fix(#664): remediate break-glass restart workflow blockers B1, B6/B11, B9, B10, B8, and B12

gitea_audit.py

@@ -27,13 +27,32 @@ ALLOWED = "allowed"
 BLOCKED = "blocked"
 FAILED = "failed"
 SUCCEEDED = "succeeded"
+REQUESTED = "requested"
+ACCEPTED = "accepted"
+PENDING = "pending"
 
 REDACTED = "[REDACTED]"
 
 # A dict key containing any of these (case-insensitive) has its value redacted.
 _SECRET_KEY_HINTS = ("token", "password", "secret", "authorization", "auth")
 # A string value starting with one of these has the following run redacted.
-_SECRET_VALUE_PREFIXES = ("token ", "Basic ", "Bearer ")
+_SECRET_VALUE_PREFIXES = ("token ", "Basic ", "Bearer ", "token:", "bearer:", "basic:")
+
+_BARE_SECRET_PATTERN = re.compile(
+    r'(?i)\b(?:'
+    r'ghp_[A-Za-z0-9_]{16,}'
+    r'|gho_[A-Za-z0-9_]{16,}'
+    r'|ghu_[A-Za-z0-9_]{16,}'
+    r'|ghs_[A-Za-z0-9_]{16,}'
+    r'|ghr_[A-Za-z0-9_]{16,}'
+    r'|sk-live-[A-Za-z0-9_-]{16,}'
+    r'|sk-proj-[A-Za-z0-9_-]{16,}'
+    r'|sk-[A-Za-z0-9_-]{20,}'
+    r'|glpat-[A-Za-z0-9_-]{16,}'
+    r'|sec-[A-Za-z0-9_-]{16,}'
+    r')\b'
+)
+
 
 # Known synthetic test-only domains/hostnames to preserve
 _SYNTHETIC_HOSTS = {
@@ -115,20 +134,23 @@ def redact_urls(text: str) -> str:
 
 
 def _redact_str(text):
-    """Redact anything that looks like an Authorization credential or raw URL in *text*."""
+    """Redact anything that looks like an Authorization credential, bare secret token, or raw URL in *text*."""
     if not isinstance(text, str) or not text:
         return text
-    out = text
+    out = _BARE_SECRET_PATTERN.sub(REDACTED, text)
+    out_lower = out.lower()
     for prefix in _SECRET_VALUE_PREFIXES:
+        prefix_lower = prefix.lower()
         idx = 0
         while True:
-            i = out.find(prefix, idx)
+            i = out_lower.find(prefix_lower, idx)
             if i == -1:
                 break
             j = i + len(prefix)
             while j < len(out) and not out[j].isspace():
                 j += 1
             out = out[:i] + prefix + REDACTED + out[j:]
+            out_lower = out.lower()
             idx = i + len(prefix) + len(REDACTED)
     return redact_urls(out)