coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
activity-core/activity-definitions/weekly-sbom-staleness.md
tegwick 4f5399df84
All checks were successful
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Build and Publish Container Image / build-and-push (push) Successful in 28s
Details
Implement ACTIVITY-WP-0022/0023: safe sink default and gap closures 
Default ISSUE_SINK_TYPE to state-hub (no silent Forgejo issues), hard-fail
prune apply without live-images protection, refresh-live-images script,
disable TaskExecutor stub by default, and document consumer/sink contracts.
2026-07-21 21:40:08 +02:00

2.3 KiB
Raw Blame History

id name enabled owner governance status trigger context_sources
weekly-sbom-staleness Weekly SBOM Staleness Check true custodian-agent custodian active
type cron_expression timezone misfire_policy
cron 0 9 * * 1 Europe/Berlin skip
type query params bind_to
state-hub repo_sbom_status
repos
all
context.repos

Weekly SBOM Staleness Check

Runs every Monday at 09:00 Berlin time. Checks all tracked repositories for SBOM staleness and flags any repository whose SBOM is older than 30 days.

ACTIVITY-WP-0021: the fleet no longer treats Forgejo issues as the primary landing zone for automated tasks. The deterministic state-hub-progress instruction report below is the operator-visible evidence path. Task emission via IssueSink remains optional and only fires when ISSUE_SINK_TYPE points at a healthy sink (rest/state-hub); a broken Forgejo backend must not be required for a green weekly completion.

id: weekly-sbom-staleness-report
trusted_fields: []
model: deterministic
temperature: 0
max_tokens: 1
prompt: |
  Deterministic SBOM staleness report from context.repos (no LLM).
output_schema: ""
review_required: false
report_sinks:
  - type: state-hub-progress
    event_type: sbom_staleness
    author: activity-core
    topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a

Task emission uses the fleet default sink (ISSUE_SINK_TYPE=state-hub — ACTIVITY-WP-0022): stale repos spawn activity_task_spawn progress events, not Forgejo issues. The deterministic instruction always posts a sbom_staleness summary for operators.

id: flag-stale-sbom
for_each: context.repos.repos
bind_as: repo
condition: 'context.repo.sbom_age_days > 30'
action:
  task_template: Run SBOM rescan for {context.repo.repo_slug}
  target_repo: context.repo.repo_slug
  priority: medium
  labels: ["sbom", "security", "automated"]

The bulk resolver exposes the per-repo entries under context.repos.repos. The deterministic instruction posts sbom_staleness progress with stale repo counts and a sample list for operator review.