Supervised Fleet Scan #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # Scheduled/dispatch pipeline for supervised-repo scanning via Hypatia + gitbot-fleet. | |
| name: Supervised Fleet Scan | |
| on: | |
| schedule: | |
| - cron: '0 3 * * 1' | |
| workflow_dispatch: | |
| inputs: | |
| limit: | |
| description: 'Maximum repos to scan (0 = all resolved)' | |
| required: false | |
| default: '0' | |
| inventory_file: | |
| description: 'Optional inventory file path (.git-private-repos or .git-private-farm.scm)' | |
| required: false | |
| default: '' | |
| process_findings: | |
| description: 'Run fleet process-findings after scan' | |
| required: false | |
| type: boolean | |
| default: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| supervised-scan: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout gitbot-fleet | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4 | |
| with: | |
| lfs: true # shared-context/learning/*.jsonl is LFS-tracked (Item 60) | |
| - name: Clone Hypatia scanner | |
| run: | | |
| set -euo pipefail | |
| git clone --depth=1 https://github.com/hyperpolymath/hypatia.git ../hypatia | |
| - name: Run supervised fleet scan | |
| env: | |
| LIMIT: ${{ github.event.inputs.limit || '0' }} | |
| INVENTORY_FILE: ${{ github.event.inputs.inventory_file || '' }} | |
| PROCESS_FINDINGS: ${{ github.event.inputs.process_findings || 'true' }} | |
| FLEET_SUPERVISED_REPOS_FILE: ${{ github.event.inputs.inventory_file || '' }} | |
| # FLEET_SCAN_PAT is required for Hypatia's DependabotAlerts | |
| # rule (DA001-DA004) to query per-repo Dependabot alerts via | |
| # the GitHub REST API. This PAT must have `security_events: read` | |
| # scope on ALL target repos. Without it, cross-repo alerts will | |
| # be MISSING. The built-in GITHUB_TOKEN is insufficient for | |
| # estate-wide scanning. See: | |
| # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md. | |
| GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT }} | |
| # HYPATIA_SEVERITY=low surfaces low-severity findings from | |
| # every rule module. The Hypatia CLI's default threshold is | |
| # "medium"; without this override, low-severity findings | |
| # from any rule (not just DependabotAlerts) are dropped. | |
| HYPATIA_SEVERITY: low | |
| run: | | |
| set -euo pipefail | |
| ARGS=(--limit "$LIMIT") | |
| if [[ -n "$INVENTORY_FILE" ]]; then | |
| ARGS+=(--inventory "$INVENTORY_FILE") | |
| fi | |
| if [[ "$PROCESS_FINDINGS" == "true" ]]; then | |
| ARGS+=(--process) | |
| fi | |
| echo "Running: fleet-coordinator.sh scan-supervised ${ARGS[*]}" | |
| bash fleet-coordinator.sh scan-supervised "${ARGS[@]}" |