Files
docker-infrastructure/falco
poprhythm a44f35e758 falco: fix git-hook-tamper false-positiving on every gitea push
The rule checked proc.name against gitea's managed hook names, but git's
hook dispatcher always execs these as `bash ./hooks/<hookname>.d/gitea` -
proc.name is "bash" (the interpreter), never the hook name. That check
could never match, so this fired CRITICAL 3x (pre-receive/update/
post-receive) on every single push since it was added - including two
notifications the user got moments ago from this repo's own commits.

Fixed to check the actual invoked script path in proc.cmdline instead.
This commit's own push is the live verification.
2026-08-16 15:41:05 +00:00
..