GovOPlaN/govoplan
1
0
Fork 0
Code Issues 10 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

ci: mount audit workspace safely
Some checks failed
Dependency Audit / dependency-audit (push) Successful in 1m43s
Details
Security Audit / security-audit (push) Failing after 4m10s
Details

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-23 00:30:28 +02:00
parent 3fc17701df
commit 8b93bbc6b6
5 changed files with 656 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/SECURITY_AUDIT.md
View File

@@ -164,10 +164,12 @@ The regular `Security Audit` workflow reuses the fingerprinted toolbox image
when the Docker daemon is persistent, which is the normal case for the
self-hosted Gitea runner using the host Docker socket. Trusted push, schedule,
and manual runs scan all registered repositories; authenticated SSH is used
only for the private website repository. Pull-request audit runs stay disabled
while the audit runner exposes its host Docker socket: PR-controlled audit code
must run on a disposable or rootless runner without host-socket access. The
separate
only for the private website repository. The wrapper inspects the Actions job
mount table and forwards only the narrowest writable mount covering the audit
scope; it never inherits the job's Docker socket or unrelated runner mounts.
Pull-request audit runs stay disabled while the audit runner exposes its host
Docker socket: PR-controlled audit code must run on a disposable or rootless
runner without host-socket access. The separate
`Security Audit Toolbox Update` workflow runs weekly with
`SECURITY_AUDIT_UPDATE=1`; it pulls current base images and re-resolves the
allowed tool version ranges into a refreshed local image.