From 4970d31a817ad6af873d61dea86d54b1c1054a61 Mon Sep 17 00:00:00 2001 From: igor04091968 Date: Sun, 21 Jun 2026 08:54:53 +0300 Subject: [PATCH] chore(public): add CI coverage security and OSS process visibility --- .github/ISSUE_TEMPLATE/bug_report.yml | 42 ++++++ .github/ISSUE_TEMPLATE/feature_request.yml | 42 ++++++ .../registry_readiness_task.yml | 29 ++++ .../security_hardening_task.yml | 30 ++++ .github/pull_request_template.md | 29 ++-- .github/workflows/ci.yml | 124 +++++++++++------ .github/workflows/coverage.yml | 47 +++++++ .github/workflows/security.yml | 131 ++++++++++++++++++ CONTRIBUTING.md | 31 ++++- README.md | 14 ++ ROADMAP.md | 67 +++++++++ SECURITY.md | 41 ++++++ deny.toml | 39 ++++++ docs/QUALITY_STATUS_RU.md | 41 ++++++ .../REGISTER_RU_SOFTWARE_READINESS_RU.md | 9 ++ .../REGISTRY_READINESS_CHANGELOG_RU.md | 39 ++++++ docs/registry/RELEASE_EVIDENCE_MANIFEST_RU.md | 17 +++ docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md | 4 + docs/registry/RU_BUILD_RUNNER_READINESS_RU.md | 6 + docs/registry/registry-evidence-manifest.json | 9 ++ scripts/registry_readiness_check.sh | 59 +++++++- 21 files changed, 798 insertions(+), 52 deletions(-) create mode 100644 .github/ISSUE_TEMPLATE/bug_report.yml create mode 100644 .github/ISSUE_TEMPLATE/feature_request.yml create mode 100644 .github/ISSUE_TEMPLATE/registry_readiness_task.yml create mode 100644 .github/ISSUE_TEMPLATE/security_hardening_task.yml create mode 100644 .github/workflows/coverage.yml create mode 100644 .github/workflows/security.yml create mode 100644 ROADMAP.md create mode 100644 SECURITY.md create mode 100644 deny.toml create mode 100644 docs/QUALITY_STATUS_RU.md diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml new file mode 100644 index 0000000..20342b2 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -0,0 +1,42 @@ +name: Bug report +description: Report a reproducible defect with sanitized evidence. +title: "fix: " +labels: ["bug"] +body: + - type: markdown + attributes: + value: | + Do not publish secrets, tokens, private keys, personal data, real employee logs or customer evidence. Use demo/anonymized evidence. + - type: textarea + id: summary + attributes: + label: Summary + description: What is broken? + validations: + required: true + - type: textarea + id: steps + attributes: + label: Reproduction steps + description: Minimal steps using sanitized data. + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + validations: + required: true + - type: textarea + id: actual + attributes: + label: Actual behavior + validations: + required: true + - type: textarea + id: evidence + attributes: + label: Sanitized evidence + description: Logs, screenshots or output with secrets and personal data removed. + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml new file mode 100644 index 0000000..c0ab12b --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature_request.yml @@ -0,0 +1,42 @@ +name: Feature request +description: Request a capability without using customer or employee data. +title: "feat: " +labels: ["enhancement"] +body: + - type: markdown + attributes: + value: | + Do not publish secrets, personal data, real employee logs or non-anonymized customer evidence. + - type: textarea + id: problem + attributes: + label: Problem + description: What user or operator problem should this solve? + validations: + required: true + - type: textarea + id: proposal + attributes: + label: Proposed behavior + description: Describe the desired behavior conservatively. + validations: + required: true + - type: dropdown + id: area + attributes: + label: Area + options: + - Workforce + - Security analytics + - Forensics + - Registry-readiness + - Install/deployment + - Documentation + validations: + required: true + - type: textarea + id: evidence + attributes: + label: Demo/anonymized evidence + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/registry_readiness_task.yml b/.github/ISSUE_TEMPLATE/registry_readiness_task.yml new file mode 100644 index 0000000..97f404e --- /dev/null +++ b/.github/ISSUE_TEMPLATE/registry_readiness_task.yml @@ -0,0 +1,29 @@ +name: Registry-readiness task +description: Track registry-readiness documentation, evidence or process gaps. +title: "docs(registry): " +labels: ["registry-readiness", "documentation"] +body: + - type: markdown + attributes: + value: | + Do not claim legal completion of registry registration. Do not publish secrets, personal data, real employee logs or private infrastructure credentials. + - type: textarea + id: scope + attributes: + label: Scope + description: What registry-readiness gap is being tracked? + validations: + required: true + - type: textarea + id: