coulomb/railiance-forge
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: record deployed Git template inheritance and rollback proof
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2
This commit is contained in:
tegwick 2026-10-13 14:04:02 +02:00
parent 11767e5bf0
commit ec1d7c591a
1 changed files with 26 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

26
workplans/FORGE-WP-0006-independent-secret-detection.md
View file

@ -110,6 +110,32 @@ remain open. Upstream import/mirror paths use clone/fetch, not receive-pack, so
template inheritance alone cannot prove those content paths covered. T02/T03
remain open; Custodian close-down checklist row 21 retains the uncovered control.
2026-10-13 template lifecycle deployed under exact proposal
FORGE6-TEMPLATE-LIFECYCLE-001. Release source railiance-apps `390a30a` adds an
immutable non-secret ConfigMap, read-only file subPath mounts (avoiding broken
ConfigMap symlinks in copied Git templates), the encoded environment-to-ini
setting, and a Make prerequisite so future Helm deploys retain the declaration.
The live rollout is a conditional additive Deployment patch: the old Helm
release is not reapplied over intervening live changes. The same Forgejo image
reached generation 12 Ready. Actual `/data/home/.gitconfig` selects the mounted
template; native Git init using that configuration copied the exact regular,
executable scanner hook and malformed input was refused. All original 22 hook
inventories and pinned binaries remain exact, health passes, and the owned probe
repository was removed. No production credential or identity changed.
Thirty isolated exact-image checks passed for this file-mount/configuration
variant, including rollback to Git's default template while preserving existing
repository hooks. Six conditional-patch/rollback tests and the exact server
dry-run passed. Receipt: Custodian
`docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json`;
proposal/rollback executor: `docs/changes/CUST-WP-0080/forge-template-proposal.json`
and `activate_forge_template.py`. Rollback retains the ConfigMap inert and uses
an explicit default template selection because merely removing the environment
variable would leave the saved setting behind. Original immutable October 12
activation remains bound to its old pod and must not be rewritten or replayed.
Authenticated production HTTP/SSO/frontend creation, the other 143 existing
repositories, import/mirror and wider detection/response coverage remain open.
## Verify CI independence, detection response and complete coverage
```task