mirror of
https://github.com/Sea-Haven-Industries/security-review.git
synced 2026-09-30 10:23:14 +00:00
58aa07d8be
* feat: add router-less cross-family reviewer CLI (cross_review.py)
Re-homes the archived orchestrator repo's GPT-4.1 cross_reviewer as a
direct OpenAI SDK CLI: verbatim system prompt, same model id, ported
3-attempt exponential-backoff retry. Reads OPENAI_API_KEY from the
environment or the gitignored repo-root .env. Lazy openai import so
--help works without the package.
* feat: create machine-level suppressions dir on --global hook install
install-hooks.sh --global now mkdir -p's
${SH_SECURITY_SUPPRESSIONS_DIR:-~/.config/sea-haven/security-review} and
states the convention: machine-level <dir>/<repo-basename>/suppressions.json
is preferred over repo-local .security-review/suppressions.json, with
review.sh merging both when run without --suppressions.
* docs: describe sh-build-review as cross-family GPT-4.1 pass via cross_review.py
* chore: retire Path B VM host artifacts, repoint xmodel hook to cross_review.py
- delete systemd/ units and DEPLOY-R720.md (VM destroyed; recoverable
from git history)
- nightly_sweep.sh: retained for reference — header notes the VM-based
Path B sweep is retired; ENABLE_XMODEL_HOOK now calls this repo's
cross_review.py instead of the archived orchestrator's run.py
- sweep-targets.txt: drop the stale ~/orchestrator warning block
- README: document the Claude Code web cloud routines
(repo-scanner-nightly-sweep 08:00 ET, repo-checkers-plane1 07:30 ET,
ALARM-only to #repo-scanner) and add the cross_review.py section
* docs(iam): repoint cross-family review invocations to cross_review.py
* fix(ci): exclude canary corpus from ruff, add import smoke test
CI has been red repo-wide: the latest ruff wants to reformat the
intentionally-vulnerable canary fixtures (whose line numbers are keyed
in canary-meta/KEY.md), and pytest --collect-only exits 5 with zero
tests. Exclude canary/ via ruff.toml and add a root-level import smoke
test so collection is non-empty and imports cross_review.py.
23 lines
1.7 KiB
Text
23 lines
1.7 KiB
Text
# sweep-targets.txt — one repo path per line for the nightly Path B sweep.
|
|
# Lines starting with '#' and blank lines are ignored. ~ is expanded.
|
|
# Override at runtime with the TARGETS env var (space-separated paths).
|
|
#
|
|
# ┌─ SECURITY — TRUSTED REPOS ONLY (accepted-risk condition, 2026-07-13) ─────────┐
|
|
# │ review.sh auto-loads each scanned repo's GIT-TRACKED │
|
|
# │ .security-review/suppressions.json. A contributor who can land a commit can │
|
|
# │ therefore suppress a real finding (ship the vuln + its own suppression) and │
|
|
# │ make the automated run PASS — /sh-security-review confirmed this as HIGH and │
|
|
# │ it was ACCEPTED only on the condition that this list (and any target list the │
|
|
# │ Open SWE daily-report automation uses) contains ONLY trusted repos. Do NOT │
|
|
# │ add a repo that merges untrusted contributions without human review. The same │
|
|
# │ rule applies to the Open SWE daily automation's target set — keep it in sync. │
|
|
# └───────────────────────────────────────────────────────────────────────────────┘
|
|
#
|
|
# NOTE: the testbed canary corpus is ALWAYS scanned by nightly_sweep.sh as the
|
|
# anti-complacency check; do NOT list it here (it is handled separately).
|
|
#
|
|
# TODO (Phase 5): add the first real hardened repo here once it is cloned on the
|
|
# VM (candidates: payments-dashboard / proposal-system / procurement-ingest).
|
|
#
|
|
# Deliberately EMPTY by default = canary-only nights. Only add repos with no
|
|
# plaintext secrets (or scrub/exclude secret files first).
|