[
  {
    "target": "/home/worsch/railiance-apps/helm/forgejo-values.yaml",
    "original_sha256": "910bb0e79a515ed411beded29fbfc8cd0ea26e09d4c3ff5fcaf5bdcd9f3e46b1",
    "candidate_sha256": "4bd65a32c97c9aa75f7fb08025b463c3acf060e82ac32f56feab58f1193cbd7d",
    "candidate_file": "forgejo-values.yaml",
    "patch": "--- /home/worsch/railiance-apps/helm/forgejo-values.yaml\n+++ /home/worsch/railiance-apps/helm/forgejo-values.yaml\n@@ -54,7 +54,7 @@\n extraVolumes:\n - name: secret-scan-template\n   configMap:\n-    name: forgejo-secret-template-d1df801be39f\n+    name: forgejo-secret-template-619d94208139\n     defaultMode: 365\n extraContainerVolumeMounts:\n - &id001\n@@ -74,7 +74,7 @@\n   command:\n   - sh\n   - -c\n-  - \"#!/bin/sh\\nset +vx\\nset -eu\\ntest \\\"$(id -u)\\\" = 1000\\ntest -d /data && test ! -L /data\\ntest -d /data/security && test ! -L /data/security\\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\\ntest -d /data/security/receive-secret-scan/20261012-57a0642b6251 && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251\\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan | cut -d \\\" \\\" -f 1)\\\" = 57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\\\" in 755|775) ;; *) exit 21;; esac\\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks | cut -d \\\" \\\" -f 1)\\\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\\\" in 755|775) ;; *) exit 21;; esac\\nif [ \\\"${1:-check}\\\" = apply ]; then\\n  chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\\\" = 755\\n  chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\\\" = 755\\nfi\\n\\n#!/bin/sh\\nset +vx\\nset -eu\\ntest \\\"$(id -u)\\\" = 1000\\ntest -d /data && test ! -L /data\\ntest -d /data/security && test ! -L /data/security\\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\\ntest -d /data/security/receive-secret-scan/20261018-73ee04078786 && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786\\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan | cut -d \\\" \\\" -f 1)\\\" = 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\\\" in 755|775) ;; *) exit 21;; esac\\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks | cut -d \\\" \\\" -f 1)\\\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\\\" in 755|775) ;; *) exit 21;; esac\\nif [ \\\"${1:-check}\\\" = apply ]; then\\n  chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\\\" = 755\\n  chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\\\" = 755\\nfi\\n\\n#!/bin/sh\\nset +vx\\nset -eu\\ntest \\\"$(id -u)\\\" = 1000\\ntest -d /data && test ! -L /data\\ntest -d /data/security && test ! -L /data/security\\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\\ntest -d /data/security/receive-secret-scan/20261027-b735d052a49f && test ! -L /data/security/receive-secret-scan/20261027-b735d052a49f\\ntest -f /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan | cut -d \\\" \\\" -f 1)\\\" = b735d052a49fc8e9cca14cddee074c5429352ad71841eb6548459294f15683a2\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan)\\\" in 755|775) ;; *) exit 21;; esac\\ntest -f /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks && test ! -L /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks | cut -d \\\" \\\" -f 1)\\\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks)\\\" in 755|775) ;; *) exit 21;; esac\\nif [ \\\"${1:-check}\\\" = apply ]; then\\n  chmod 755 /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan)\\\" = 755\\n  chmod 755 /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks)\\\" = 755\\nfi\\n\"\n+  - \"#!/bin/sh\\nset +vx\\nset -eu\\ntest \\\"$(id -u)\\\" = 1000\\ntest -d /data && test ! -L /data\\ntest -d /data/security && test ! -L /data/security\\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\\ntest -d /data/security/receive-secret-scan/20261012-57a0642b6251 && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251\\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan | cut -d \\\" \\\" -f 1)\\\" = 57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\\\" in 755|775) ;; *) exit 21;; esac\\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks | cut -d \\\" \\\" -f 1)\\\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\\\" in 755|775) ;; *) exit 21;; esac\\nif [ \\\"${1:-check}\\\" = apply ]; then\\n  chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\\\" = 755\\n  chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\\\" = 755\\nfi\\n\\n#!/bin/sh\\nset +vx\\nset -eu\\ntest \\\"$(id -u)\\\" = 1000\\ntest -d /data && test ! -L /data\\ntest -d /data/security && test ! -L /data/security\\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\\ntest -d /data/security/receive-secret-scan/20261018-73ee04078786 && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786\\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan | cut -d \\\" \\\" -f 1)\\\" = 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\\\" in 755|775) ;; *) exit 21;; esac\\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks | cut -d \\\" \\\" -f 1)\\\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\\\" in 755|775) ;; *) exit 21;; esac\\nif [ \\\"${1:-check}\\\" = apply ]; then\\n  chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\\\" = 755\\n  chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\\\" = 755\\nfi\\n\\n#!