evidence + attributes: + label: Required evidence + description: List sanitized evidence or documents needed. + validations: + required: true + - type: textarea + id: remaining + attributes: + label: Remaining gaps + validations: + required: false diff --git a/.github/ISSUE_TEMPLATE/security_hardening_task.yml b/.github/ISSUE_TEMPLATE/security_hardening_task.yml new file mode 100644 index 0000000..7aa2306 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/security_hardening_task.yml @@ -0,0 +1,30 @@ +name: Security hardening task +description: Track hardening without exposing sensitive data. +title: "chore(security): " +labels: ["security", "hardening"] +body: + - type: markdown + attributes: + value: | + Do not publish exploits, secrets, private keys, tokens, personal data, real employee logs or customer evidence. + - type: textarea + id: hardening + attributes: + label: Hardening target + description: What should be hardened? + validations: + required: true + - type: textarea + id: risk + attributes: + label: Risk addressed + description: Explain the risk without sensitive details. + validations: + required: true + - type: textarea + id: validation + attributes: + label: Validation + description: Checks or evidence required. + validations: + required: true diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index a12b8c6..7632786 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,13 +1,24 @@ ## Summary -- what changed -- why it changed -- risk and rollback notes +Describe what changed and why. -## Checklist +## Validation -- [ ] No real secrets or credentials committed -- [ ] Server-side scripts validated (`bash -n`) -- [ ] PowerShell scripts validated (`Invoke-ScriptAnalyzer`) -- [ ] Docs updated (full paths and runbook steps) -- [ ] Rollback steps documented +List commands executed. Use `skipped: ` when a check requires a live +stand or unavailable tool. + +## Registry / Public Mirror Scope + +- GitHub is public mirror validation only. +- Primary registry release evidence must be produced on the Russian + build-runner. +- Update `docs/registry/` when registry-readiness behavior or evidence changes. + +## Safety + +- No secrets, tokens, passwords or private keys. +- No personal data. +- No real employee logs. +- No customer evidence unless anonymized. +- No unsupported claims about certification, DLP/SIEM replacement or legal + registry completion. diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 71da693..077e705 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,70 +1,114 @@ -name: shell-and-powershell-ci +name: CI + +# GitHub Actions is public mirror validation only. +# Primary registry release evidence must be produced on Russian build-runner. on: push: - branches: [ "main" ] pull_request: - branches: [ "main" ] + workflow_dispatch: + +permissions: + contents: read jobs: - shell-check: + rust-checks: + name: Rust checks runs-on: ubuntu-latest + defaults: + run: + shell: bash + working-directory: adk-rust steps: - name: Checkout uses: actions/checkout@v4 + with: + lfs: false - - name: Install shellcheck - run: sudo apt-get update && sudo apt-get install -y shellcheck + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + with: + components: rustfmt, clippy - - name: Run shellcheck - run: | - find . -type f -name "*.sh" -print0 | xargs -0 -r shellcheck -S error -e SC1007,SC1090,SC2016 + - name: cargo fmt + run: cargo fmt --all --check - - name: Run production inventory placeholder guard self-test - run: bash scripts/check_production_inventory_placeholders.sh --self-test + - name: cargo test + run: cargo test --workspace - - name: Run private-config guard - run: bash scripts/check_private_config_guard.sh + - name: cargo clippy + run: cargo clippy --workspace --all-targets -- -D warnings - - name: Run portal contract sync guard - run: node scripts/check_portal_contract_sync.mjs + - name: cargo build + run: cargo build --workspace - rust-runtime-guard: + docs-registry-checks: + name: Docs and registry checks runs-on: ubuntu-latest + defaults: + run: + shell: bash steps: - name: Checkout uses: actions/checkout@v4 + with: + lfs: false - - name: Test detmir-core runtime guard - run: cargo test --manifest-path adk-rust/Cargo.toml -p detmir-core runtime_guard + - name: Registry script syntax + run: bash -n scripts/registry_readiness_check.sh - - name: Test detmir readiness crate - run: cargo test --manifest-path adk-rust/Cargo.toml -p detmir-readiness + - name: Registry readiness + run: bash scripts/registry_readiness_check.sh - powershell-analyzer: + - name: Release evidence script syntax + run: | + if [[ -f scripts/build_release_evidence.sh ]]; then + bash -n scripts/build_release_evidence.sh + fi + if [[ -f scripts/check_release_evidence.sh ]]; then + bash -n scripts/check_release_evidence.sh + fi + + - name: Whitespace diff check + run: git diff --check + + smoke-checks: + name: Smoke checks runs-on: ubuntu-latest + defaults: + run: + shell: bash steps: - name: Checkout uses: actions/checkout@v4 + with: + lfs: false - - name: Install PSScriptAnalyzer - shell: pwsh - run: | - Set-PSRepository -Name PSGallery -InstallationPolicy Trusted - Install-Module PSScriptAnalyzer -Scope CurrentUser -Force + - name: Install Node.js + uses: actions/setup-node@v4 + with: + node-version: "20" - - name: Analyze PowerShell scripts - shell: pwsh + - name: Deployment readiness smoke run: | - $targets = @( - "windows/*.ps1", - "windows/*.psm1", - "windows/*.psd1" - ) - $issues = $targets | ForEach-Object { - Invoke-ScriptAnalyzer -Path $_ -Recurse -Severity Error - } - if ($issues) { - $issues | Format-Table -AutoSize - throw "PSScriptAnalyzer detected issues." - } + if command -v node >/dev/null 2>&1 && [[ -f scripts/deployment-readiness-smoke.mjs ]]; then + node scripts/deployment-readiness-smoke.mjs + else + echo "skipped: node or scripts/deployment-readiness-smoke.mjs missing" + fi + + - name: Pilot validation smoke + run: | + if command -v node >/dev/null 2>&1 && [[ -f scripts/pilot-validation-smoke.mjs ]]; then + node scripts/pilot-validation-smoke.mjs + else + echo "skipped: node or scripts/pilot-validation-smoke.mjs missing" + fi + + - name: Browser conformance smoke + run: | + if [[ -f scripts/browser-conformance-smoke.mjs ]]; then + echo "skipped: requires live stand unless explicitly run by operator" + else + echo "skipped: scripts/browser-conformance-smoke.mjs missing" + fi diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml new file mode 100644 index 0000000..7e467f4 --- /dev/null +++ b/.github/workflows/coverage.yml @@ -0,0 +1,47 @@ +name: Coverage + +# GitHub Actions is public mirror validation only. +# Primary registry release evidence must be produced on Russian build-runner. + +on: + push: + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + coverage-baseline: + name: Coverage baseline + runs-on: ubuntu-latest + defaults: + run: + shell: bash + working-directory: adk-rust + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - name: Install cargo-llvm-cov + uses: taiki-e/install-action@cargo-llvm-cov + + - name: Generate coverage summary + run: | + mkdir -p ../coverage + cargo llvm-cov --workspace --summary-only | tee ../coverage/coverage-summary.txt + + - name: Upload coverage summary + uses: actions/upload-artifact@v4 + with: + name: coverage-summary + path: coverage/coverage-summary.txt + + - name: Future threshold placeholder + run: | + echo "Coverage threshold is not enforced yet; this workflow tracks baseline and regressions." diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..5372557 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,131 @@ +name: Security + +# GitHub Actions is public mirror validation only. +# Primary registry release security evidence must be produced on Russian build-runner. + +on: + push: + pull_request: + workflow_dispatch: + +permissions: + contents: read + pull-requests: read + +jobs: + cargo-audit: + name: Cargo audit + runs-on: ubuntu-latest + defaults: + run: + shell: bash + working-directory: adk-rust + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - name: Install cargo-audit + uses: taiki-e/install-action@cargo-audit + + - name: cargo audit + run: cargo audit + + cargo-deny: + name: Cargo deny + runs-on: ubuntu-latest + defaults: + run: + shell: bash + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Install stable Rust + uses: dtolnay/rust-toolchain@stable + + - name: Install cargo-deny + uses: taiki-e/install-action@cargo-deny + + - name: cargo deny + run: cargo deny --manifest-path adk-rust/Cargo.toml --config deny.toml check + + secret-pattern-check: + name: Secret pattern check + runs-on: ubuntu-latest + defaults: + run: + shell: bash + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Scan for obvious secret patterns + run: | + python3 - <<'PY' + import os + import re + import sys + from pathlib import Path + + root = Path(".") + text_suffixes = { + ".cfg", ".conf", ".env", ".ini", ".json", ".lock", ".md", ".py", + ".rs", ".sh", ".toml", ".ts", ".txt", ".yaml", ".yml" + } + skip_dirs = { + ".git", "target", "node_modules", "release-evidence", "dist", "bin" + } + patterns = [ + ("private_key_header", re.compile(r"-----BEGIN (?:RSA |OPENSSH |EC |DSA )?PRIVATE KEY-----")), + ("aws_access_key", re.compile(r"\bAKIA[0-9A-Z]{16}\b")), + ("secret_assignment", re.compile( + r"(?i)\b(password|passwd|pwd|token|secret|api[_-]?key|bearer|cookie)\b" + r"\s*[:=]\s*[\"']?