docs(status): record public CI security coverage validation

2026-06-22 20:35:06 +03:00
parent cc0b2ff53d
commit d412f35644
5 changed files with 78 additions and 6 deletions
@@ -11,13 +11,23 @@ backup, registry-readiness документации, плана российск
 ## Текущий baseline

 - Baseline commit: `4970d31 chore(public): add CI coverage security and OSS process visibility`.
+- Public validation after hardening commit:
+  `4f90aba chore(security): harden public secret scan and document policy`.
 - Primary Russian Git:
  `https://git.iri1968.dpdns.org/awatch-rus/AWatch-rus`.
 - GitHub:
  `public mirror / public validation only`.
+- Public CI status: passed.
+- Public coverage workflow: passed.
+- Public security workflow: passed.
+- Secret scan: hardened and passed.
+- GitHub Actions role: public mirror validation only.
 - Gitea operator account: `igor`; пароль/токены не входят в tracked files.
 - Основной доказательный пакет для registry-readiness:
  `docs/registry/`.
+- Public validation passed status does not constitute registry release evidence.
+- Registry release evidence still requires the Russian build-runner contour.
+- Russian build-runner still required for registry release evidence.

 ## Что готово

@@ -42,6 +52,8 @@ backup, registry-readiness документации, плана российск
  `scripts/check_release_evidence.sh`.
 - Добавлены публичные GitHub Actions workflow для CI, coverage baseline и
  security scanning.
+- Первый публичный GitHub Actions validation после hardening secret scan прошел
+  по контурам `CI`, `Coverage` и `Security`.
 - Добавлены `SECURITY.md`, `CONTRIBUTING.md`, `ROADMAP.md`, issue templates и
  pull request template.

@@ -67,12 +79,11 @@ backup, registry-readiness документации, плана российск

 ## Следующие рекомендуемые этапы

-1. Проверить первый публичный прогон GitHub Actions после push.
-2. Выполнить тестовое восстановление Gitea backup на отдельном сервере.
-3. Подготовить временный или постоянный российский build-runner
+1. Выполнить тестовое восстановление Gitea backup на отдельном сервере.
+2. Подготовить временный или постоянный российский build-runner
   `awatch-build-01`.
-4. Сформировать первый release evidence package на российском build-runner.
-5. Подготовить юридический пакет правообладателя для финальной проверки.
+3. Сформировать первый release evidence package на российском build-runner.
+4. Подготовить юридический пакет правообладателя для финальной проверки.

 ## Связанные документы

@@ -13,6 +13,14 @@ Public GitHub Actions workflows are available for mirror validation:

 GitHub Actions is public mirror validation only. Public CI is not registry release evidence and is not the primary registry build contour.

+First public validation passed after
+`4f90aba chore(security): harden public secret scan and document policy`:
+
+- `CI`: passed.
+- `Coverage`: passed.
+- `Security`: passed.
+- Secret-pattern scan: hardened and passed.
+
 ## Coverage baseline policy

 Coverage threshold is not enforced yet. The first stage is tracking and
@@ -29,6 +37,9 @@ Registry release build and release evidence must be produced on the Russian
 build-runner described in
 `docs/registry/RU_BUILD_RUNNER_READINESS_RU.md`.

+Public validation passed does not replace Russian build-runner release
+evidence. Russian build-runner still required for registry release evidence.
+
 ## Security checks

 Public security checks are advisory/public validation. Registry release
@@ -1,5 +1,26 @@
 # Registry readiness changelog

+## 2026-06-22 public GitHub Actions validation passed
+
+Changed:
+
+- Recorded first public validation passed after
+  `4f90aba chore(security): harden public secret scan and document policy`.
+- Documented passed public GitHub Actions contours: `CI`, `Coverage` and
+  `Security`.
+- Documented that the hardened public secret scan passed.
+- Reconfirmed that GitHub Actions remains public mirror validation only and is
+  not registry release evidence.
+- Reconfirmed that registry release evidence still requires the Russian
+  build-runner contour.
+
+Runtime impact:
+
+- No runtime/product code changes.
+- No API changes.
+- No UI changes.
+- No business logic changes.
+
 ## 2026-06-22 Gitea duplicate status

