From dec3b79793f51376b2bb7001af9c822afc452eac Mon Sep 17 00:00:00 2001 From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com> Date: Wed, 2 Sep 2026 23:37:30 +0200 Subject: [PATCH] hygiene: prepare ForgeFlow for public release --- .gitea/workflows/managed-validation.yml | 2 ++ SECURITY.md | 2 +- UPDATE_FROM_0.3.2.md | 2 +- docs/RELEASE_NOTES_0.3.2.md | 4 ++-- docs/UPDATING.md | 4 ++-- src/renderer/mock-bridge.js | 2 +- src/renderer/mock-deployment-bridge.js | 2 +- src/renderer/mock-repository-bridge.js | 2 +- tests/gitea-actions.test.mjs | 2 +- tests/log-redaction.test.mjs | 4 ++-- tests/unraid-deployment.test.mjs | 14 +++++++------- 11 files changed, 21 insertions(+), 19 deletions(-) diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml index 05072fe..b8d7385 100644 --- a/.gitea/workflows/managed-validation.yml +++ b/.gitea/workflows/managed-validation.yml @@ -21,6 +21,8 @@ concurrency: jobs: full: name: full + # Public fork code must never execute automatically on the private runner. + if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }} runs-on: ubuntu-latest timeout-minutes: 30 steps: diff --git a/SECURITY.md b/SECURITY.md index e8ad22c..1006433 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,7 +2,7 @@ ForgeFlow's detailed security model is documented in [`docs/SECURITY.md`](docs/SECURITY.md). -Report suspected vulnerabilities privately to the repository owner. Do not publish Gitea tokens, SSH credentials, update-signing material, private server addresses, support bundles containing sensitive data or other operational secrets in a public issue. +Report suspected vulnerabilities privately to `security@itworx.tech`. Do not publish Gitea tokens, SSH credentials, update-signing material, private server addresses, support bundles containing sensitive data or other operational secrets in a public issue. For a useful report, include the affected ForgeFlow version/commit, component, minimal reproduction steps, expected and observed behaviour and security impact. Use sanitized or synthetic repository/server data whenever possible. diff --git a/UPDATE_FROM_0.3.2.md b/UPDATE_FROM_0.3.2.md index 283c59f..565d135 100644 --- a/UPDATE_FROM_0.3.2.md +++ b/UPDATE_FROM_0.3.2.md @@ -3,7 +3,7 @@ 1. Close ForgeFlow completely. 2. Extract `ForgeFlow-0.4.0-update-from-0.3.2.zip`. 3. Copy the contents of the included `ForgeFlow` folder into your existing - `C:\Users\Jens\dyad-apps\ForgeFlow` folder and replace existing files. + `C:\Users\your-name\Apps\ForgeFlow` folder and replace existing files. 4. Do not create a nested `ForgeFlow\ForgeFlow` folder. 5. Open Windows PowerShell in the existing ForgeFlow folder and run: diff --git a/docs/RELEASE_NOTES_0.3.2.md b/docs/RELEASE_NOTES_0.3.2.md index 2f93f8b..795c406 100644 --- a/docs/RELEASE_NOTES_0.3.2.md +++ b/docs/RELEASE_NOTES_0.3.2.md @@ -17,9 +17,9 @@ for every repository. ForgeFlow now: Example: ```text -Default project root: C:\Users\Jens\Projects +Default project root: C:\Users\your-name\Projects Gitea repository: Jens/Portfolio -Automatic target: C:\Users\Jens\Projects\Portfolio +Automatic target: C:\Users\your-name\Projects\Portfolio ``` A separate **Choose another location** action remains