[A-Za-z0-9_./+=-]{16,}" + )), + ] + findings = [] + for path in root.rglob("*"): + if not path.is_file(): + continue + if any(part in skip_dirs for part in path.parts): + continue + if path.suffix.lower() not in text_suffixes: + continue + try: + lines = path.read_text(encoding="utf-8", errors="ignore").splitlines() + except OSError: + continue + for line_no, line in enumerate(lines, start=1): + for name, pattern in patterns: + if pattern.search(line): + findings.append(f"{path}:{line_no}:{name}") + break + if findings: + print("secret_pattern_check=fail") + for finding in findings: + print(finding) + sys.exit(2) + print("secret_pattern_check=ok") + PY + + dependency-review: + name: Dependency review + runs-on: ubuntu-latest + if: github.event_name == 'pull_request' + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + lfs: false + + - name: Dependency Review + uses: actions/dependency-review-action@v4 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 1bf4aba..b2bb990 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,5 +1,9 @@ # Contributing +GitHub is public mirror validation only. Primary registry release evidence is +produced separately on the Russian build-runner and documented under +`docs/registry/`. + ## Branching - Работайте в feature-ветке, не пушьте напрямую в `main`. @@ -15,13 +19,36 @@ ## Required checks before PR -- `bash -n` для всех `*.sh`. +- `cargo fmt --all --check` from `adk-rust/`. +- `cargo test --workspace` from `adk-rust/`, unless the PR is documentation-only + and the skip is documented. +- `cargo clippy --workspace --all-targets -- -D warnings` from `adk-rust/`. +- `bash -n` для всех changed `*.sh`. +- `bash scripts/registry_readiness_check.sh` when registry docs/process changes. +- `node scripts/deployment-readiness-smoke.mjs` when Node.js is available. +- `node scripts/pilot-validation-smoke.mjs` when Node.js is available. - `Invoke-ScriptAnalyzer` для `windows/*.ps1`, `windows/*.psm1`, `windows/*.psd1`. -- Проверка, что нет секретов (`secrets/deploy.secrets.env` не должен быть в индексе git). +- Проверка, что нет секретов (`secrets/deploy.secrets.env` не должен быть в + индексе git). - Обновлены инструкции и runbook при изменении поведения. +## Registry-readiness docs + +- Registry-readiness documents live in `docs/registry/`. +- Public GitHub CI is not registry release evidence. +- Registry release evidence must be generated on the Russian build-runner. +- GitHub remains public mirror validation only. + +## Secrets and personal data + +- Do not commit secrets, tokens, passwords, cookies or private keys. +- Do not commit personal data. +- Do not commit real employee logs. +- Use demo/anonymized evidence for issues, PRs, docs and screenshots. + ## PR content - Изменения и обоснование. - Риск и rollback. - Какие команды валидации были выполнены. +- Какие проверки были пропущены и почему, если пропуск был необходим. diff --git a/README.md b/README.md index 30cbada..fe17d80 100755 --- a/README.md +++ b/README.md @@ -1,5 +1,9 @@ # AWatch-rus +[![CI](https://github.com/igor04091968/AWatch-rus/actions/workflows/ci.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/ci.yml) +[![Security](https://github.com/igor04091968/AWatch-rus/actions/workflows/security.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/security.yml) +[![Coverage](https://github.com/igor04091968/AWatch-rus/actions/workflows/coverage.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/coverage.yml) + AWatch-rus - программный комплекс операционного контроля, технического аудита, оценки трудоотдачи сотрудников и мониторинга корпоративной ИТ-инфраструктуры на базе ActivityWatch, Rust-сервисов @@ -231,6 +235,16 @@ collectors. [RU_BUILD_RUNNER_READINESS_RU.md](docs/registry/RU_BUILD_RUNNER_READINESS_RU.md). - GitHub remains public mirror only. +### Public engineering transparency + +- Public CI, coverage baseline and security scanning are enabled on GitHub. +- Issue templates, PR template and public roadmap are maintained for process + visibility. +- GitHub remains public mirror validation only. +- Primary registry contour remains Gitea plus the Russian build-runner. +- Quality status: + [docs/QUALITY_STATUS_RU.md](docs/QUALITY_STATUS_RU.md). + - [Позиционирование для реестра российского ПО](docs/RUSSIAN_SOFTWARE_REGISTRY_POSITIONING_RU.md) - [Сведения для подачи в реестр](REGISTER_RU_SOFTWARE.md) - [Registry product passport](docs/REGISTRY_PRODUCT_PASSPORT_RU.md) diff --git a/ROADMAP.md b/ROADMAP.md new file mode 100644 index 0000000..7d6dfdd --- /dev/null +++ b/ROADMAP.md @@ -0,0 +1,67 @@ +# AWatch-rus Roadmap + +This roadmap is public planning. It does not