security: persist Forgejo receive hook inheritance for new repositories

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2

Makefile

@@ -63,6 +63,7 @@ FORGEJO_CHART_VERSION ?= 12.5.0
 FORGEJO_VALUES ?= helm/forgejo-values.yaml
 FORGEJO_REGISTRY_VALUES ?= helm/forgejo-registry-values.yaml
 FORGEJO_SECRETS ?= helm/forgejo-secrets.sops.yaml
+FORGEJO_SECRET_SCAN_TEMPLATE ?= manifests/forgejo-secret-scan-template.yaml
 FORGEJO_INGRESS ?= manifests/forgejo-ingress.yaml
 FORGEJO_SSH_NODEPORT ?= manifests/forgejo-ssh-nodeport.yaml
 FORGEJO_BASE_URL ?= https://forgejo.coulomb.social
@@ -469,7 +470,10 @@ forgejo-server-dry-run: check-railiance01-kubeconfig ## Helm server dry-run Forg
 		-f <(KUBECONFIG="$(FORGEJO_KUBECONFIG)" tools/forgejo-helm-secrets.sh) \
 		--dry-run=server --timeout 5m
 
-forgejo-deploy: check-railiance01-kubeconfig forgejo-mailer-es-deploy ## Deploy / upgrade Forgejo on railiance01
+forgejo-secret-scan-template-deploy: check-railiance01-kubeconfig ## Install the immutable, non-secret receive-hook template
+	KUBECONFIG="$(FORGEJO_KUBECONFIG)" kubectl apply --server-side -f $(FORGEJO_SECRET_SCAN_TEMPLATE)
+
+forgejo-deploy: check-railiance01-kubeconfig forgejo-mailer-es-deploy forgejo-secret-scan-template-deploy ## Deploy / upgrade Forgejo on railiance01
 	@test -n "$$(KUBECONFIG="$(FORGEJO_KUBECONFIG)" kubectl get secret forgejo-mailer -n $(FORGEJO_NAMESPACE) -o name 2>/dev/null)" || { \
 		echo "Missing secret forgejo-mailer in $(FORGEJO_NAMESPACE)." >&2; \
 		echo "Ensure ExternalSecret is Ready and OpenBao role external-secrets-forgejo is configured." >&2; \
@@ -643,3 +647,5 @@ help: ## Show this help
 	  /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) }' $(MAKEFILE_LIST)
 
 .PHONY: check-tools check-sops k8s-server-dry-run apps-pg-status apps-pg-restore-drill check-railiance01-kubeconfig check-inter-hub-image-tag check-inter-hub-image check-vergabe-image-tag check-vergabe-image vergabe-dry-run vergabe-deploy vergabe-ingress-deploy vergabe-status vergabe-migrate vergabe-seed vergabe-superuser vergabe-logs vergabe-db-url-secret check-coulomb-social-image-tag coulomb-social-dry-run coulomb-social-deploy coulomb-social-ingress-deploy coulomb-social-status coulomb-social-logs coulomb-social-env-secret coulomb-social-env-secret-dry-run eso-deploy forgejo-openbao-eso-token-apply forgejo-openbao-store-deploy forgejo-mailer-es-deploy forgejo-mailer-es-status forgejo-dry-run forgejo-server-dry-run forgejo-deploy forgejo-ingress-deploy forgejo-ssh-nodeport-deploy forgejo-status forgejo-smoke forgejo-npm-smoke forgejo-verify forgejo-operator-bootstrap forgejo-runner-registration-sops-bootstrap forgejo-secrets-check forgejo-logs forgejo-runner-registration-deploy forgejo-runner-deploy forgejo-runner-status forgejo-runner-logs inter-hub-render-baseline inter-hub-dry-run inter-hub-server-dry-run inter-hub-deploy inter-hub-status inter-hub-release-info inter-hub-smoke inter-hub-logs reuse-dry-run reuse-deploy reuse-status reuse-smoke reuse-logs reuse-forgejo-webhook reuse-openbao-eso-token-apply reuse-openbao-store-deploy reuse-runtime-es-deploy reuse-runtime-es-status reuse-webhook-smoke policy-nexus-check-binding policy-nexus-check-image policy-nexus-render policy-nexus-server-dry-run policy-nexus-deploy policy-nexus-status policy-nexus-smoke policy-nexus-rollback help
+
+.PHONY: forgejo-secret-scan-template-deploy

helm/forgejo-values.yaml

@@ -30,6 +30,21 @@ redis-cluster:
 valkey-cluster:
   enabled: false
 
+# File subPath keeps Git from copying ConfigMap projection symlinks.
+extraVolumes:
+- name: secret-scan-template
+  configMap:
+    name: forgejo-secret-template-b1d7cf8cd13f
+    defaultMode: 365
+extraContainerVolumeMounts:
+- &id001
+  name: secret-scan-template
+  mountPath: /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan
+  subPath: hook
+  readOnly: true
+extraInitVolumeMounts:
+- *id001
+
 gitea:
   admin:
     username: forgejo_admin
@@ -37,6 +52,8 @@ gitea:
     passwordMode: initialOnlyRequireReset
   # Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS).
   additionalConfigFromEnvs:
+    - name: GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR
+      value: /opt/forge-secret-template
     - name: GITEA__mailer__PASSWD
       valueFrom:
         secretKeyRef:

manifests/forgejo-secret-scan-template.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: forgejo-secret-template-b1d7cf8cd13f
+  namespace: forgejo
+  labels:
+    app.kubernetes.io/part-of: forgejo
+    custodian.coulomb.social/workplan: FORGE-WP-0006
+immutable: true
+data:
+  hook: '#!/bin/sh
+
+    set +vx
+
+    set -eu
+
+    exec /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan
+    --scanner /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks
+
+    '