6d713aeeb9
Some checks failed
PR Checklist / pr-checklist (pull_request) Failing after 1m18s
Golden state: Kimi K2.5 primary → Gemini via OpenRouter → local Ollama. Anthropic is gone from every active config, fallback chain, and loop script. Wizard configs (3): - allegro, bezalel, ezra: removed anthropic from fallback_providers, replaced with gemini + ollama. Removed anthropic provider section. Playbooks (7): - All playbooks now use kimi-k2.5 as preferred, google/gemini-2.5-pro as fallback. No claude model references remain. Fleet scripts (8): - claude-loop.sh: deprecated (exit 0, original preserved as reference) - claudemax-watchdog.sh: deprecated (exit 0) - agent-loop.sh: removed claude dispatch case - start-loops.sh: removed claude-locks, claude-loop from proc list - timmy-orchestrator.sh: removed claude worker monitoring - fleet-status.sh: zeroed claude loop counter - model-health-check.sh: replaced check_anthropic_model with check_kimi_model - ops-gitea.sh, ops-helpers.sh, ops-panel.sh: removed claude from agent lists Infrastructure (5): - wizard_bootstrap.py: removed anthropic pip package and API key checks - WIZARD_ENVIRONMENT_CONTRACT.md: replaced ANTHROPIC keys with KIMI - DEPLOY.md: replaced ANTHROPIC_API_KEY with KIMI_API_KEY - fallback-portfolios.yaml: replaced anthropic provider with kimi-coding - fleet-vocabulary.md: updated Ezra and Claude entries to Kimi K2.5 Docs (2): - sonnet-workforce.md: deprecated with notice - GoldenRockachopa-checkin.md: updated model references Preserved (not touched): - training/ data (changing would corrupt training set) - evaluations/ (historical benchmarks) - RELEASE_*.md (changelogs) - metrics_helpers.py (historical cost calculation) - hermes-sovereign/githooks/pre-commit.py (secret detection - still useful) - security/secret-scan.yml (key detection - still useful) - architecture_linter.py (warns about anthropic usage - desired behavior) - test_sovereignty_enforcement.py (tests anthropic is blocked - correct) - son-of-timmy.md philosophical references (Claude as one of many backends) Refs: Sovereignty directive, zero-cloud vision
39 lines
1.8 KiB
YAML
39 lines
1.8 KiB
YAML
name: security-auditor
|
|
description: 'Scans code for security vulnerabilities, hardcoded secrets, dependency issues. Files findings as Gitea issues.
|
|
|
|
'
|
|
model:
|
|
preferred: kimi-k2.5
|
|
fallback: kimi-k2.5
|
|
max_turns: 40
|
|
temperature: 0.2
|
|
tools:
|
|
- terminal
|
|
- file
|
|
- search_files
|
|
trigger:
|
|
schedule: weekly
|
|
pr_merged_with_lines: 100
|
|
manual: true
|
|
repos:
|
|
- Timmy_Foundation/the-nexus
|
|
- Timmy_Foundation/timmy-home
|
|
- Timmy_Foundation/timmy-config
|
|
- Timmy_Foundation/hermes-agent
|
|
steps:
|
|
- clone_repo
|
|
- run_audit
|
|
- file_issues
|
|
output: gitea_issue
|
|
timeout_minutes: 20
|
|
system_prompt: "You are a security auditor for the Timmy Foundation codebase.\nYour job is to FIND vulnerabilities, not write\
|
|
\ code.\n\nTARGET REPO: {{repo}}\n\nSCAN FOR:\n1. Hardcoded secrets, API keys, tokens in source code\n2. SQL injection vulnerabilities\n\
|
|
3. Command injection via unsanitized input\n4. Path traversal in file operations\n5. Insecure HTTP calls (should be HTTPS\
|
|
\ where possible)\n6. Dependencies with known CVEs (check requirements.txt/package.json)\n7. Missing input validation\n\
|
|
8. Overly permissive file permissions\n9. Privilege drift in deploy, orchestration, memory, cron, and playbook surfaces\n\
|
|
10. Places where private data or local-only artifacts could leak into tracked repos\n\nOUTPUT FORMAT:\nFor each finding,\
|
|
\ file a Gitea issue with:\n Title: [security] <severity>: <description>\n Body: file + line, description, why it matters,\
|
|
\ recommended fix\n Label: security\n\nSEVERITY: critical / high / medium / low\nOnly file issues for real findings. No\
|
|
\ false positives.\nDo not open duplicate issues for already-known findings; link the existing issue instead.\nIf a finding\
|
|
\ affects sovereignty boundaries or private-data handling, flag it clearly as such.\n"
|