Adam Moussa
537e83975b
Replace the opt-in sweep-targets allowlist with zero-wiring discovery: enumerate org repos via the GitHub REST API (curl + read-only GH_TOKEN, no gh dependency) and mirror each as a shallow clean clone (git clone --depth=1, default branch from the API) into ~/repo-mirrors. Scanning server-side clones keeps local .env secrets out of scope. Tier 1 runs deterministic scanners over every repo nightly ($0 Claude); tier 2 runs the agentic pass over a budget-bounded round-robin rotation with a persistent cycle pointer, so the draw on the shared Max limits stays bounded and coverage never goes silently incomplete (COVERAGE ALARM if the rotation falls behind). Skip = committed marker or central list (marker-skips logged). Redact secrets from Slack; reports mode 600. Raise the systemd timeout to 6h for the longer two-tier run.
20 lines
609 B
SYSTEMD
20 lines
609 B
SYSTEMD
# sea-haven-secrev.timer — fires the nightly sweep at ~02:00 local, user adam.
|
|
#
|
|
# Install: see the header of sea-haven-secrev.service. In short:
|
|
# sudo systemctl enable --now sea-haven-secrev.timer
|
|
# systemctl list-timers sea-haven-secrev.timer
|
|
#
|
|
# Persistent=true → if the VM was off at 02:00, the sweep runs at next boot.
|
|
# RandomizedDelaySec spreads load off an exact-minute spike.
|
|
|
|
[Unit]
|
|
Description=Run the Sea Haven Path B security sweep nightly (~02:00)
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 02:00:00
|
|
Persistent=true
|
|
RandomizedDelaySec=600
|
|
Unit=sea-haven-secrev.service
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|