Draft: docs(security): Security Supply Chain 低摩擦框架 #117

wooo · 2026-05-12T23:30:45+08:00

wooo commented

2026-05-12 23:30:45 +08:00

摘要

本 PR 建立 Security Supply Chain 的 docs-only / contracts-first 框架，承接 Kali 192.168.0.112、開發主機 192.168.0.111 / 192.168.0.168、Gitea -> GitHub 遷移、Code Review -> Codex coding handoff、以及 AwoooP mirror-only 同步。

邊界

不切 GitHub primary。
不建立 GitHub repo、不改 visibility、不同步 refs。
不部署、不修改 runtime enforcement、不碰 NetworkPolicy / RBAC。
AwoooP 只可 mirror / read-only policy / approval candidate，不可把 manifest 當 execution router。
初期維持低摩擦：observe-first、warn-first，只有高風險動作進 approval gate。

驗證

python3 -m py_compile scripts/security/*.py
git diff --check gitea/main...HEAD
JSON / schema / snapshot parse：30 files OK。
security_supply_chain_contract_manifest_v1：12 contracts path check OK。
PR diff added lines 敏感字串掃描通過。

下一步

等 Gitea read-only inventory approval 後，補 private/internal server-side repo list。
逐 repo 取得 owner / visibility / canonical 決策。
對 refs blocked repos 產生 reconcile plan；GitHub primary 仍保持 blocked。

## 摘要本 PR 建立 Security Supply Chain 的 docs-only / contracts-first 框架，承接 Kali `192.168.0.112`、開發主機 `192.168.0.111` / `192.168.0.168`、Gitea -> GitHub 遷移、Code Review -> Codex coding handoff、以及 AwoooP mirror-only 同步。 ## 邊界 - 不切 GitHub primary。 - 不建立 GitHub repo、不改 visibility、不同步 refs。 - 不部署、不修改 runtime enforcement、不碰 NetworkPolicy / RBAC。 - AwoooP 只可 mirror / read-only policy / approval candidate，不可把 manifest 當 execution router。 - 初期維持低摩擦：observe-first、warn-first，只有高風險動作進 approval gate。 ## 驗證 - `python3 -m py_compile scripts/security/*.py` - `git diff --check gitea/main...HEAD` - JSON / schema / snapshot parse：30 files OK。 - `security_supply_chain_contract_manifest_v1`：12 contracts path check OK。 - PR diff added lines 敏感字串掃描通過。 ## 下一步 - 等 Gitea read-only inventory approval 後，補 private/internal server-side repo list。 - 逐 repo 取得 owner / visibility / canonical 決策。 - 對 refs blocked repos 產生 reconcile plan；GitHub primary 仍保持 blocked。

wooo added 2 commits 2026-05-12 23:30:45 +08:00

docs(security): add supply chain contract manifest [skip ci] 8ce318ac1c

chore(security): sync with gitea main [skip ci] dc540cba52

wooo added 1 commit 2026-05-12 23:32:26 +08:00

docs(security): record PR handoff and main sync [skip ci] 5b144f0c92

wooo added 1 commit 2026-05-12 23:43:56 +08:00

docs(security): add source control approval board [skip ci] cd72808560

wooo added 2 commits 2026-05-13 00:33:41 +08:00

chore(security): sync with gitea main before reconcile plan [skip ci] 13b2db6563

docs(security): add source control reconcile plan [skip ci] 892e68dcca

wooo added 1 commit 2026-05-13 01:49:16 +08:00

chore(security): sync with gitea main after reconcile plan [skip ci] 58887c5f24