claim completion of unverified +work and does not replace `docs/registry/` evidence for registry-readiness. + +## Registry-readiness + +- Maintain `docs/registry/` as the authoritative registry-readiness + documentation package. +- Keep conservative product claims and explicit remaining gaps. +- Prepare final rightsholder confirmation and legal review separately. + +## Russian Git/build contour + +- Keep self-hosted Gitea as the target Russian Git contour for + registry-readiness. +- Keep GitHub as public mirror validation only. +- Provision `awatch-build-01` as a separate Russian build-runner. + +## Release evidence + +- Run release candidate checks on the Russian build-runner. +- Generate source archive, binary archive, SBOM, SHA256SUMS, smoke logs and + release evidence manifest. +- Keep public GitHub Actions separate from registry release evidence. + +## Backup/restore test + +- Complete a test restore of Gitea backup on a separate server. +- Keep `restore_tested=false` until evidence exists. +- Document offsite backup in RF before registry submission. + +## Coverage and CI + +- Use public CI for engineering transparency. +- Track coverage baseline without enforcing a threshold at first. +- Add coverage threshold after baseline review. + +## Security scanning + +- Maintain cargo audit, cargo deny, dependency review and secret-pattern checks. +- Treat public security checks as advisory validation. +- Produce registry release security evidence in the Russian build contour. + +## Russian OS compatibility + +- Validate deployment and agent behavior on target Russian OS variants. +- Document unsupported combinations explicitly. + +## Pilot hardening + +- Keep demo data anonymized. +- Improve smoke coverage for install kit and operational reports. +- Preserve clear rollback and backup-first operational procedures. + +## Future UI + +- Future UI work remains planned unless backed by implemented code and tests. +- Public roadmap entries are not product claims. + +## Not claimed / out of scope + +- No claim of FSTEC/FSB certification. +- No claim of replacing DLP or SIEM. +- No claim of ML/LLM-based detection. +- No claim of automatic remediation. +- No claim of legal completion of Russian software registry registration. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..95c9373 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,41 @@ +# Security Policy + +## Reporting a vulnerability + +Please report suspected vulnerabilities privately to the project maintainer +before publishing technical details. If a private contact channel is not +available, open a GitHub issue with a minimal description and no exploit, +secret, customer data, employee logs or personal data. + +Do not include: + +- passwords, tokens, cookies or private keys; +- real employee logs; +- personal data; +- private network details; +- customer evidence that has not been anonymized. + +Use demo or anonymized evidence whenever possible. + +## Security scope + +AWatch-rus is not positioned as a certified security product. It is not a replacement for DLP or SIEM platforms. Public security checks are advisory validation for engineering transparency. + +## Public validation + +GitHub Actions security checks run in the public mirror: + +- cargo audit; +- cargo deny; +- secret-pattern check; +- dependency review for pull requests. + +GitHub remains public mirror validation only. Registry release security +evidence must be produced in the Russian build contour on the Russian +build-runner. + +## Registry-readiness note + +Security checks do not confirm legal completion of Russian software registry +registration. Final submission requires rightsholder confirmation and legal +review. diff --git a/deny.toml b/deny.toml new file mode 100644 index 0000000..1a1ab81 --- /dev/null +++ b/deny.toml @@ -0,0 +1,39 @@ +# Public mirror dependency policy for cargo-deny. +# This is advisory validation for public engineering transparency. +# Final license and registry-submission review still requires legal review. + +[advisories] +version = 2 +yanked = "warn" +ignore = [] + +[licenses] +version = 2 +confidence-threshold = 0.8 +allow = [ + "Apache-2.0", + "Apache-2.0 WITH LLVM-exception", + "BSD-2-Clause", + "BSD-3-Clause", + "CC0-1.0", + "ISC", + "MIT", + "MPL-2.0", + "OpenSSL", + "Unicode-3.0", + "Unicode-DFS-2016", + "Zlib", +] + +[bans] +multiple-versions = "warn" +wildcards = "warn" +deny = [] +skip = [] +skip-tree = [] + +[sources] +unknown-registry = "warn" +unknown-git = "warn" +allow-registry = ["https://github.com/rust-lang/crates.io-index"] +allow-git = [] diff --git a/docs/QUALITY_STATUS_RU.md b/docs/QUALITY_STATUS_RU.md new file mode 100644 index 