coulomb/railiance-forge
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

FORGE-WP-ADHOC-2026-10-27: admit the filename-digest receive scanner
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The live Forgejo adapter now allows one generic-api-key match for a text filename whose value is a 64-character lowercase content digest. The two older admitted binaries stay on disk.

Assistant: grok
Assistant-Model: grok-4.7
Assistant-Session: 01a17f2b-8cc3-76f0-9bce-3b3444b9a5e9
This commit is contained in:
tegwick 2026-10-27 22:45:15 +01:00
parent 0ad068dc7b
commit bc3cc92b0c
2 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

4
WORK-RECORDS.md
View file

@ -8,7 +8,7 @@
| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
| workplan | FORGE-WP-ADHOC-2026-10-27 | active | — | workplans/ADHOC-2026-10-27.md |
| workplan | FORGE-WP-ADHOC-2026-10-27 | finished | — | workplans/ADHOC-2026-10-27.md |
| workplan | FORGE-WP-0006 | finished | — | workplans/FORGE-WP-0006-independent-secret-detection.md |
| workplan | FORGE-WP-0007 | finished | — | workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md |
| workplan | FORGE-WP-0008 | proposed | — | workplans/FORGE-WP-0008-secret-detection-residual-coverage.md |
@ -17,7 +17,7 @@
| workplan | FORGE-WP-0011 | active | — | workplans/FORGE-WP-0011-forgejo-resource-requests.md |
| workplan | RFORGE-WP-0002 | finished | — | workplans/RFORGE-WP-0002-forge-resource-economics-evidence.md |
| task | FORGE-WP-ADHOC-2026-10-27-T01 | done | — | workplans/ADHOC-2026-10-27.md |
| task | FORGE-WP-ADHOC-2026-10-27-T02 | wait | — | workplans/ADHOC-2026-10-27.md |
| task | FORGE-WP-ADHOC-2026-10-27-T02 | done | — | workplans/ADHOC-2026-10-27.md |
| task | FORGE-WP-0006-T01 | done | — | workplans/FORGE-WP-0006-independent-secret-detection.md |
| task | FORGE-WP-0006-T02 | done | — | workplans/FORGE-WP-0006-independent-secret-detection.md |
| task | FORGE-WP-0006-T03 | cancel | — | workplans/FORGE-WP-0006-independent-secret-detection.md |

14
workplans/ADHOC-2026-10-27.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Allow filename content digests in the receive scanner"
domain: financials
repo: railiance-forge
status: active
status: finished
owner: grok
created: "2026-10-27"
updated: "2026-10-27"
@ -32,12 +32,14 @@ Repository `.gitleaks.toml` files and inline allow comments remain ignored.
```task
id: FORGE-WP-ADHOC-2026-10-27-T02
status: wait
status: done
priority: high
state_hub_task_id: "a2c3e425-a36f-59e0-a07f-600882b6a141"
```
Source and the disposable scanner test do not change the installed pre-receive
adapter. The running Forgejo hook keeps the previous profile until this
executable is rebuilt and admitted. The emergent-security 0.2.7 push stays
blocked until that admission.
The admitted adapter is directory `20261027-b735d052a49f`, binary
`b735d052a49fc8e9cca14cddee074c5429352ad71841eb6548459294f15683a2`, template
`forgejo-secret-template-d1df801be39f`. The 20261012 and 20261018 binaries
remain in place. All 168 existing repository hooks now execute the new
adapter. Forgejo deployment `forge` was recreated and its health check passed.
emergent-security `8c903af` is on origin/main.