/bin/sh\\nset +vx\\nset -eu\\ntest \\\"$(id -u)\\\" = 1000\\ntest -d /data && test ! -L /data\\ntest -d /data/security && test ! -L /data/security\\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\\ntest -d /data/security/receive-secret-scan/20261027-b735d052a49f && test ! -L /data/security/receive-secret-scan/20261027-b735d052a49f\\ntest -f /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan | cut -d \\\" \\\" -f 1)\\\" = b735d052a49fc8e9cca14cddee074c5429352ad71841eb6548459294f15683a2\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan)\\\" in 755|775) ;; *) exit 21;; esac\\ntest -f /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks && test ! -L /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks | cut -d \\\" \\\" -f 1)\\\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks)\\\" in 755|775) ;; *) exit 21;; esac\\nif [ \\\"${1:-check}\\\" = apply ]; then\\n  chmod 755 /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan)\\\" = 755\\n  chmod 755 /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks\\n  test \\\"$(stat -c %a /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks)\\\" = 755\\nfi\\n\\n#!/bin/sh\\nset +vx\\nset -eu\\ntest \\\"$(id -u)\\\" = 1000\\ntest -d /data && test ! -L /data\\ntest -d /data/security && test ! -L /data/security\\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\\ntest -d /data/security/receive-secret-scan/20261102-d7dbd0ef5731 && test ! -L /data/security/receive-secret-scan/20261102-d7dbd0ef5731\\ntest -f /data/security/receive-secret-scan/20261102-d7dbd0ef5731/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261102-d7dbd0ef5731/receive-secret-scan\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261102-d7dbd0ef5731/receive-secret-scan)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261102-d7dbd0ef5731/receive-secret-scan | cut -d \\\" \\\" -f 1)\\\" = d7dbd0ef57312ab9507874bb5fd67c49bef637b6d7dee121e526227307af4bf0\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261102-d7dbd0ef5731/receive-secret-scan)\\\" in 755|775) ;; *) exit 21;; esac\\nif [ \\\"${1:-check}\\\" = apply ]; then chmod 755 /data/security/receive-secret-scan/20261102-d7dbd0ef5731/receive-secret-scan; test \\\"$(stat -c %a /data/security/receive-secret-scan/20261102-d7dbd0ef5731/receive-secret-scan)\\\" = 755; fi\\ntest -f /data/security/receive-secret-scan/20261102-d7dbd0ef5731/gitleaks && test ! -L /data/security/receive-secret-scan/20261102-d7dbd0ef5731/gitleaks\\ntest \\\"$(stat -c %u /data/security/receive-secret-scan/20261102-d7dbd0ef5731/gitleaks)\\\" = 1000\\ntest \\\"$(sha256sum /data/security/receive-secret-scan/20261102-d7dbd0ef5731/gitleaks | cut -d \\\" \\\" -f 1)\\\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\\ncase \\\"$(stat -c %a /data/security/receive-secret-scan/20261102-d7dbd0ef5731/gitleaks)\\\" in 755|775) ;; *) exit 21;; esac\\nif [ \\\"${1:-check}\\\" = apply ]; then chmod 755 /data/security/receive-secret-scan/20261102-d7dbd0ef5731/gitleaks; test \\\"$(stat -c %a /data/security/receive-secret-scan/20261102-d7dbd0ef5731/gitleaks)\\\" = 755; fi\\n\"\n   - sh\n   - apply\n   securityContext:\n"
  },
  {
    "target": "/home/worsch/railiance-apps/manifests/forgejo-secret-scan-template.yaml",
    "original_sha256": "ca468a0d8847e7a7ed81462e3d9a144c8a370eec0960bf2ba830cafde24509de",
    "candidate_sha256": "e91a3405b6524c7dcdfa82d6fd4efc17570e430f833b265892e4f223a19d7689",
    "candidate_file": "configmap.json",
    "patch": "--- /home/worsch/railiance-apps/manifests/forgejo-secret-scan-template.yaml\n+++ /home/worsch/railiance-apps/manifests/forgejo-secret-scan-template.yaml\n@@ -1,16 +1,16 @@\n-apiVersion: v1\n-kind: ConfigMap\n-metadata:\n-  name: forgejo-secret-template-d1df801be39f\n-  namespace: forgejo\n-  labels:\n-    app.kubernetes.io/part-of: forgejo\n-    custodian.coulomb.social/workplan: FORGE-WP-ADHOC-2026-10-27\n-immutable: true\n-data:\n-  hook: |\n-    #!/bin/sh\n-    set +vx\n-    set -eu\n-    exec /data/security/receive-secret-scan/20261027-b735d052a49f/receive-secret-scan --scanner /data/security/receive-secret-scan/20261027-b735d052a49f/gitleaks\n-\n+{\n+  \"apiVersion\": \"v1\",\n+  \"kind\": \"ConfigMap\",\n+  \"metadata\": {\n+    \"name\": \"forgejo-secret-template-619d94208139\",\n+    \"namespace\": \"forgejo\",\n+    \"labels\": {\n+      \"app.kubernetes.io/part-of\": \"forgejo\",\n+      \"custodian.railiance.org/workplan\": \"CUST-WP-0083\"\n+    }\n+  },\n+  \"immutable\": true,\n+  \"data\": {\n+    \"hook\": \"#!/bin/sh\\nset +vx\\nset -eu\\nexec /data/security/receive-secret-scan/20261102-d7dbd0ef5731/receive-secret-scan --scanner /data/security/receive-secret-scan/20261102-d7dbd0ef5731/gitleaks\\n\"\n+  }\n+}\n"
  }
]