94 lines
2.5 KiB
JSON
94 lines
2.5 KiB
JSON
{
|
|
"audit_id": "ZY-PAT-AUDIT-2026-0324-001",
|
|
"type": "token-secret-audit",
|
|
"timestamp": "2026-03-24T07:42:00.000Z",
|
|
"executor": "ICE-GL-ZY001",
|
|
"trigger": "issue-directive",
|
|
"phase_1_findings": {
|
|
"cross_repo_secrets_found": 3,
|
|
"secrets": [
|
|
{
|
|
"name": "MAIN_REPO_TOKEN",
|
|
"references": 4,
|
|
"workflows": [
|
|
"federation-bridge.yml",
|
|
"pull-sync-awen.yml"
|
|
],
|
|
"usage_type": "federation-bridge + sub-repo-clone",
|
|
"is_guanghu_token": true,
|
|
"details": [
|
|
{
|
|
"file": "federation-bridge.yml",
|
|
"count": 3,
|
|
"method": "env-var-to-node-script",
|
|
"target": "qinfendebingshuo org repos"
|
|
},
|
|
{
|
|
"file": "pull-sync-awen.yml",
|
|
"count": 1,
|
|
"method": "git-clone-url-auth",
|
|
"target": "WENZHUOXI/guanghu-awen"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "CROSS_REPO_TOKEN",
|
|
"references": 2,
|
|
"workflows": [
|
|
"sync-persona-studio.yml"
|
|
],
|
|
"usage_type": "github-api-dispatch",
|
|
"is_guanghu_token": false,
|
|
"details": [
|
|
{
|
|
"file": "sync-persona-studio.yml",
|
|
"count": 2,
|
|
"method": "bearer-token-curl",
|
|
"target": "qinfendebingshuo/persona-studio"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "DEPLOY_GITHUB_TOKEN",
|
|
"references": 1,
|
|
"workflows": [
|
|
"auto-deploy-drive-bridge.yml"
|
|
],
|
|
"usage_type": "deploy-git-push",
|
|
"is_guanghu_token": false,
|
|
"details": [
|
|
{
|
|
"file": "auto-deploy-drive-bridge.yml",
|
|
"count": 1,
|
|
"method": "env-var-to-node-script",
|
|
"target": "self-repo-deploy"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"conclusion": "MAIN_REPO_TOKEN is the primary secret corresponding to guanghu-token"
|
|
},
|
|
"phase_4_security_scan": {
|
|
"hardcoded_tokens": {
|
|
"ghp_prefix": {
|
|
"found": false,
|
|
"note": "Only placeholder in dingtalk-bot/.env.example"
|
|
},
|
|
"github_pat_prefix": {
|
|
"found": false
|
|
},
|
|
"glpat_prefix": {
|
|
"found": false
|
|
}
|
|
},
|
|
"total_secrets_referenced": 57,
|
|
"verdict": "CLEAN"
|
|
},
|
|
"summary": {
|
|
"primary_secret": "MAIN_REPO_TOKEN",
|
|
"secondary_secrets": ["CROSS_REPO_TOKEN", "DEPLOY_GITHUB_TOKEN"],
|
|
"security_status": "CLEAN",
|
|
"action_required": "Human must update MAIN_REPO_TOKEN value in GitHub Settings"
|
|
}
|
|
}
|