hygiene: prepare MobilityOps for public release

.env.example

@@ -86,6 +86,10 @@ N8N_ENCRYPTION_KEY=replace-me
 N8N_BASIC_AUTH_ACTIVE=true
 N8N_BASIC_AUTH_USER=admin
 N8N_BASIC_AUTH_PASSWORD=change-me
+# Recipient and sender used by the importable alert workflow. Configure real,
+# monitored addresses in the deployment environment; repository defaults stay synthetic.
+MOBILITYOPS_ALERT_RECIPIENT=alerts@example.test
+MOBILITYOPS_ALERT_SENDER=n8n@example.test
 MOBILITYOPS_CALLBACK_TOKEN=replace-me-n8n-callback-token
 # Sent as the X-Fleet-Ops-Trigger-Token header when Fleet Ops calls the n8n return-
 # processing webhook, so the webhook trigger can require Header Auth instead of being

.gitea/workflows/ci.yml

@@ -12,6 +12,8 @@ permissions:
 
 jobs:
   acceptance:
+    # Never execute code from an untrusted public fork on the private runner.
+    if: ${{ gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:

.gitea/workflows/managed-validation.yml

@@ -42,33 +42,6 @@ jobs:
             exit 1
           fi
 
-          # MANAGED_FAST_PATH: documentation and this baseline workflow cannot
-          # affect the shipped runtime. Keep the required status check, but do
-          # not install toolchains or execute the full product suite.
-          if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
-            git fetch --no-tags --depth=1 origin "${GITHUB_BASE_REF}"
-            managed_base="origin/${GITHUB_BASE_REF}"
-            git diff --check "${managed_base}..HEAD"
-            mapfile -t managed_changed_files < <(
-              git diff --name-only --diff-filter=ACMR "${managed_base}..HEAD"
-            )
-            managed_runtime_change=0
-            for managed_path in "${managed_changed_files[@]}"; do
-              case "${managed_path}" in
-                *.md|*.mdx|docs/*|.github/ISSUE_TEMPLATE/*|.gitea/ISSUE_TEMPLATE/*|.gitea/runner-scope.sh|.gitea/workflows/managed-validation.yml)
-                  ;;
-                *)
-                  managed_runtime_change=1
-                  break
-                  ;;
-              esac
-            done
-            if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
-              printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
-                "${#managed_changed_files[@]}"
-              exit 0
-            fi
-          fi
           if [[ -f pyproject.toml || -f requirements.txt ]]; then
             # Compile only tracked Python sources. Running compileall after a
             # Node install would otherwise traverse node_modules and turn a

.gitleaksignore

@@ -0,0 +1,4 @@
+81e3fd63bdbcb2e9c4ae1d709ea46f40537b6f62:backend/tests/test_data_quality.py:generic-api-key:869
+0091c57c7fd82ffda16da1edfe5fa5589c8f1e13:backend/tests/test_return.py:generic-api-key:93
+0091c57c7fd82ffda16da1edfe5fa5589c8f1e13:backend/tests/test_return.py:generic-api-key:122
+0091c57c7fd82ffda16da1edfe5fa5589c8f1e13:backend/tests/test_return.py:generic-api-key:127

SECURITY.md

@@ -15,7 +15,7 @@ release line only.
 
 Do not disclose suspected vulnerabilities through a public issue.
 
-Report them privately to `jens@itworx.tech` with:
+Report them privately to `security@itworx.tech` with:
 
 - the affected revision, endpoint or component;
 - reproduction steps and prerequisites;

compose.yaml

@@ -107,6 +107,8 @@ services:
       N8N_BASIC_AUTH_PASSWORD: ${N8N_BASIC_AUTH_PASSWORD:-change-me}
       N8N_SECURE_COOKIE: "false"
       N8N_BLOCK_ENV_ACCESS_IN_NODE: "false"
+      MOBILITYOPS_ALERT_RECIPIENT: ${MOBILITYOPS_ALERT_RECIPIENT:-alerts@example.test}
+      MOBILITYOPS_ALERT_SENDER: ${MOBILITYOPS_ALERT_SENDER:-n8n@example.test}
       MOBILITYOPS_CALLBACK_TOKEN: ${MOBILITYOPS_CALLBACK_TOKEN:-replace-me-n8n-callback-token}
     ports:
       - "5678:5678"

n8n/workflows/fleet-ops-alert-receiver.json

@@ -17,7 +17,7 @@
       "id": "accept", "name": "Accept alert", "type": "n8n-nodes-base.respondToWebhook", "typeVersion": 1.4, "position": [740, 300]
     },
     {
-      "parameters": {"toRecipients": "jens@itworx.tech", "subject": "={{ $('Validate and format').item.json.subject }}", "bodyContent": "={{ $('Validate and format').item.json.html }}", "additionalFields": {"from": "n8n@itworx.tech", "bodyContentType": "html"}},
+      "parameters": {"toRecipients": "={{ $env.MOBILITYOPS_ALERT_RECIPIENT || 'alerts@example.test' }}", "subject": "={{ $('Validate and format').item.json.subject }}", "bodyContent": "={{ $('Validate and format').item.json.html }}", "additionalFields": {"from": "={{ $env.MOBILITYOPS_ALERT_SENDER || 'n8n@example.test' }}", "bodyContentType": "html"}},
       "id": "email", "name": "Send owner email", "type": "n8n-nodes-base.microsoftOutlook", "typeVersion": 2, "position": [980, 300],
       "credentials": {"microsoftOutlookOAuth2Api": {"id": "EDTj3sOsganaoDVL", "name": "M365 n8n Shared Mailbox"}},
       "retryOnFail": true, "maxTries": 3, "waitBetweenTries": 1000