Scaled-Tech-Consulting/Gitea-Tools
2
0
Fork 0
Code Issues 6 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Audit-log Gitea MCP mutating actions with execution profile metadata #18

New Issue
Closed
opened 2026-07-01 11:16:21 -05:00 by jcwalker3 · 1 comment
jcwalker3 commented 2026-07-01 11:16:21 -05:00
Owner
Copy Link
Copy Source

Parent

Roadmap #10 — Task-scoped MCP execution profiles for LLM-operated Gitea workflows

Problem

When LLMs perform workflow actions, audit logs must show which MCP profile and authenticated Gitea user performed each mutation.

Scope

Define and implement audit logging for Gitea MCP mutating actions.

Audit events should include:

  • timestamp
  • repository
  • issue or PR number
  • action type
  • active profile name
  • authenticated username
  • target branch, where applicable
  • PR head SHA, where applicable
  • result: allowed, blocked, failed, succeeded
  • reason for block/failure
  • redacted request metadata

Mutating actions to audit

  • create issue
  • comment issue
  • update issue
  • create PR
  • comment PR
  • approve PR
  • request changes
  • merge PR
  • close/reopen issue
  • label/unlabel issue

Acceptance criteria

  • Mutating actions emit audit records.
  • Audit records include profile and authenticated username.
  • Secrets/tokens are redacted.
  • Blocked actions are logged.
  • Failed eligibility checks are logged.
  • Existing Gitea MCP behavior is not broken.

Non-goals

  • Do not log raw tokens.
  • Do not log authorization headers.
  • Do not add Jenkins/Ops/deploy behavior.

Proposed labels

mcp · gitea · audit · security · mutating

## Parent Roadmap #10 — Task-scoped MCP execution profiles for LLM-operated Gitea workflows ## Problem When LLMs perform workflow actions, audit logs must show which MCP profile and authenticated Gitea user performed each mutation. ## Scope Define and implement audit logging for Gitea MCP mutating actions. Audit events should include: * timestamp * repository * issue or PR number * action type * active profile name * authenticated username * target branch, where applicable * PR head SHA, where applicable * result: allowed, blocked, failed, succeeded * reason for block/failure * redacted request metadata ## Mutating actions to audit * create issue * comment issue * update issue * create PR * comment PR * approve PR * request changes * merge PR * close/reopen issue * label/unlabel issue ## Acceptance criteria * Mutating actions emit audit records. * Audit records include profile and authenticated username. * Secrets/tokens are redacted. * Blocked actions are logged. * Failed eligibility checks are logged. * Existing Gitea MCP behavior is not broken. ## Non-goals * Do not log raw tokens. * Do not log authorization headers. * Do not add Jenkins/Ops/deploy behavior. ## Proposed labels `mcp` · `gitea` · `audit` · `security` · `mutating`
jcwalker3 added the mcpsecuritygiteamutating labels 2026-07-01 11:28:33 -05:00
jcwalker3 added the status:in-progress label 2026-07-01 21:07:43 -05:00
jcwalker3 commented 2026-07-01 21:07:59 -05:00
Author
Owner
Copy Link
Copy Source

Claimed. Starting implementation.

Planned branch: feat/issue-18-audit-log-mutating-actions (from latest master).

Scope: audit logging for Gitea MCP mutating actions per acceptance criteria (timestamp, repo, issue/PR, action, profile, authenticated username, result, redacted metadata). Secrets/tokens redacted; no Jenkins/Ops/deploy behavior.

Claimed. Starting implementation. Planned branch: `feat/issue-18-audit-log-mutating-actions` (from latest `master`). Scope: audit logging for Gitea MCP mutating actions per acceptance criteria (timestamp, repo, issue/PR, action, profile, authenticated username, result, redacted metadata). Secrets/tokens redacted; no Jenkins/Ops/deploy behavior.
sysadmin removed the status:in-progress label 2026-07-02 01:31:14 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
chore
documentation
Docs / runbooks
 gitea
Gitea MCP workflow
 important
mcp
MCP server / tooling
 mutating
Mutating action; requires gating
 nice-to-have
read-only
Read-only, no mutation
 roadmap
Roadmap / umbrella issue
 security
Security / trust boundary
 status:in-progress
Issue is being worked on
No Label gitea mcp mutating security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
jcwalker3 sysadmin
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#18
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?