coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(security): hold annotation enforcement until ESO metadata is explicit

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e7fb-275d-7db0-b1df-39ed943427da
This commit is contained in:
codex 2026-09-28 15:08:00 +02:00
parent 54885ac158
commit 6016f72a8d
5 changed files with 111 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/secret_annotation_maintenance.py
View file

@ -43,11 +43,18 @@ def maintain(clean=False):
if len(pair) != 2 or not all(NAME.fullmatch(value) for value in pair):
raise RuntimeError("invalid Secret identity output; suppressed")
rows.append(pair)
namespaces = run(["get", "namespaces", "-o", "name"]).splitlines()
if not all(value.startswith("namespace/") and NAME.fullmatch(value.split("/", 1)[1]) for value in namespaces):
raise RuntimeError("invalid namespace inventory; suppressed")
active_namespaces = {value.split("/", 1)[1] for value in namespaces}
report = {"captured_at": datetime.now(timezone.utc).isoformat(),
"mode": "clean" if clean else "inspect", "checked": 0,
"annotated": [], "cleaned": [], "complete": False}
"annotated": [], "cleaned": [], "orphaned_namespace": [], "complete": False}
try:
for namespace, name in rows:
if namespace not in active_namespaces:
report["orphaned_namespace"].append(namespace + "/" + name)
continue
report["checked"] += 1
if not inspect(namespace, name):
continue
@ -61,7 +68,8 @@ def maintain(clean=False):
if inspect(namespace, name):
raise RuntimeError("annotation still present")
report["cleaned"].append(identity)
report["complete"] = True
report["active_namespace_scan_complete"] = True
report["complete"] = not report["orphaned_namespace"]
except (RuntimeError, subprocess.SubprocessError, OSError):
report["error"] = "maintenance incomplete; raw output suppressed; inspect before retry"
return report