0000000..b413ff7 --- /dev/null +++ b/docs/QUALITY_STATUS_RU.md @@ -0,0 +1,41 @@ +# Quality status + +Статус: public engineering transparency document. + +## CI status + +Public GitHub Actions workflows are available for mirror validation: + +- `CI`: Rust checks, registry/docs checks and smoke checks. +- `Coverage`: cargo-llvm-cov baseline summary. +- `Security`: cargo audit, cargo deny, secret-pattern check and dependency + review for pull requests. + +GitHub Actions is public mirror validation only. Public CI is not registry release evidence and is not the primary registry build contour. + +## Coverage baseline policy + +Coverage threshold is not enforced yet. The first stage is tracking and +regression visibility: + +- collect `cargo llvm-cov --workspace --summary-only`; +- store coverage summary artifact; +- avoid failing early public builds by percentage before baseline review; +- add future threshold after the first stable baseline is reviewed. + +## Registry release build + +Registry release build and release evidence must be produced on the Russian +build-runner described in +`docs/registry/RU_BUILD_RUNNER_READINESS_RU.md`. + +## Security checks + +Public security checks are advisory/public validation. Registry release +security evidence must be generated in the Russian build contour. + +## Conservative positioning + +The quality layer does not claim certification, does not position AWatch-rus as +a SIEM/DLP replacement and does not claim legal completion of Russian software +registry registration. diff --git a/docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md b/docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md index 68a05f5..0b4ac3e 100644 --- a/docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md +++ b/docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md @@ -25,6 +25,12 @@ registry-readiness пакета, не подтверждает готовнос - Доказательная документация должна храниться в `docs/registry/`. - Backup-контур начат, но `restore_tested=false` до проверки восстановления на отдельном сервере. +- Public CI, coverage baseline and security scanning added on GitHub for + transparency. +- GitHub Actions is public mirror validation only and is not the primary + registry build contour. +- Russian build-runner remains required for registry release candidate and + release evidence. ## Текущее состояние @@ -65,6 +71,9 @@ Done / partially done: - Russian build-runner: planned. - Release artifacts storage in RF: planned. - Release evidence automation: partially done after this task. +- Public CI transparency: added. +- Coverage baseline: added, threshold not enforced yet. +- Security scanning: added. - Restore test: required. - Legal rightsholder confirmation: required. diff --git a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md index 782c868..2b1db74 100644 --- a/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md +++ b/docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md @@ -1,5 +1,44 @@ # Registry readiness changelog +## 2026-06-21 public engineering transparency + +Added: + +- Public CI workflow for GitHub mirror validation. +- Public coverage baseline workflow. +- Public security workflow with cargo audit, cargo deny, secret-pattern check + and dependency review for pull requests. +- `SECURITY.md`, `CONTRIBUTING.md`, public `ROADMAP.md`, issue templates and + pull request template. +- `docs/QUALITY_STATUS_RU.md`. + +Changed: + +- Registry manifest now records public engineering transparency fields. +- Registry readiness check now validates public CI/security/coverage/process + files. + +Runtime impact: + +- No runtime/product code changes. +- No API changes. +- No UI changes. +- GitHub Actions is public mirror validation only. +- Russian build-runner remains required for registry release candidate. + +Checks note: + +- Rust/runtime checks should run in public CI and on `awatch-build-01`. +- Local Rust checks may be skipped for this documentation/process-only update + only if the skip reason is recorded in the final report. + +Remaining gaps: + +- First successful public CI run after push. +- First coverage baseline artifact after push. +- First security scan baseline after push. +- Actual `awatch-build-01` provisioning and registry release evidence run. + ## 2026-06-21 Added: diff --git a/docs/registry/RELEASE_EVIDENCE_MANIFEST_RU.md b/docs/registry/RELEASE_EVIDENCE_MANIFEST_RU.md index df6f2b5..46717f9 100644 --- a/docs/registry/RELEASE_EVIDENCE_MANIFEST_RU.md +++ b/docs/registry/RELEASE_EVIDENCE_MANIFEST_RU.md @@ -45,6 +45,9 @@ build-runner и storage release artifacts в РФ или документиро владельцем схему. До этого нельзя утверждать, что source/build/release contour