 Changed:
@@ -2,7 +2,7 @@
  "schema_version": 1,
  "product": "AWatch-rus",
  "status": "registry-readiness infrastructure evidence manifest",
-  "updated_at": "2026-06-21",
+  "updated_at": "2026-06-22",
  "primary_source_repository": "https://git.iri1968.dpdns.org/awatch-rus/AWatch-rus",
  "primary_git_clone_url_https": "https://git.iri1968.dpdns.org/awatch-rus/AWatch-rus.git",
  "primary_git_platform": "self-hosted Gitea",
@@ -75,8 +75,12 @@
  },
  "public_engineering_transparency": {
    "github_actions_ci": true,
+    "github_actions_ci_status": "passed",
    "coverage_baseline": true,
+    "coverage_workflow_status": "passed",
    "security_scanning": true,
+    "security_workflow_status": "passed",
+    "secret_scan_status": "passed",
    "issue_templates": true,
    "public_roadmap": true,
    "github_role": "public_mirror_validation_only",
@@ -96,8 +96,12 @@ if [[ -s "$MANIFEST" ]]; then
      and .build_runner.separate_from_git_server == true
      and (.build_runner.required_checks | index("release_evidence_check") != null)
      and .public_engineering_transparency.github_actions_ci == true
+      and .public_engineering_transparency.github_actions_ci_status == "passed"
      and .public_engineering_transparency.coverage_baseline == true
+      and .public_engineering_transparency.coverage_workflow_status == "passed"
      and .public_engineering_transparency.security_scanning == true
+      and .public_engineering_transparency.security_workflow_status == "passed"
+      and .public_engineering_transparency.secret_scan_status == "passed"
      and .public_engineering_transparency.issue_templates == true
      and .public_engineering_transparency.public_roadmap == true
      and .public_engineering_transparency.github_role == "public_mirror_validation_only"
@@ -162,8 +166,12 @@ if "release_evidence_check" not in build_runner.get("required_checks", []):
 public = data.get("public_engineering_transparency") or {}
 public_expected = {
    "github_actions_ci": True,
+    "github_actions_ci_status": "passed",
    "coverage_baseline": True,
+    "coverage_workflow_status": "passed",
    "security_scanning": True,
+    "security_workflow_status": "passed",
+    "secret_scan_status": "passed",
    "issue_templates": True,
    "public_roadmap": True,
    "github_role": "public_mirror_validation_only",
@@ -194,6 +202,12 @@ require_grep "PROJECT_STATUS_RU\\.md" "README.md" "readme_project_status_link"
 require_grep "4970d31" "docs/PROJECT_STATUS_RU.md" "project_status_baseline_commit"
 require_grep "git\\.iri1968\\.dpdns\\.org/awatch-rus/AWatch-rus" "docs/PROJECT_STATUS_RU.md" "project_status_primary_git"
 require_grep "public mirror / public validation only" "docs/PROJECT_STATUS_RU.md" "project_status_github_role"
+require_grep "Public CI status:[[:space:]]*passed" "docs/PROJECT_STATUS_RU.md" "project_status_public_ci_passed"
+require_grep "Public coverage workflow:[[:space:]]*passed" "docs/PROJECT_STATUS_RU.md" "project_status_public_coverage_passed"
+require_grep "Public security workflow:[[:space:]]*passed" "docs/PROJECT_STATUS_RU.md" "project_status_public_security_passed"
+require_grep "Secret scan:[[:space:]]*hardened and passed" "docs/PROJECT_STATUS_RU.md" "project_status_secret_scan_passed"
+require_grep "Public validation passed.*not.*registry release evidence|not registry release evidence" "docs/PROJECT_STATUS_RU.md" "project_status_public_validation_not_release_evidence"
+require_grep "Russian build-runner.*required|requires_russian_build_runner" "docs/PROJECT_STATUS_RU.md" "project_status_russian_runner_required"
 require_grep "docs/registry" "docs/PROJECT_STATUS_RU.md" "project_status_registry_docs"
 require_grep "GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU\\.md|Restore outline|Post-restore checks" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_restore_runbook"
 require_grep "awatch-gitea-backup\\.timer" "docs/registry/GITEA_BACKUP_AND_RESTORE_RUNBOOK_RU.md" "backup_timer"
@@ -207,7 +221,18 @@ require_grep "SECURITY_SCANNING_POLICY_RU\\.md" "README.md" "readme_security_sca
 require_grep "GitHub Actions is public mirror validation only|public mirror validation only" "docs/registry/RU_BUILD_RUNNER_READINESS_RU.md" "github_actions_not_registry_build_runner"
 require_grep "GitHub Actions is public mirror validation only|public mirror validation only" "docs/registry/RELEASE_EVIDENCE_RUNBOOK_RU.md" "github_actions_not_registry_release_runbook"
 require_grep "Public CI is not registry release evidence|not registry release evidence" "docs/QUALITY_STATUS_RU.md" "quality_public_ci_not_registry_evidence"
+require_grep "First public validation passed|public validation passed" "docs/QUALITY_STATUS_RU.md" "quality_first_public_validation_passed"
+require_grep "Coverage.*passed" "docs/QUALITY_STATUS_RU.md" "quality_coverage_workflow_passed"
+require_grep "Security.*passed" "docs/QUALITY_STATUS_RU.md" "quality_security_workflow_passed"
+require_grep "Coverage threshold is not enforced yet" "docs/QUALITY_STATUS_RU.md" "quality_no_coverage_threshold"
+require_grep "Russian build-runner.*required" "docs/QUALITY_STATUS_RU.md" "quality_russian_runner_required"
 require_grep "requires_russian_build_runner|public_mirror_validation_only" "docs/registry/registry-evidence-manifest.json" "public_engineering_manifest"
+require_grep "\"github_actions_ci_status\"[[:space:]]*:[[:space:]]*\"passed\"" "docs/registry/registry-evidence-manifest.json" "manifest_github_actions_ci_passed"
+require_grep "\"coverage_workflow_status\"[[:space:]]*:[[:space:]]*\"passed\"" "docs/registry/registry-evidence-manifest.json" "manifest_coverage_passed"
+require_grep "\"security_workflow_status\"[[:space:]]*:[[:space:]]*\"passed\"" "docs/registry/registry-evidence-manifest.json" "manifest_security_passed"
+require_grep "\"secret_scan_status\"[[:space:]]*:[[:space:]]*\"passed\"" "docs/registry/registry-evidence-manifest.json" "manifest_secret_scan_passed"
+require_grep "public GitHub Actions validation passed" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_public_validation_passed"
+require_grep "No business logic changes" "docs/registry/REGISTRY_READINESS_CHANGELOG_RU.md" "changelog_no_business_logic_changes"
 require_grep "public mirror validation only" "SECURITY.md" "security_public_mirror_validation"
 require_grep "public mirror validation only" "CONTRIBUTING.md" "contributing_public_mirror_validation"
 require_grep "public mirror validation only" "ROADMAP.md" "roadmap_public_mirror_validation"