the-custodian/docs/evidence/2026-10-13-netkingdom-security/forge-template-activation.json

100 lines
3.2 KiB
JSON

{
"proposal_id": "FORGE6-TEMPLATE-LIFECYCLE-001",
"proposal_sha256": "7eddea55359b25c5ad307ed8ccd392dfadfe167d65cbe34b02f1955350bbcb36",
"observed_at": "2026-10-13T12:00:12.863351+00:00",
"result": "verified",
"old_pod_uid": "bc771b51-e9b8-456d-b59c-e7041704389d",
"old_generation": 11,
"server_dry_run_exact_match": true,
"patch": [
{
"op": "test",
"path": "/metadata/uid",
"value": "e8eff0aa-64bb-4b44-9a80-a66612986355"
},
{
"op": "test",
"path": "/metadata/resourceVersion",
"value": "67848734"
},
{
"op": "add",
"path": "/spec/template/spec/volumes/-",
"value": {
"name": "secret-scan-template",
"configMap": {
"name": "forgejo-secret-template-b1d7cf8cd13f",
"defaultMode": 365
}
}
},
{
"op": "add",
"path": "/spec/template/spec/initContainers/0/volumeMounts/-",
"value": {
"name": "secret-scan-template",
"mountPath": "/opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan",
"subPath": "hook",
"readOnly": true
}
},
{
"op": "add",
"path": "/spec/template/spec/initContainers/1/volumeMounts/-",
"value": {
"name": "secret-scan-template",
"mountPath": "/opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan",
"subPath": "hook",
"readOnly": true
}
},
{
"op": "add",
"path": "/spec/template/spec/initContainers/1/env/-",
"value": {
"name": "GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR",
"value": "/opt/forge-secret-template"
}
},
{
"op": "add",
"path": "/spec/template/spec/initContainers/2/volumeMounts/-",
"value": {
"name": "secret-scan-template",
"mountPath": "/opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan",
"subPath": "hook",
"readOnly": true
}
},
{
"op": "add",
"path": "/spec/template/spec/containers/0/volumeMounts/-",
"value": {
"name": "secret-scan-template",
"mountPath": "/opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan",
"subPath": "hook",
"readOnly": true
}
}
],
"original_template_sha256": "18855f7b4c78f79117884684e44550406c72fc7be08c0b8e61ec16cfcb855746",
"resulting_template_sha256": "73f6c1ef484c60f93285d61e6df6651b4f1268fafb3e470f35f450bce4f34aba",
"no_secret_objects_read": true,
"mode": "apply",
"configmap_created": true,
"patch_submission_started": true,
"applied_generation": 12,
"inheritance": {
"mounted_hook_regular": true,
"inherited_hook_regular_executable": true,
"hook_sha256": "b1d7cf8cd13feafe44e45876b1de3fdd9c88339d8d45791fa2b9f72ca832932b",
"inherited_hook_malformed_input_refused": true,
"scope": "Native Git init with actual Forgejo global configuration in an owned temporary bare repository; not production API repository creation."
},
"new_pod_uid": "f818d3f5-5c3d-4a2a-8e78-50e10b10d2ce",
"generation": 12,
"selected_template": "/opt/forge-secret-template",
"existing_22_profiles_preserved": true,
"binaries_unchanged": true,
"health_after": true
}