panicbot-sweep.yml

# SPDX-License-Identifier: MPL-2.0
# Panicbot Sweep — weekly batch scan of all repos via panic-attack.
#
# Catches drift in dormant repos that don't get per-PR scans.
# Active repos are already scanned on every push via hypatia-scan.yml.

name: Panicbot Sweep

on:
  schedule:
    # Sunday 04:00 UTC — weekly sweep of all repos
    - cron: '0 4 * * 0'
  workflow_dispatch:
    inputs:
      scope:
        description: 'Scan scope (all, or a specific repo name)'
        required: false
        default: 'all'
        type: string
      mode:
        description: 'Bot operating mode'
        required: false
        default: 'advisor'
        type: choice
        options:
          - advisor
          - auditor
          - guardian

permissions:
  contents: read

jobs:
  sweep:
    name: Panicbot Sweep Scan
    runs-on: ubuntu-latest
    timeout-minutes: 120

    steps:
      - name: Checkout gitbot-fleet
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable
        with:
          toolchain: stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
        with:
          workspaces: |
            bots/panicbot -> target
            shared-context -> target

      - name: Build panicbot
        run: |
          cd bots/panicbot
          cargo build --release

      - name: Install panic-attack
        run: |
          if ! command -v panic-attack &>/dev/null; then
            echo "::warning::panic-attack not found, attempting cargo install"
            cargo install --git https://github.com/hyperpolymath/panic-attacker.git || echo "::error::Failed to install panic-attack"
          fi

      - name: Run sweep
        env:
          PANICBOT_MODE: ${{ inputs.mode || 'advisor' }}
          PANICBOT_SCOPE: ${{ inputs.scope || 'all' }}
        run: |
          set -euo pipefail

          PANICBOT="./bots/panicbot/target/release/panicbot"
          FINDINGS_DIR="shared-context/findings"
          SESSION_ID="$(date +%Y%m%d-%H%M%S)"

          mkdir -p "$FINDINGS_DIR"

          echo "::group::Panicbot Sweep ($PANICBOT_SCOPE)"
          echo "Mode: $PANICBOT_MODE"
          echo "Session: $SESSION_ID"

          if [[ "$PANICBOT_SCOPE" == "all" ]]; then
            # Scan the repos we have access to (gitbot-fleet itself + test fixtures)
            echo "Scanning gitbot-fleet repository..."
            $PANICBOT fleet . --mode "$PANICBOT_MODE" --format json \
              > "$FINDINGS_DIR/gitbot-fleet-${SESSION_ID}.json" 2>&1 || true
          else
            # Scan a specific repo
            echo "Scanning $PANICBOT_SCOPE..."
            $PANICBOT fleet "$PANICBOT_SCOPE" --mode "$PANICBOT_MODE" --format json \
              > "$FINDINGS_DIR/${PANICBOT_SCOPE}-${SESSION_ID}.json" 2>&1 || true
          fi

          echo "::endgroup::"

      - name: Process findings
        if: always()
        run: |
          FINDINGS_DIR="shared-context/findings"
          TOTAL=$(find "$FINDINGS_DIR" -name "*.json" -newer "$FINDINGS_DIR" 2>/dev/null | wc -l)

          echo "## Panicbot Sweep Results" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Findings files**: $TOTAL" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Mode**: ${{ inputs.mode || 'advisor' }}" >> "$GITHUB_STEP_SUMMARY"
          echo "- **Scope**: ${{ inputs.scope || 'all' }}" >> "$GITHUB_STEP_SUMMARY"

      # upload-artifact rejects ':' in paths; a single legacy colon-named file
      # failed the whole sweep for 3 consecutive weeks. The writer
      # (scripts/submit-finding.sh) already emits colon-free names — this guard
      # fails LOUDLY (naming the offender) if any regressed writer reintroduces
      # one, instead of the upload step failing cryptically.
      - name: Guard — no artifact-illegal filenames
        if: always()
        run: |
          BAD=$(find shared-context/findings -name '*:*' -print)
          if [ -n "$BAD" ]; then
            echo "::error::Colon-named findings file(s) break artifact upload — fix the writer, then rename:"
            echo "$BAD"
            exit 1
          fi

      - name: Upload findings artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: panicbot-sweep-findings
          path: shared-context/findings/
          retention-days: 90
          if-no-files-found: ignore