coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement ACTIVITY-WP-0021 production automation reliability
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 47s
Details

Browse source 
Root-cause IssueSink 503 (dead Forgejo PAT on issue-core), add state-hub
task sink path B, log runs before emit, harden sync_schedules, deterministic
SBOM/triage reports, DB probe thrash fix, and prod automation-status helper.
This commit is contained in:
tegwick 2026-07-21 04:21:55 +02:00
parent 1209ff6973
commit 98e8aa83bd
15 changed files with 638 additions and 63 deletions
Download patch file Download diff file Expand all files Collapse all files

35
activity-definitions/weekly-sbom-staleness.md
View file

@ -26,11 +26,39 @@ context_sources:
Runs every Monday at 09:00 Berlin time. Checks all tracked repositories for
SBOM staleness and flags any repository whose SBOM is older than 30 days.
ACTIVITY-WP-0021: the fleet no longer treats Forgejo issues as the primary
landing zone for automated tasks. The deterministic **state-hub-progress**
instruction report below is the operator-visible evidence path. Task emission
via IssueSink remains optional and only fires when `ISSUE_SINK_TYPE` points at
a healthy sink (rest/state-hub); a broken Forgejo backend must not be required
for a green weekly completion.
```instruction
id: weekly-sbom-staleness-report
trusted_fields: []
model: deterministic
temperature: 0
max_tokens: 1
prompt: |
Deterministic SBOM staleness report from context.repos (no LLM).
output_schema: ""
review_required: false
report_sinks:
- type: state-hub-progress
event_type: sbom_staleness
author: activity-core
topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a
```
Task emission for stale repos is **disabled** while IssueSink→Forgejo is
policy/token broken (ACTIVITY-WP-0021). Re-enable the rule below once
`ISSUE_SINK_TYPE=rest` (or `state-hub`) is proven healthy again.
```rule
id: flag-stale-sbom
for_each: context.repos.repos
bind_as: repo
condition: 'context.repo.sbom_age_days > 30'
condition: 'false'
action:
task_template: Run SBOM rescan for {context.repo.repo_slug}
target_repo: context.repo.repo_slug
@ -39,6 +67,5 @@ action:
```
The bulk resolver exposes the per-repo entries under `context.repos.repos`.
The rule uses explicit `for_each` binding so the workflow evaluates the
condition once per repository and emits one task per stale repo. Action fields
may reference the bound item with `context.repo.*`.
The deterministic instruction posts `sbom_staleness` progress with stale repo
counts and a sample list for operator review.