Skip to content

Commit bad97b6

Browse files
SecAI-Hubclaude
SecAI-Hub
and
claude
committed
SecAI_OS: initial clean commit
Complete local-first AI appliance with defense-in-depth security. Services: registry, tool-firewall, airlock, quarantine, inference-worker, UI. CI/CD: GitHub Actions with Go build/test, Python pytest, shellcheck, YAML validation. All tests passing (26 Go tests, 23 Python tests). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
0 parents  commit bad97b6

67 files changed

Lines changed: 5962 additions & 0 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @sec_ai

‎.github/dependabot.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"

‎.github/workflows/build.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: bluebuild
2+
on:
3+
schedule:
4+
- cron:
5+
"00 06 * * *"
6+
push:
7+
branches: [main]
8+
paths-ignore:
9+
- "**.md"
10+
pull_request:
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
15+
cancel-in-progress: true
16+
17+
jobs:
18+
bluebuild:
19+
name: Build Custom Image
20+
runs-on: ubuntu-latest
21+
permissions:
22+
contents: read
23+
packages: write
24+
id-token: write
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
recipe:
29+
- recipe.yml
30+
steps:
31+
- name: Build Custom Image
32+
uses: blue-build/github-action@v1.11
33+
with:
34+
recipe: ${{ matrix.recipe }}
35+
cosign_private_key: ${{ secrets.SIGNING_SECRET }}
36+
registry_token: ${{ github.token }}
37+
pr_event_number: ${{ github.event.number }}
38+
maximize_build_space: true

‎.github/workflows/ci.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
paths-ignore:
7+
- "**.md"
8+
pull_request:
9+
paths-ignore:
10+
- "**.md"
11+
workflow_dispatch:
12+
13+
concurrency:
14+
group: ci-${{ github.ref }}
15+
cancel-in-progress: true
16+
17+
# Minimal permissions by default
18+
permissions:
19+
contents: read
20+
21+
jobs:
22+
go-build-and-test:
23+
name: Go Build & Test
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read
27+
strategy:
28+
matrix:
29+
service: [registry, tool-firewall, airlock]
30+
steps:
31+
- uses: actions/checkout@v4
32+
- uses: actions/setup-go@v5
33+
with:
34+
go-version: "1.23"
35+
cache-dependency-path: services/${{ matrix.service }}/go.sum
36+
37+
- name: Build
38+
working-directory: services/${{ matrix.service }}
39+
run: CGO_ENABLED=0 go build -ldflags="-s -w" -o /dev/null .
40+
41+
- name: Test
42+
working-directory: services/${{ matrix.service }}
43+
run: go test -v -race -count=1 ./...
44+
45+
- name: Vet
46+
working-directory: services/${{ matrix.service }}
47+
run: go vet ./...
48+
49+
go-securectl:
50+
name: Build securectl CLI
51+
runs-on: ubuntu-latest
52+
permissions:
53+
contents: read
54+
steps:
55+
- uses: actions/checkout@v4
56+
- uses: actions/setup-go@v5
57+
with:
58+
go-version: "1.23"
59+
cache-dependency-path: services/registry/go.sum
60+
61+
- name: Build securectl
62+
working-directory: services/registry
63+
run: CGO_ENABLED=0 go build -ldflags="-s -w" -o /dev/null ./cmd/securectl/
64+
65+
python-test:
66+
name: Python Test & Lint
67+
runs-on: ubuntu-latest
68+
permissions:
69+
contents: read
70+
steps:
71+
- uses: actions/checkout@v4
72+
- uses: actions/setup-python@v5
73+
with:
74+
python-version: "3.12"
75+
76+
- name: Install dependencies
77+
run: pip install pyyaml flask requests pytest
78+
79+
- name: Lint (syntax check)
80+
run: |
81+
python -m py_compile services/quarantine/quarantine/pipeline.py
82+
python -m py_compile services/quarantine/quarantine/watcher.py
83+
python -m py_compile services/ui/ui/app.py
84+
85+
- name: Test quarantine pipeline
86+
run: python -m pytest tests/test_pipeline.py -v
87+
88+
- name: Test UI app
89+
run: python -m pytest tests/test_ui.py -v
90+
91+
shellcheck:
92+
name: Shell Script Lint
93+
runs-on: ubuntu-latest
94+
permissions:
95+
contents: read
96+
steps:
97+
- uses: actions/checkout@v4
98+
99+
- name: Lint shell scripts
100+
run: |
101+
shellcheck -s bash \
102+
files/system/usr/libexec/secure-ai/firstboot.sh \
103+
files/system/usr/libexec/secure-ai/panic.sh \
104+
files/system/usr/libexec/secure-ai/setup-vault.sh \
105+
files/system/usr/libexec/secure-ai/select-model.sh \
106+
files/scripts/build-services.sh
107+
108+
policy-validate:
109+
name: Validate YAML configs
110+
runs-on: ubuntu-latest
111+
permissions:
112+
contents: read
113+
steps:
114+
- uses: actions/checkout@v4
115+
- uses: actions/setup-python@v5
116+
with:
117+
python-version: "3.12"
118+
119+
- name: Install pyyaml
120+
run: pip install pyyaml
121+
122+
- name: Validate YAML files
123+
run: |
124+
python -c "
125+
import yaml, sys, glob
126+
errors = 0
127+
for pattern in ['files/system/etc/secure-ai/**/*.yaml', 'recipes/*.yml']:
128+
for f in glob.glob(pattern, recursive=True):
129+
try:
130+
with open(f) as fh:
131+
yaml.safe_load(fh)
132+
print(f'OK: {f}')
133+
except Exception as e:
134+
print(f'FAIL: {f}: {e}')
135+
errors += 1
136+
sys.exit(errors)
137+
"

‎.gitignore‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# Signing keys
2+
cosign.key
3+
cosign.private
4+
5+
# BlueBuild generated
6+
/Containerfile
7+
8+
# Go
9+
services/*/vendor/
10+
11+
# Python
12+
__pycache__/
13+
*.pyc
14+
*.egg-info/
15+
dist/
16+
.venv/
17+
18+
# IDE
19+
.idea/
20+
.vscode/
21+
*.swp
22+
23+
# OS
24+
.DS_Store
25+
Thumbs.db

0 commit comments

Comments
 (0)