Add typed CI attribution to audit records #269

New issue

Closed

opened 2026-08-01 19:31:55 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-01 19:31:55 +00:00

Member

Problem

Ward issue #1632 needs an accepted repo verb audit row to preserve validated CI checkout attribution. The shared audit.Record wire type currently has no typed field for provider-neutral CI evidence, so a consumer cannot attach commit, repository, event ref, and run identity without overloading unrelated fields.

Boundary

cli-guard owns only the generic audit wire shape. It must not detect Forgejo, read CI environment variables, validate Git relationships, or impose consumer policy. Ward owns those decisions and adapts validated evidence into this type.

Parent: coilyco-flight-deck/ward#1632

Acceptance

audit.Record can carry an optional typed CI context with provider, server, repository, event, ref, base, head, immutable SHA, workflow/job, actor, run ID, run number, and run attempt attribution.
Empty CI context remains absent from existing JSON rows.
Round-trip tests preserve the typed context.
The audit feature documentation names the optional context without claiming it is independently trusted.

## Problem Ward issue #1632 needs an accepted repo verb audit row to preserve validated CI checkout attribution. The shared audit.Record wire type currently has no typed field for provider-neutral CI evidence, so a consumer cannot attach commit, repository, event ref, and run identity without overloading unrelated fields. ## Boundary cli-guard owns only the generic audit wire shape. It must not detect Forgejo, read CI environment variables, validate Git relationships, or impose consumer policy. Ward owns those decisions and adapts validated evidence into this type. Parent: https://forgejo.coilysiren.me/coilyco-flight-deck/ward/issues/1632 ## Acceptance * audit.Record can carry an optional typed CI context with provider, server, repository, event, ref, base, head, immutable SHA, workflow/job, actor, run ID, run number, and run attempt attribution. * Empty CI context remains absent from existing JSON rows. * Round-trip tests preserve the typed context. * The audit feature documentation names the optional context without claiming it is independently trusted.

coilyco-ops referenced this issue from a commit

2026-08-01 19:39:12 +00:00

feat(audit): add typed CI attribution

coilyco-ops closed this issue

2026-08-01 19:39:12 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/umbra#269

No description provided.

Rows
Columns