available for exceptional diff --git a/docs/UPDATING.md b/docs/UPDATING.md index b9b8720..0b615b1 100644 --- a/docs/UPDATING.md +++ b/docs/UPDATING.md @@ -53,13 +53,13 @@ The binary publisher refuses to upload when local `HEAD` differs from the config Extract the complete source ZIP so this file exists: ```text -C:\Users\Jens\Downloads\ForgeFlow-\ForgeFlow\package.json +C:\Users\your-name\Downloads\ForgeFlow-\ForgeFlow\package.json ``` Run: ```powershell -cd C:\Users\Jens\Downloads\ForgeFlow-\ForgeFlow +cd C:\Users\your-name\Downloads\ForgeFlow-\ForgeFlow Set-ExecutionPolicy -Scope Process Bypass .\Publish-ForgeFlow-Release.ps1 ``` diff --git a/src/renderer/mock-bridge.js b/src/renderer/mock-bridge.js index 434dd85..dfb7ed0 100644 --- a/src/renderer/mock-bridge.js +++ b/src/renderer/mock-bridge.js @@ -176,7 +176,7 @@ username: "root", authType: "privateKey", basePath: "/mnt/user/appdata", - privateKeyPath: "C:\\Users\\Jens\\.ssh\\id_ed25519", + privateKeyPath: "C:\\Users\\your-name\\.ssh\\id_ed25519", hostFingerprint: "SHA256:demo", hasPassword: false, hasPassphrase: false, diff --git a/src/renderer/mock-deployment-bridge.js b/src/renderer/mock-deployment-bridge.js index 4aa6445..903e6b1 100644 --- a/src/renderer/mock-deployment-bridge.js +++ b/src/renderer/mock-deployment-bridge.js @@ -665,7 +665,7 @@ function createMockDeploymentBridge(context) { async exportDiagnostics(privacyMode = "standard") { await wait(500); return { - path: `C:\Users\Jens\Downloads\ForgeFlow-Diagnostics-demo.zip`, + path: `C:\Users\your-name\Downloads\ForgeFlow-Diagnostics-demo.zip`, bytes: 38221, size: "37.3 KB", sha256: "b".repeat(64), diff --git a/src/renderer/mock-repository-bridge.js b/src/renderer/mock-repository-bridge.js index 065e608..dc9c81d 100644 --- a/src/renderer/mock-repository-bridge.js +++ b/src/renderer/mock-repository-bridge.js @@ -29,7 +29,7 @@ function createMockRepositoryBridge(context) { }, async selectKeyFile() { await wait(); - return "C:\\Users\\Jens\\.ssh\\id_ed25519"; + return "C:\\Users\\your-name\\.ssh\\id_ed25519"; }, async setupPreflight({ baseUrl, token, roots = [] }) { await wait(240); diff --git a/tests/gitea-actions.test.mjs b/tests/gitea-actions.test.mjs index f5d7647..38162e3 100644 --- a/tests/gitea-actions.test.mjs +++ b/tests/gitea-actions.test.mjs @@ -164,7 +164,7 @@ test('rewrites Gitea internal HTTP release URLs to the configured public origin' return Buffer.from('asset'); }; await service.downloadReleaseAsset('Jens', 'ForgeFlow', 107, 412, { - downloadUrl: 'http://192.168.10.150:3000/Jens/ForgeFlow/releases/download/v0.10.1/ForgeFlow.exe', + downloadUrl: 'http://192.168.56.10:3000/Jens/ForgeFlow/releases/download/v0.10.1/ForgeFlow.exe', }); assert.equal(requested, 'https://gitea.example.test/Jens/ForgeFlow/releases/download/v0.10.1/ForgeFlow.exe'); }); diff --git a/tests/log-redaction.test.mjs b/tests/log-redaction.test.mjs index 092338a..c695027 100644 --- a/tests/log-redaction.test.mjs +++ b/tests/log-redaction.test.mjs @@ -20,7 +20,7 @@ test('redacts runtime credentials, structured secrets, private keys and URL cred test('sanitizes nested sensitive keys and aliases user paths', () => { const value = { accessToken: 'do-not-keep', - nested: { password: 'do-not-keep-either', path: 'C:\\Users\\Jens\\Projects\\ForgeFlow' }, + nested: { password: 'do-not-keep-either', path: 'C:\\Users\\example-user\\Projects\\ForgeFlow' }, home: '/home/jens/projects/forgeflow' }; const sanitized = sanitizeForDiagnostics(value, { homeDir: '/home/jens', cwd: '/work/ForgeFlow' }); @@ -48,7 +48,7 @@ test('strict privacy redacts private addresses, infrastructure URLs and server p }); test('path aliasing handles slash variants', () => { - const result = pathAlias('C:\\Users\\Jens\\src and C:/Users/Jens/src', { homeDir: 'C:\\Users\\Jens', cwd: 'D:\\ForgeFlow' }); + const result = pathAlias('C:\\Users\\example-user\\src and C:/Users/example-user/src', { homeDir: 'C:\\Users\\example-user', cwd: 'D:\\ForgeFlow' }); assert.doesNotMatch(result, /Users[\\/]Jens/); assert.match(result, //); }); diff --git a/tests/unraid-deployment.test.mjs b/tests/unraid-deployment.test.mjs index 31f8863..bffd6eb 100644 --- a/tests/unraid-deployment.test.mjs +++ b/tests/unraid-deployment.test.mjs @@ -121,10 +121,10 @@ test("server pull prefers the linked checkout origin over stale detected SSH end const repository = { fullName: "Jens/Portfolio", localStatus: { remoteUrl: "git@gitea.itworx.tech:Jens/Portfolio.git" }, - sshUrl: "ssh://git@192.168.10.150:222/Jens/Portfolio.git", - preferredCloneUrl: "ssh://git@192.168.10.150:222/Jens/Portfolio.git", + sshUrl: "ssh://git@192.168.56.10:222/Jens/Portfolio.git", + preferredCloneUrl: "ssh://git@192.168.56.10:222/Jens/Portfolio.git", }; - const profile = { cloneUrl: "ssh://git@192.168.10.150:222/Jens/Portfolio.git" }; + const profile = { cloneUrl: "ssh://git@192.168.56.10:222/Jens/Portfolio.git" }; assert.equal(service.serverGitRemote(repository, profile), "git@gitea.itworx.tech:Jens/Portfolio.git"); assert.deepEqual(service.serverGitHost(repository, profile), { host: "gitea.itworx.tech", port: 22 }); @@ -894,7 +894,7 @@ test("DockerMan metadata uses dockerman labels, a template WebUI and lowercase-s remoteFolder: "Portfolio", environment: "production", hostPort: 5150, - webUiUrl: "http://192.168.10.150:5150/admin", + webUiUrl: "http://192.168.56.10:5150/admin", dockerShell: "/bin/sh", }, { name: "Portfolio" }, @@ -927,7 +927,7 @@ test("DockerMan integration writes a persistent template fallback and invalidate remoteFolder: "Portfolio", environment: "production", hostPort: 5150, - webUiUrl: "http://192.168.10.150:5150/", + webUiUrl: "http://192.168.56.10:5150/", dockerShell: "/bin/sh", manageDockerMan: true, generatedCompose: true, @@ -1124,7 +1124,7 @@ test("existing Unraid deployment discovery derives profile values from Docker, C defaultBranch: "main", sshUrl: "ssh://git@gitea/Jens/blockpilot-autonomous.git", }, - server: { id: "unraid", host: "192.168.10.150" }, + server: { id: "unraid", host: "192.168.56.10" }, remoteFolder: "blockpilot-autonomous", remotePath: "/mnt/user/appdata/blockpilot-autonomous", payload: { @@ -1399,7 +1399,7 @@ test("push bundle preflight does not require Git or Gitea credentials on Unraid" getServer: () => ({ id: "unraid", name: "Unraid", - host: "192.168.10.150", + host: "192.168.56.10", port: 22, username: "root", basePath: "/mnt/user/appdata", -- 2.54.0