adam/orchestrator
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finalize security-review: repo-sourced hooks, two-tier nightly auto-discovery #6

Merged
amoussa1229 merged 16 commits from feature/security-review-two-tier-auto-discovery into main 2026-06-17 19:03:16 +00:00
Conversation 0 Commits 16 Files changed 18 +4 -2
1 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 6d65c54b58 - Show all commits

6
security-review/nightly_sweep.sh
View file

@ -136,7 +136,8 @@ discover_repos() {
# failed fetch cannot leave GH_TOKEN at rest on disk. (Residual: the token is briefly visible
# in process args to a local `ps`; acceptable on this single-user unattended box.)
mirror_repo() { # name clone_url default_branch -> 0 ok / 1 fail
local name="$1" url="$2" branch="$3" dir="$MIRROR_DIR/$name"
local name="$1" url="$2" branch="$3"
local dir="$MIRROR_DIR/$name"
local auth_url="https://x-access-token:${GH_TOKEN}@${url#https://}"
if [ -d "$dir/.git" ]; then
git -C "$dir" fetch --depth=1 "$auth_url" "$branch" >/dev/null 2>&1 || return 1
@ -188,7 +189,8 @@ xmodel_check_criticals() {
# Sets T1_BLOCK/T1_CRIT/T1_HIGH. review.sh exit 0 pass / 1 BLOCK / 2 setup.
T1_BLOCK=0; T1_CRIT=0; T1_HIGH=0
scan_scanners() { # target slug
local target="$1" slug="$2" result_json="$REPORT_DIR/${slug}.scanners.json"
local target="$1" slug="$2"
local result_json="$REPORT_DIR/${slug}.scanners.json"
T1_BLOCK=0; T1_CRIT=0; T1_HIGH=0
local sup=()
[ -f "$target/.security-review/suppressions.json" ] && sup=(--suppressions "$target/.security-review/suppressions.json")