lekss361/gendesign
1
0
Fork 0
Code Issues 57 Pull requests Projects Releases Packages Wiki Activity Actions

docs(infra): secrets rotation policy (#78) #1324

Merged
bot-backend merged 1 commit from docs/secrets-rotation-policy-78 into main 2026-06-13 18:50:56 +00:00
Conversation 0 Commits 1 Files changed 1 +301
bot-backend commented 2026-06-13 18:50:25 +00:00
Collaborator
Copy link

#78 Secrets_Rotation_Policy.md — реестр 8 классов секретов + процедуры ротации + quarterly audit + OIDC verdict (future, Forgejo 10.0.3). 🔴 Флагает sshkey.txt (PR #391) достижимый в git-истории — deploy-key скомпрометирован, нужна ротация. Значения в vault (не в репо). Closes #78

#78 Secrets_Rotation_Policy.md — реестр 8 классов секретов + процедуры ротации + quarterly audit + OIDC verdict (future, Forgejo 10.0.3). 🔴 Флагает sshkey.txt (PR #391) достижимый в git-истории — deploy-key скомпрометирован, нужна ротация. Значения в vault (не в репо). Closes #78
bot-backend added 1 commit 2026-06-13 18:50:26 +00:00
docs(infra): secrets rotation policy + procedure (#78)
All checks were successful
CI / changes (push) Successful in 7s
Details
CI / backend-tests (push) Has been skipped
Details
CI / frontend-tests (push) Has been skipped
Details
CI / openapi-codegen-check (push) Has been skipped
Details
CI / changes (pull_request) Successful in 6s
Details
CI / backend-tests (pull_request) Has been skipped
Details
CI / frontend-tests (pull_request) Has been skipped
Details
CI / openapi-codegen-check (pull_request) Has been skipped
Details
d030b04cf2 
Compliance-doc: реестр классов секретов (CI/CD + prod runtime), процедуры ротации
per-class с downtime-эффектом, периодичность, quarterly audit-чеклист. OIDC verdict:
future (Forgejo 10.0.3 без Actions OIDC token provider; deploy = прямой SSH, не cloud
federation). Флагает sshkey.txt (PR #391) достижимый в git-истории — deploy-key
скомпрометирован, нужна ротация. Значения — в vault meta/00_credentials.md (не в репо).

Closes #78
bot-backend merged commit d030b04cf2 into main 2026-06-13 18:50:56 +00:00
bot-backend deleted branch docs/secrets-rotation-policy-78 2026-06-13 18:50:56 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
admin

Admin UI / internal tools / pipeline tracker

  
analytics

Аналитика данных / matching

  
auth

Authentication / authorization / multi-tenancy

  
automation

Автоматизация / cron / scheduler

  
bug

Something isn't working

  
business

Коммерческая воронка / пилоты / pipeline / реестр ПО

  
chore

Operational housekeeping

  
ci

Forgejo Actions / build pipeline

  
compliance

152-ФЗ / реестр ПО / legal / TOS

  
data

Data sources, parsers, ETL

  
data-moat

Уникальные данные — sales tracker, CRM aggregation

  
docs

README / runbooks / onboarding

  
duplicate

This issue or pull request already exists

  
dx

Developer experience / build speed

  
enhancement

New feature or request

  
Fable 5 ревью

Находки полного мульти-агентного ревью (Claude Fable 5, 2026-06-09)

  
feedback/max

Feedback from Max (Senior partner)

  
generative

Generative Design — concept generation engine

  
GG-форсайт

Новое ТЗ от Ген Геныча (июнь 2026): Site Finder v2 — ИИ-прогноз продуктовой стратегии девелопера. Актуальный приоритет.

  
needs-discussion

Pending team sync / decision

  
needs-human

Human review/decision required

  
observability

Monitoring / metrics / logs / Sentry / Uptime

  
pause-bots

Kill-switch — all autonomous bots pause

  
performance

Latency / throughput / DB query tuning

  
priority/p0

Critical / production-blocker

  
priority/p1

High priority

  
priority/p2

Normal priority

  
priority/p3

Низкий приоритет (follow-up, tech-debt)

  
scope/backend

Backend Python — FastAPI, Celery, scrapers

  
scope/db

DB migrations, indexes, SQL

  
scope/devops

docker-compose, Caddy, workflows

  
scope/frontend

Frontend — Next.js, React, TypeScript

  
scope/qa

Tests, smoke, Playwright

  
scrapers

Скрапперы (Avito/Cian/Yandex/Rosreestr)

  
security

Security audit / secrets / vulnerabilities

  
site-finder

Site Finder scoring quality & data layer

  
stage/1

Stage 1: Generative MVP (нед 2-7)

  
stage/2

Stage 2: Site Finder MVP (нед 8-12)

  
status/blocked

Blocked — needs human intervention

  
status/done

Closed, completed

  
status/needs-analysis

Raw/fuzzy task filed by human — auto-analyst подхватывает: code-archeology + декомпозиция в actionable scope/* + status/ready (или split на под-issues)

  
status/needs-fix

Reviewer/QA вернул worker на доработку — worker сам чинит свой PR (fixup), НЕ требует human (в отличие от status/blocked)

  
status/qa

PR merged, awaiting smoke test

  
status/ready

Ready for pickup by worker bot

  
status/review

PR open, awaiting code review

  
status/wip

Work in progress (worker claimed)

  
tech-debt

Технический долг

  
tradein

Trade-In MVP проект

  
ux

User experience / responsive / conversion

  
week ревью 1

Week review 1 — находки multi-agent аудита проекта (2026-06-14)

  
wontfix

This will not be worked on

  
вторичка

Trade-In Estimator — проект оценки вторичного жилья

  
ИРД

Исходно-разрешительная документация — слой ограничений участка для analyze-таблицы

No labels
admin
analytics
auth
automation
bug
business
chore
ci
compliance
data
data-moat
docs
duplicate
dx
enhancement
Fable 5 ревью
feedback/max
generative
GG-форсайт
needs-discussion
needs-human
observability
pause-bots
performance
priority/p0
priority/p1
priority/p2
priority/p3
scope/backend
scope/db
scope/devops
scope/frontend
scope/qa
scrapers
security
site-finder
stage/1
stage/2
status/blocked
status/done
status/needs-analysis
status/needs-fix
status/qa
status/ready
status/review
status/wip
tech-debt
tradein
ux
week ревью 1
wontfix
вторичка
ИРД
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: lekss361/gendesign#1324
No description provided.
Delete branch "docs/secrets-rotation-policy-78"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?