram.py",
"line": 91,
"line_hash": "875d9e9fbc2d75ce"
},
{
"path": "apps/api/src/services/runbook_generator.py",
"line": 392,
"line_hash": "771939312f164e0c"
},
{
"path": "apps/api/src/services/runbook_generator.py",
"line": 405,
"line_hash": "813d7d118fc840c4"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 5374,
"line_hash": "6abe4f6f01027f51"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 5615,
"line_hash": "6b08bb5969e6bf81"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6048,
"line_hash": "e31cf0f5587583bd"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6138,
"line_hash": "fcb7c764d12ed4ad"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6141,
"line_hash": "d7865613da2925eb"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6199,
"line_hash": "7ce4aec16700add3"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6258,
"line_hash": "c38b1044dc1936ed"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6581,
"line_hash": "a2b428c7cd26f6df"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6639,
"line_hash": "940568cc70f135da"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6695,
"line_hash": "dc4975526f170c4b"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6752,
"line_hash": "4431802f09177793"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6815,
"line_hash": "3b403ecc07e58580"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6890,
"line_hash": "217eddafb1892d3f"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 6933,
"line_hash": "5d3959b2a3a6ef6b"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 7201,
"line_hash": "ae305742e8413fb9"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 7532,
"line_hash": "f8e757b0b1940dfd"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 7549,
"line_hash": "6aa3d0c6f294c9db"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 7605,
"line_hash": "edce43618980911d"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 7950,
"line_hash": "040c55f344e63e2e"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 8107,
"line_hash": "46d66b2145372dd8"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 8252,
"line_hash": "8ebe1f28478b8b11"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 8326,
"line_hash": "91d2ca0efcac21ee"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 8420,
"line_hash": "6eb41eedd8070d91"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9040,
"line_hash": "bc576b6fda533964"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9047,
"line_hash": "e4b078f7815ac3db"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9174,
"line_hash": "8dbb002e7811389c"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9199,
"line_hash": "54e1ad827084af7d"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9213,
"line_hash": "12d58f7f2fbb2a64"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9238,
"line_hash": "9394a79d9cfe4020"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9344,
"line_hash": "9ffceb53c73f29e2"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9370,
"line_hash": "e987f2b54961d32c"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 9406,
"line_hash": "766c1cf3c2e7b37c"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 10423,
"line_hash": "f47ba2d2e8f18e9b"
},
{
"path": "apps/api/src/services/telegram_gateway.py",
"line": 10527,
"line_hash": "b058b22806044d84"
},
{
"path": "apps/api/src/services/weekly_report_service.py",
"line": 457,
"line_hash": "c2a061a65eade81f"
}
],
"operator_interpretation": [
"direct_bot_api_call_count 大於 0 代表仍有 workflow / ops / API 旁路可能繞過 TelegramGateway formatter。",
"本清冊只建立 metadata-only egress surface不送 Telegram、不修改 workflow / script、不讀 secret value。",
"後續要收斂 direct Bot API 必須另走 owner response、formatter convergence、redaction contract、delivery receipt 與維護窗口。"
]
}