coulomb/repo-manager
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

security: record native forge receive-hook baseline

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
This commit is contained in:
tegwick 2026-10-12 18:15:43 +02:00
parent 21498306ec
commit 710567cbda
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/RMGR-WP-0021-secret-detection-controls.md
View file

@ -75,7 +75,7 @@ T03/T04 remain open; local hooks remain bypassable.
```task
id: RMGR-WP-0021-T03
status: todo
status: progress
priority: high
state_hub_task_id: "0ab44bd9-00d8-5470-ad45-7350e7868d0a"
```
@ -87,6 +87,16 @@ history/merge cases and bypasses, missing scanner, malformed input and scanner
failure. Record actual rejected/accepted push or required-check receipts. Local
hook success is insufficient and this staged adapter alone does not scan history.
2026-10-12 read-only native baseline: railiance01 runs Forgejo 11.0.3.
All 22 reviewed repositories have only the upstream-generated receive-hook files,
matched by SHA256 to the v11.0.3 templates; no custom scanner hook is installed at
that boundary. Storage contains 165 repository directories, which still need
classification before being an admitted production denominator. Independent
Actions/branch-protection coverage and push acceptance remain unverified. Do not
replace generated dispatchers or enable arbitrary user hook editing to add the
control. Receipt: Custodian `forge-secret-detection-baseline.json`. No live
server mutation, credential access or synthetic push was performed.
## Verify private finding-to-response handling
```task