.gitea/workflows/ci.yml

@@ -1,31 +1,21 @@
 name: CI (SIAX Cloud)
 
-# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2),
-# following the fleet-wide pattern (quality gate -> advisory security scan).
+# Self-hosted CI on SIAX Cloud (Gitea Actions, runners siax-runner-1/2).
+# Quality gate for the Next.js 16 web console + the 0pt capability layer.
 #
-# WHAT THIS REPO SHIPS: a Next.js 16 web console PLUS the 0pt capability layer
-# (src/, tests/). Wave 2/3 hardening added a real test runner (vitest), a
-# scoped strict type-check (tsconfig.check.json), and a flat ESLint config, so
-# the quality gate now runs them:
 #   * typecheck (BLOCKING) -> `tsc -p tsconfig.check.json` over src/ + tests/.
-#   * test      (BLOCKING) -> `vitest run` (the src/ capability + auth + validation suites).
-#   * lint      (ADVISORY, continue-on-error) -> `eslint src tests`. The v0-generated
-#                 legacy adapter/test tree carries pre-existing lint noise
-#                 (explicit-any / require-style imports), so lint is advisory to
-#                 avoid blocking merges on inherited debt; the Wave 2 auth/validation
-#                 additions themselves are lint-clean. Flip to blocking once the
-#                 legacy noise is cleared.
-#   * build     (BLOCKING) -> `next build` compiles the whole app.
+#   * test      (BLOCKING) -> `vitest run`.
+#   * lint      (ADVISORY) -> `eslint src tests` (legacy v0-generated noise
+#                 is inherited debt; continue-on-error so it never blocks).
+#   * build     (BLOCKING) -> `next build`.
 #
-# The security job is intentionally advisory (separate job, `--exit-code 0`) so
-# it never blocks merges, matching the fleet convention.
+# Nightly re-runs + Trivy security scanning live in nightly.yml and
+# security.yml (this file is push/PR-only).
 on:
   push:
     branches: ["**"]
   pull_request:
   workflow_dispatch:
-  schedule:
-    - cron: "0 4 * * *"   # daily safety re-run so CI runs even without a push
 
 jobs:
   quality:
@@ -51,14 +41,14 @@ jobs:
       - name: Build (next build -- blocking quality gate)
         run: pnpm run build
 
+  # Kept in ci.yml (advisory) so the protected-branch status check contexts
+  # "CI (SIAX Cloud) / quality (push)" + "CI (SIAX Cloud) / security (push)"
+  # are always reported on push. security.yml is the dedicated scanner on
+  # push/PR/weekly; this job guarantees the required check exists.
   security:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      # Install Trivy natively and scan the checked-out workspace directly.
-      # (The `docker run -v "$PWD:/repo" aquasec/trivy` pattern is a silent no-op
-      # on this Docker-outside-of-Docker runner -- $PWD inside the job container
-      # is not a real path on the Docker daemon host, so it scans nothing.)
       - name: Install Trivy
         run: |
           curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

.gitea/workflows/nightly.yml

@@ -0,0 +1,44 @@
+name: Nightly (SIAX Cloud)
+
+# Nightly full-gate re-run so CI exercises the repo even without pushes:
+# quality gate + advisory security scan. Fails loudly on regressions
+# introduced outside push-triggered runs (e.g. dependency drift).
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 4 * * *"   # daily 04:00 UTC
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Enable corepack + pin pnpm@9
+        run: |
+          corepack enable
+          corepack prepare pnpm@9 --activate
+      - name: Install (frozen lockfile)
+        run: pnpm install --frozen-lockfile
+      - name: Typecheck (blocking)
+        run: pnpm run typecheck
+      - name: Test (blocking)
+        run: pnpm run test
+      - name: Lint (advisory)
+        continue-on-error: true
+        run: pnpm run lint
+      - name: Build (blocking)
+        run: pnpm run build
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+      - name: Trivy fs scan (vuln + secrets, advisory)
+        run: |
+          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 .

.gitea/workflows/security.yml

@@ -0,0 +1,28 @@
+name: Security Scan (SIAX Cloud)
+
+# Advisory security scanning on every push/PR + weekly re-run, matching the
+# fleet convention (--exit-code 0 so findings never block merges; they are
+# triaged via the repo's security channel and BACKLOG).
+#
+# NOTE: findings on services/scrapers/* (FlareSolverr/Tor/curl_cffi) are
+# expected and documented as a deliberate user decision -- see
+# docs/compliance/GOLDEN-STANDARD-REPORT.md control C6.
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 5 * * 1"   # weekly Monday re-scan
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+      - name: Trivy fs scan (vuln + secrets, advisory)
+        run: |
+          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL --exit-code 0 .

.gitignore

@@ -31,3 +31,19 @@ next-env.d.ts
 
 # interim LocalBlobStore output (src/adapters/local-blob-store.ts)
 .data/
+
+# local blob storage (document artifacts when no object storage configured)
+.opt-blobs/
+
+# python (engine + scrapers) -- runtime artifacts, never source
+__pycache__/
+*.pyc
+*.pyo
+
+# analytics / database files
+*.duckdb
+*.duckdb.wal
+
+# local-only environment overrides (all real values live in Infisical)
+.env.local
+.env.production