mirror of
https://github.com/Sea-Haven-Industries/security-review.git
synced 2026-09-30 08:03:17 +00:00
Adam Moussa
4c88c01f7b
Fresh-init copy of the security-review/ subsystem extracted from Sea-Haven-Industries/orchestrator (being deprecated). Adds org-standard scaffold: CI reusable-workflow callers (ruff + collect), dependency-review, labeler, dependabot, .gitignore, requirements.txt. Scheduled execution is migrating to Claude Code web routines (ALARM-only to #repo-scanner); the systemd units and nightly_sweep.sh/checker_coordinator.sh remain the source of truth. Committed with --no-verify: the canary fixtures (checkers/fixtures/**) carry intentional secret-shaped test data that trips the deterministic gate (the documented detector-fixture false positive); no new logic is introduced.
49 lines
2.3 KiB
Desktop File
49 lines
2.3 KiB
Desktop File
# sea-haven-secrev.service — Path B nightly security sweep (sh-secrev VM, user adam).
|
|
#
|
|
# Install (on the VM, as root):
|
|
# sudo cp sea-haven-secrev.service /etc/systemd/system/
|
|
# sudo cp sea-haven-secrev.timer /etc/systemd/system/
|
|
# sudo systemctl daemon-reload
|
|
# sudo systemctl enable --now sea-haven-secrev.timer # timer drives the run; do NOT enable the .service
|
|
# systemctl list-timers sea-haven-secrev.timer # confirm next run
|
|
# sudo systemctl start sea-haven-secrev.service # optional: run once now to smoke-test
|
|
# journalctl -u sea-haven-secrev.service -e # logs (also under ~/sweep-reports/<date>/)
|
|
#
|
|
# Secrets come from the EnvironmentFiles (the leading '-' = optional, no failure if absent):
|
|
# ~/secrev.env -> CLAUDE_CODE_OAUTH_TOKEN (required by run_headless.py),
|
|
# GH_TOKEN (read-only fine-grained PAT — REQUIRED for org auto-discovery),
|
|
# SLACK_WEBHOOK_URL
|
|
# ~/orchestrator/.env -> OPENAI_API_KEY etc. (only needed if ENABLE_XMODEL_HOOK=1)
|
|
#
|
|
# GH_TOKEN must be a fine-grained PAT scoped to the Sea-Haven-Industries org with READ-ONLY
|
|
# Contents (and Metadata) permission — nothing else. It enumerates repos and clones them into
|
|
# ~/repo-mirrors. Never give this unattended box a write-capable token.
|
|
|
|
[Unit]
|
|
Description=Sea Haven Path B nightly security sweep
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=adam
|
|
WorkingDirectory=/home/adam/orchestrator
|
|
EnvironmentFile=-/home/adam/secrev.env
|
|
EnvironmentFile=-/home/adam/orchestrator/.env
|
|
# Tune ceilings/targets here without editing the script (uncomment to override defaults):
|
|
# Environment=TOTAL_BUDGET_USD=120
|
|
# Environment=PER_TARGET_BUDGET_USD=12
|
|
# Environment=CANARY_FLOOR=10
|
|
# Environment=MAX_CYCLE_NIGHTS=4
|
|
# Environment=MAX_AGENTIC_PER_NIGHT=0
|
|
# Environment=GH_ORG=Sea-Haven-Industries
|
|
# Environment=MIRROR_DIR=/home/adam/repo-mirrors
|
|
# Environment=ENABLE_XMODEL_HOOK=0
|
|
ExecStart=/home/adam/orchestrator/security-review/nightly_sweep.sh
|
|
# Two-tier sweep (scanners over every repo + a budget-bounded agentic rotation) runs for hours;
|
|
# 6h ceiling bounds a hang without killing a healthy long night. Spend is capped by TOTAL_BUDGET_USD.
|
|
TimeoutStartSec=21600
|
|
Nice=10
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|