supervised-fleet-scan.yml

# SPDX-License-Identifier: MPL-2.0
# Scheduled/dispatch pipeline for supervised-repo scanning via Hypatia + gitbot-fleet.
name: Supervised Fleet Scan

on:
  schedule:
    - cron: '0 3 * * 1'
  workflow_dispatch:
    inputs:
      limit:
        description: 'Maximum repos to scan (0 = all resolved)'
        required: false
        default: '0'
      inventory_file:
        description: 'Optional inventory file path (.git-private-repos or .git-private-farm.scm)'
        required: false
        default: ''
      process_findings:
        description: 'Run fleet process-findings after scan'
        required: false
        type: boolean
        default: true

permissions:
  contents: read

jobs:
  supervised-scan:
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - name: Checkout gitbot-fleet
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
        with:
          lfs: true  # shared-context/learning/*.jsonl is LFS-tracked (Item 60)

      - name: Clone Hypatia scanner
        run: |
          set -euo pipefail
          git clone --depth=1 https://github.com/hyperpolymath/hypatia.git ../hypatia

      - name: Run supervised fleet scan
        env:
          LIMIT: ${{ github.event.inputs.limit || '0' }}
          INVENTORY_FILE: ${{ github.event.inputs.inventory_file || '' }}
          PROCESS_FINDINGS: ${{ github.event.inputs.process_findings || 'true' }}
          FLEET_SUPERVISED_REPOS_FILE: ${{ github.event.inputs.inventory_file || '' }}
          # FLEET_SCAN_PAT is required for Hypatia's DependabotAlerts
          # rule (DA001-DA004) to query per-repo Dependabot alerts via
          # the GitHub REST API. This PAT must have `security_events: read`
          # scope on ALL target repos. Without it, cross-repo alerts will
          # be MISSING. The built-in GITHUB_TOKEN is insufficient for
          # estate-wide scanning. See:
          # 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
          GITHUB_TOKEN: ${{ secrets.FLEET_SCAN_PAT }}
          # HYPATIA_SEVERITY=low surfaces low-severity findings from
          # every rule module. The Hypatia CLI's default threshold is
          # "medium"; without this override, low-severity findings
          # from any rule (not just DependabotAlerts) are dropped.
          HYPATIA_SEVERITY: low
        run: |
          set -euo pipefail
          ARGS=(--limit "$LIMIT")
          if [[ -n "$INVENTORY_FILE" ]]; then
            ARGS+=(--inventory "$INVENTORY_FILE")
          fi
          if [[ "$PROCESS_FINDINGS" == "true" ]]; then
            ARGS+=(--process)
          fi

          echo "Running: fleet-coordinator.sh scan-supervised ${ARGS[*]}"
          bash fleet-coordinator.sh scan-supervised "${ARGS[@]}"