coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
activity-core/activity-definitions/weekly-sbom-staleness.md
tegwick 98e8aa83bd
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 47s
Details
Implement ACTIVITY-WP-0021 production automation reliability 
Root-cause IssueSink 503 (dead Forgejo PAT on issue-core), add state-hub
task sink path B, log runs before emit, harden sync_schedules, deterministic
SBOM/triage reports, DB probe thrash fix, and prod automation-status helper.
2026-07-21 04:21:55 +02:00

2.2 KiB
Raw Blame History

id name enabled owner governance status trigger context_sources
weekly-sbom-staleness Weekly SBOM Staleness Check true custodian-agent custodian active
type cron_expression timezone misfire_policy
cron 0 9 * * 1 Europe/Berlin skip
type query params bind_to
state-hub repo_sbom_status
repos
all
context.repos

Weekly SBOM Staleness Check

Runs every Monday at 09:00 Berlin time. Checks all tracked repositories for SBOM staleness and flags any repository whose SBOM is older than 30 days.

ACTIVITY-WP-0021: the fleet no longer treats Forgejo issues as the primary landing zone for automated tasks. The deterministic state-hub-progress instruction report below is the operator-visible evidence path. Task emission via IssueSink remains optional and only fires when ISSUE_SINK_TYPE points at a healthy sink (rest/state-hub); a broken Forgejo backend must not be required for a green weekly completion.

id: weekly-sbom-staleness-report
trusted_fields: []
model: deterministic
temperature: 0
max_tokens: 1
prompt: |
  Deterministic SBOM staleness report from context.repos (no LLM).
output_schema: ""
review_required: false
report_sinks:
  - type: state-hub-progress
    event_type: sbom_staleness
    author: activity-core
    topic_id: cee7bedf-2b48-46ef-8601-006474f2ad7a

Task emission for stale repos is disabled while IssueSink→Forgejo is policy/token broken (ACTIVITY-WP-0021). Re-enable the rule below once ISSUE_SINK_TYPE=rest (or state-hub) is proven healthy again.

id: flag-stale-sbom
for_each: context.repos.repos
bind_as: repo
condition: 'false'
action:
  task_template: Run SBOM rescan for {context.repo.repo_slug}
  target_repo: context.repo.repo_slug
  priority: medium
  labels: ["sbom", "security", "automated"]

The bulk resolver exposes the per-repo entries under context.repos.repos. The deterministic instruction posts sbom_staleness progress with stale repo counts and a sample list for operator review.