Adam Moussa
537e83975b
Replace the opt-in sweep-targets allowlist with zero-wiring discovery: enumerate org repos via the GitHub REST API (curl + read-only GH_TOKEN, no gh dependency) and mirror each as a shallow clean clone (git clone --depth=1, default branch from the API) into ~/repo-mirrors. Scanning server-side clones keeps local .env secrets out of scope. Tier 1 runs deterministic scanners over every repo nightly ($0 Claude); tier 2 runs the agentic pass over a budget-bounded round-robin rotation with a persistent cycle pointer, so the draw on the shared Max limits stays bounded and coverage never goes silently incomplete (COVERAGE ALARM if the rotation falls behind). Skip = committed marker or central list (marker-skips logged). Redact secrets from Slack; reports mode 600. Raise the systemd timeout to 6h for the longer two-tier run.
15 lines
849 B
Text
15 lines
849 B
Text
# sweep-targets.txt — one repo path per line for the nightly Path B sweep.
|
|
# Lines starting with '#' and blank lines are ignored. ~ is expanded.
|
|
# Override at runtime with the TARGETS env var (space-separated paths).
|
|
#
|
|
# NOTE: the testbed canary corpus is ALWAYS scanned by nightly_sweep.sh as the
|
|
# anti-complacency check; do NOT list it here (it is handled separately).
|
|
#
|
|
# TODO (Phase 5): add the first real hardened repo here once it is cloned on the
|
|
# VM (candidates: payments-dashboard / proposal-system / procurement-ingest).
|
|
#
|
|
# Deliberately EMPTY by default = canary-only nights. Do NOT scan ~/orchestrator:
|
|
# it holds ~/orchestrator/.env with live provider API keys, which the agentic
|
|
# detector could surface into sweep reports / Slack. Only add repos with no
|
|
# plaintext secrets (or scrub/exclude secret files first).
|
|
# ~/orchestrator
|