полностью закрыт для подачи. +Public GitHub Actions CI, coverage and security workflows are transparency +checks only. They are not primary registry release evidence. + ## Build-runner evidence Для `awatch-build-01` фиксировать: @@ -68,3 +71,17 @@ build-runner и storage release artifacts в РФ или документиро Evidence должен формироваться скриптом `scripts/build_release_evidence.sh` и проверяться через `scripts/check_release_evidence.sh`. До первого успешного release candidate build нельзя утверждать, что release evidence production-ready. + +## Public validation evidence + +Public mirror validation may include: + +- GitHub Actions CI result; +- coverage summary artifact; +- cargo audit / cargo deny result; +- dependency review result for pull requests; +- secret-pattern check result; +- issue and PR process evidence. + +This public validation can support engineering trust, but registry release +evidence remains tied to the Russian build-runner. diff --git a/docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md b/docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md index 7c45409..e0baf25 100644 --- a/docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md +++ b/docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md @@ -4,6 +4,10 @@ candidate на российском build-runner `awatch-build-01`. Он не утверждает, что release evidence уже production-ready до первого успешного запуска. +GitHub Actions is public mirror validation only. Public CI, coverage and +security workflows improve transparency, but registry release evidence must be +produced on the Russian build-runner. + ## Процесс release candidate 1. Checkout конкретного commit SHA или tag. diff --git a/docs/registry/RU_BUILD_RUNNER_READINESS_RU.md b/docs/registry/RU_BUILD_RUNNER_READINESS_RU.md index 15a776b..774c4f0 100644 --- a/docs/registry/RU_BUILD_RUNNER_READINESS_RU.md +++ b/docs/registry/RU_BUILD_RUNNER_READINESS_RU.md @@ -12,6 +12,9 @@ Build-runner нужен для воспроизводимой сборки relea build/test/check задачи не конкурировали с Git-хранилищем, HTTPS reverse proxy и backup-процедурами. +GitHub Actions is public mirror validation only. GitHub Actions is not the +primary registry build contour and does not replace `awatch-build-01`. + ## Целевая роль | Параметр | Значение | @@ -97,5 +100,8 @@ Build-runner должен формировать: - Russian build-runner: planned. - Release artifacts storage in RF: planned. - Release evidence automation: partially done after this task. +- Public CI transparency: added. +- Coverage baseline: added. +- Security scanning: added. - Restore test: required. - Legal rightsholder confirmation: required. diff --git a/docs/registry/registry-evidence-manifest.json b/docs/registry/registry-evidence-manifest.json index 52e699f..b0cbb1d 100644 --- a/docs/registry/registry-evidence-manifest.json +++ b/docs/registry/registry-evidence-manifest.json @@ -73,6 +73,15 @@ "release_manifest": true } }, + "public_engineering_transparency": { + "github_actions_ci": true, + "coverage_baseline": true, + "security_scanning": true, + "issue_templates": true, + "public_roadmap": true, + "github_role": "public_mirror_validation_only", + "registry_release_build": "requires_russian_build_runner" + }, "github_role_note": "GitHub is a public mirror only, not the target primary source/build/release contour for registry-readiness.", "remaining_gaps": [ "legal rightsholder confirmation", diff --git a/scripts/registry_readiness_check.sh b/scripts/registry_readiness_check.sh index 530e67c..abee9fd 100644 --- a/scripts/registry_readiness_check.sh +++ b/scripts/registry_readiness_check.sh @@ -46,8 +46,21 @@ required_files=( "docs/registry/LIFECYCLE_AND_SUPPORT_RU.md" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "docs/registry/registry-evidence-manifest.json" + "docs/QUALITY_STATUS_RU.md" "scripts/build_release_evidence.sh" "scripts/check_release_evidence.sh" + ".github/workflows/ci.yml" + ".github/workflows/security.yml" + ".github/workflows/coverage.yml" + ".github/ISSUE_TEMPLATE/bug_report.yml" + ".github/ISSUE_TEMPLATE/feature_request.yml" + ".github/ISSUE_TEMPLATE/registry_readiness_task.yml" + ".github/ISSUE_TEMPLATE/security_hardening_task.yml" + ".github/pull_request_template.md" + "SECURITY.md" + "CONTRIBUTING.md" + "ROADMAP.md" + "deny.toml" "README.md" ) @@ -79,6 +92,13 @@ if [[ -s "$MANIFEST" ]]; then and .build_runner.target_hostname == "awatch-build-01" and .build_runner.separate_from_git_server == true and (.build_runner.required_checks | index("release_evidence_check") != null) + and .public_engineering_transparency.github_actions_ci == true + and .public_engineering_transparency.coverage_baseline == true + and .public_engineering_transparency.security_scanning == true + and .public_engineering_transparency.issue_templates == true + and .public_engineering_transparency.public_roadmap == true + and .public_engineering_transparency.github_role == "public_mirror_validation_only" + and .public_engineering_transparency.registry_release_build == "requires_russian_build_runner" ' "$MANIFEST" >/dev/null || fail "manifest_required_fields" elif command -v python3 >/dev/null 2>&1; then python3 -m json.tool "$MANIFEST" >/dev/null || fail "invalid_json:docs/registry/registry-evidence-manifest.json" @@ -135,6 +155,20 @@ if build_runner.get("separate_from_git_server") is not True: raise SystemExit("build_runner.separate_from_git_server mismatch") if "release_evidence_check" not in build_runner.get("required_checks", []): raise SystemExit("build_runner.required_checks missing release_evidence_check") + +public = data.get("public_engineering_transparency") or {} +public_expected = { + "github_actions_ci": True, + "coverage_baseline": True, + "security_scanning": True, + "issue_templates": True, + "public_roadmap": True, + "github_role": "public_mirror_validation_only", + "registry_release_build": "requires_russian_build_runner", +} +for key, value in public_expected.items(): + if public.get(key) != value: + raise SystemExit(f"public_engineering_transparency.{key} mismatch") PY else fail "json_validator_missing:jq_or_python3_required" @@ -160,11 +194,30 @@ require_grep "restore_tested=false|restore_tested..false|\"restore_tested\"[[:sp require_grep "\"restore_tested\"[[:space:]]*:[[:space:]]*false" "docs/registry/registry-evidence-manifest.json" "restore_tested_false_manifest" require_grep "docs/registry" "docs/registry/WIKI_AND_DOCUMENTATION_POLICY_RU.md" "authoritative_docs_path_wiki_policy" require_grep "release_evidence_check" "docs/registry/registry-evidence-manifest.json" "release_evidence_check_manifest" +require_grep "Public engineering transparency" "README.md" "readme_public_engineering_transparency" +require_grep "GitHub Actions is public mirror validation only|public mirror validation only" "docs/registry/RU_BUILD_RUNNER_READINESS_RU.md" "github_actions_not_registry_build_runner" +require_grep "GitHub Actions is public mirror validation only|public mirror validation only" "docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md" "github_actions_not_registry_release_runbook" +require_grep "Public CI is not registry release evidence|not registry release evidence" "docs/QUALITY_STATUS_RU.md" "quality_public_ci_not_registry_evidence" +require_grep "requires_russian_build_runner|public_mirror_validation_only" "docs/registry/registry-evidence-manifest.json" "public_engineering_manifest" +require_grep "public mirror validation only" "SECURITY.md" "security_public_mirror_validation" +require_grep "public mirror validation only" "CONTRIBUTING.md" "contributing_public_mirror_validation" +require_grep "public mirror validation only" "ROADMAP.md" "roadmap_public_mirror_validation" +require_grep "cargo audit|cargo deny|secret-pattern" ".github/workflows/security.yml" "security_workflow_checks" +require_grep "cargo llvm-cov" ".github/workflows/coverage.yml" "coverage_workflow_llvm_cov" +require_grep "cargo fmt --all --check" ".github/workflows/ci.yml" "ci_workflow_fmt" scan_files=( "$ROOT/README.md" "$REGISTRY_DIR"/*.md "$REGISTRY_DIR"/*.json + "$ROOT/docs/QUALITY_STATUS_RU.md" + "$ROOT/SECURITY.md" + "$ROOT/CONTRIBUTING.md" + "$ROOT/ROADMAP.md" + "$ROOT/deny.toml" + "$ROOT/.github/workflows"/*.yml + "$ROOT/.github/ISSUE_TEMPLATE"/*.yml + "$ROOT/.github/pull_request_template.md" "$ROOT/scripts/build_release_evidence.sh" "$ROOT/scripts/check_release_evidence.sh" ) @@ -173,6 +226,10 @@ claim_scan_files=( "$ROOT/README.md" "$REGISTRY_DIR"/*.md "$REGISTRY_DIR"/*.json + "$ROOT/docs/QUALITY_STATUS_RU.md" + "$ROOT/SECURITY.md" + "$ROOT/CONTRIBUTING.md" + "$ROOT/ROADMAP.md" ) if grep -RInEi "(password|passwd|pwd|token|secret|api[_-]?key|private[[:space:]_-]?key)[[:space:]]*[:=][[:space:]]*['\"]?[A-Za-z0-9_./+=-]{8,}" "${scan_files[@]}" >/tmp/registry_secret_like.$$ 2>/dev/null; then @@ -195,7 +252,7 @@ fi rm -f /tmp/registry_forbidden_replacement.$$ if grep -RInEi "(ML/LLM-based detection|LLM-based detection|ML-based detection|automatic remediation)" "${claim_scan_files[@]}" \ - | grep -Eiv "(forbidden|not_made|not_claimed|не заявляет|не фиксируется|не используется|does not claim)" \ + | grep -Eiv "(forbidden|not_made|not_claimed|no claim|не заявляет|не фиксируется|не используется|does not claim)" \ >/tmp/registry_forbidden_ai_auto.$$ 2>/dev/null; then fail "forbidden_claim_ai_or_automatic_remediation:$(cat /tmp/registry_forbidden_ai_auto.$$)" fi