From 48d31d0081335f6e63d6fcd111e356d6e557854e Mon Sep 17 00:00:00 2001 From: Simon Axelsson Date: Mon, 10 Aug 2026 04:10:47 +0200 Subject: [PATCH 1/2] ci(workflows): split CD/security/nightly under .gitea/workflows + gitignore hygiene (protected-path PR) --- .gitea/workflows/{deploy.yml => cd.yml} | 0 .gitea/workflows/ci.yml | 41 +++++------------------ .gitea/workflows/nightly.yml | 44 +++++++++++++++++++++++++ .gitea/workflows/security.yml | 28 ++++++++++++++++ .gitignore | 16 +++++++++ 5 files changed, 96 insertions(+), 33 deletions(-) rename .gitea/workflows/{deploy.yml => cd.yml} (100%) create mode 100644 .gitea/workflows/nightly.yml create mode 100644 .gitea/workflows/security.yml diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/cd.yml similarity index 100% rename from .gitea/workflows/deploy.yml rename to .gitea/workflows/cd.yml diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 45debd6..7a3af9f 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -1,31 +1,21 @@ name: CI (SIAX Cloud) -# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2), -# following the fleet-wide pattern (quality gate -> advisory security scan). +# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2). +# Quality gate for the Next.js 16 web console + the 0pt capability layer. # -# WHAT THIS REPO SHIPS: a Next.js 16 web console PLUS the 0pt capability layer -# (src/, tests/). Wave 2/3 hardening added a real test runner (vitest), a -# scoped strict type-check (tsconfig.check.json), and a flat ESLint config, so -# the quality gate now runs them: # * typecheck (BLOCKING) -> `tsc -p tsconfig.check.json` over src/ + tests/. -# * test (BLOCKING) -> `vitest run` (the src/ capability + auth + validation suites). -# * lint (ADVISORY, continue-on-error) -> `eslint src tests`. The v0-generated -# legacy adapter/test tree carries pre-existing lint noise -# (explicit-any / require-style imports), so lint is advisory to -# avoid blocking merges on inherited debt; the Wave 2 auth/validation -# additions themselves are lint-clean. Flip to blocking once the -# legacy noise is cleared. -# * build (BLOCKING) -> `next build` compiles the whole app. +# * test (BLOCKING) -> `vitest run`. +# * lint (ADVISORY) -> `eslint src tests` (legacy v0-generated noise +# is inherited debt; continue-on-error so it never blocks). +# * build (BLOCKING) -> `next build`. # -# The security job is intentionally advisory (separate job, `--exit-code 0`) so -# it never blocks merges, matching the fleet convention. +# Nightly re-runs + Trivy security scanning live in nightly.yml and +# security.yml (this file is push/PR-only). on: push: branches: ["**"] pull_request: workflow_dispatch: - schedule: - - cron: "0 4 * * *" # daily safety re-run so CI runs even without a push jobs: quality: @@ -50,18 +40,3 @@ jobs: run: pnpm run lint - name: Build (next build -- blocking quality gate) run: pnpm run build - - security: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - # Install Trivy natively and scan the checked-out workspace directly. - # (The `docker run -v "$PWD:/repo" aquasec/trivy` pattern is a silent no-op - # on this Docker-outside-of-Docker runner -- $PWD inside the job container - # is not a real path on the Docker daemon host, so it scans nothing.) - - name: Install Trivy - run: | - curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin - - name: Trivy scan (vuln + secrets, advisory) - run: | - trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 . diff --git a/.gitea/workflows/nightly.yml b/.gitea/workflows/nightly.yml new file mode 100644 index 0000000..ab56288 --- /dev/null +++ b/.gitea/workflows/nightly.yml @@ -0,0 +1,44 @@ +name: Nightly (SIAX Cloud) + +# Nightly full-gate re-run so CI exercises the repo even without pushes: +# quality gate + advisory security scan. Fails loudly on regressions +# introduced outside push-triggered runs (e.g. dependency drift). +on: + workflow_dispatch: + schedule: + - cron: "0 4 * * *" # daily 04:00 UTC + +jobs: + quality: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-node@v4 + with: + node-version: "22" + - name: Enable corepack + pin pnpm@9 + run: | + corepack enable + corepack prepare pnpm@9 --activate + - name: Install (frozen lockfile) + run: pnpm install --frozen-lockfile + - name: Typecheck (blocking) + run: pnpm run typecheck + - name: Test (blocking) + run: pnpm run test + - name: Lint (advisory) + continue-on-error: true + run: pnpm run lint + - name: Build (blocking) + run: pnpm run build + + security: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Install Trivy + run: | + curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin + - name: Trivy fs scan (vuln + secrets, advisory) + run: | + trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 . diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml new file mode 100644 index 0000000..6ed0429 --- /dev/null +++ b/.gitea/workflows/security.yml @@ -0,0 +1,28 @@ +name: Security Scan (SIAX Cloud) + +# Advisory security scanning on every push/PR + weekly re-run, matching the +# fleet convention (--exit-code 0 so findings never block merges; they are +# triaged via the repo's security channel and BACKLOG). +# +# NOTE: findings on services/scrapers/* (FlareSolverr/Tor/curl_cffi) are +# expected and documented as a deliberate user decision -- see +# docs/compliance/GOLDEN-STANDARD-REPORT.md control C6. +on: + push: + branches: ["**"] + pull_request: + workflow_dispatch: + schedule: + - cron: "0 5 * * 1" # weekly Monday re-scan + +jobs: + security: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Install Trivy + run: | + curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin + - name: Trivy fs scan (vuln + secrets, advisory) + run: | + trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 . diff --git a/.gitignore b/.gitignore index fc6a65c..ff6f695 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,19 @@ next-env.d.ts # interim LocalBlobStore output (src/adapters/local-blob-store.ts) .data/ + +# local blob storage (document artifacts when no object storage configured) +.opt-blobs/ + +# python (engine + scrapers) -- runtime artifacts, never source +__pycache__/ +*.pyc +*.pyo + +# analytics / database files +*.duckdb +*.duckdb.wal + +# local-only environment overrides (all real values live in Infisical) +.env.local +.env.production -- 2.54.0 From 6612ab1233ec51a5d0406fbffeed7a2f25adf952 Mon Sep 17 00:00:00 2001 From: Simon Axelsson Date: Mon, 10 Aug 2026 04:11:52 +0200 Subject: [PATCH 2/2] ci: keep advisory security job in ci.yml so protected-branch status contexts stay reported --- .gitea/workflows/ci.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 7a3af9f..9029ea0 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -40,3 +40,18 @@ jobs: run: pnpm run lint - name: Build (next build -- blocking quality gate) run: pnpm run build + + # Kept in ci.yml (advisory) so the protected-branch status check contexts + # "CI (SIAX Cloud) / quality (push)" + "CI (SIAX Cloud) / security (push)" + # are always reported on push. security.yml is the dedicated scanner on + # push/PR/weekly; this job guarantees the required check exists. + security: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Install Trivy + run: | + curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin + - name: Trivy scan (vuln + secrets, advisory) + run: | + trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 . -- 2.54.0