@bugb-technologies/bravos 0.0.0-stage → 1.0.0

package/templates/workflows/bravos-nightly-codex.yml

@@ -0,0 +1,172 @@
+# bravos:generated — written by `bravos init --ci`; `bravos sync --ci` refreshes it while this line stays.
+# The nightly "bulk bee": Codex covers the next slice of unannotated files with the
+# bravos-annotate skill, the lint gate checks what it wrote, and the job opens one small PR.
+# Optionally it then replays the committed retest kits against the target the reviewed
+# .guardlink/scope.yaml authorizes (see the "Authorized scan (gated)" step); without that scope
+# file's human-written attestation the scan step skips and the job annotates only.
+# The nightly is on the Team plan: add the repo secret BRAVOS_LICENCE (the token from
+# account.bugb.io/dashboard/license) so the agent's paid skills run; without it they say so and stop.
+# Needs the repo secret OPENAI_API_KEY, and Settings > Actions > General > "Allow GitHub
+# Actions to create and approve pull requests". Pin the actions to commit SHAs if your
+# organisation requires it.
+name: bravos nightly (Codex)
+
+on:
+  schedule:
+    - cron: '17 3 * * 1-5'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: bravos-nightly
+  cancel-in-progress: false
+
+jobs:
+  annotate:
+    runs-on: ubuntu-latest
+    env:
+      BRAVOS_LICENCE: ${{ secrets.BRAVOS_LICENCE }}
+    timeout-minutes: 60
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install guardlink
+        run: npm install -g guardlink
+
+      - name: Starting point
+        id: start
+        run: |
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+          guardlink ci -f json > "$RUNNER_TEMP/ci-before.json" || true
+          echo "coverage=$(jq -r '.summary.coverage.percent // "unknown"' "$RUNNER_TEMP/ci-before.json")" >> "$GITHUB_OUTPUT"
+
+      - name: Annotate the next slice
+        uses: openai/codex-action@v1
+        with:
+          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
+          permission-profile: ":workspace"
+          safety-strategy: drop-sudo
+          prompt: |
+            Follow .agents/skills/bravos-annotate/SKILL.md in slice mode (the default) to cover the
+            next unannotated files that `guardlink unannotated --json` lists. You are the agent: do
+            the work in this session and never run guardlink annotate with an agent flag. Stop when
+            `guardlink lint . --since ${{ steps.start.outputs.sha }} --json` reports 0 errors and
+            `guardlink validate .` passes. Leave the changes uncommitted; a later step commits them
+            and opens the pull request.
+
+      - name: Gate what the agent wrote
+        env:
+          START: ${{ steps.start.outputs.sha }}
+        run: |
+          guardlink validate .
+          guardlink lint . --since "$START" --json > "$RUNNER_TEMP/lint.json" || true
+          errors=$(jq -r '.summary.errors' "$RUNNER_TEMP/lint.json")
+          if [ "$errors" != "0" ]; then
+            echo "::error::guardlink lint reports $errors error(s) in what the agent wrote"
+            jq . "$RUNNER_TEMP/lint.json"
+            exit 1
+          fi
+
+      # Opt-in: replays the committed retest kits against the target the reviewed scope authorizes.
+      # It runs only when .guardlink/scope.yaml carries a human-written authorization_attestation and
+      # vars.BRAVOS_SCAN_TARGET is loopback (started by vars.BRAVOS_APP_START) or in the scope's
+      # host_allowlist. It replays kits only: no probe generation and no destructive classes.
+      - name: Authorized scan (gated)
+        id: scan
+        env:
+          TARGET: ${{ vars.BRAVOS_SCAN_TARGET }}
+          APP_START: ${{ vars.BRAVOS_APP_START }}
+          AUTH_PROFILE: ${{ vars.BRAVOS_SCAN_AUTH }}
+          AUTH_STATE: ${{ secrets.BRAVOS_AUTH_STATE }}
+        run: |
+          skip() { echo "::notice::nightly scan skipped: $1"; echo "ran=false" >> "$GITHUB_OUTPUT"; exit 0; }
+          scope=.guardlink/scope.yaml
+          [ -n "$TARGET" ] || skip "vars.BRAVOS_SCAN_TARGET is not set"
+          [ -f "$scope" ] || skip "$scope is not committed"
+          attest=$(sed -n 's/^authorization_attestation:[[:space:]]*//p' "$scope" | sed 's/^"\(.*\)"$/\1/')
+          [ -n "$attest" ] || skip "$scope has no authorization_attestation; a human must write it and get it reviewed"
+          ls .guardlink/cxg-replay/*.js >/dev/null 2>&1 || skip "no retest kits in .guardlink/cxg-replay/"
+          host=$(printf '%s' "$TARGET" | sed -E 's#^[a-z]+://##; s#[:/].*$##')
+          case "$host" in
+            127.0.0.1|localhost|::1|'[::1]') loopback=yes ;;
+            *) loopback=no ;;
+          esac
+          if [ "$loopback" = no ] && ! grep -qF "$host" <(sed -n '/^host_allowlist:/,/^[a-z_]*:/p' "$scope"); then
+            skip "$host is neither loopback nor in the scope's host_allowlist"
+          fi
+          if [ "$loopback" = yes ]; then
+            [ -n "$APP_START" ] || skip "a loopback target needs vars.BRAVOS_APP_START to start the app"
+            bash -c "$APP_START"
+            for i in $(seq 1 60); do curl -fsS -o /dev/null "$TARGET" && break; sleep 2; done
+          fi
+          cargo install --locked cert-x-gen
+          cxg pentest install
+          auth=()
+          if [ -n "$AUTH_PROFILE" ]; then
+            [ -n "$AUTH_STATE" ] || skip "vars.BRAVOS_SCAN_AUTH is set but secrets.BRAVOS_AUTH_STATE is empty"
+            printf '%s' "$AUTH_STATE" | base64 -d > "$RUNNER_TEMP/state.json"
+            cxg pentest auth import --storage-state "$RUNNER_TEMP/state.json" --profile "$AUTH_PROFILE" --target "$TARGET"
+            auth=(--auth "$AUTH_PROFILE")
+          fi
+          guardlink sarif . --profile pentest -o whitebox/findings.sarif
+          run=".guardlink/pentest-findings/nightly-$(date -u +%Y%m%d)"
+          set +e
+          cxg pentest run --codebase . --target "$TARGET" "${auth[@]}" --template-dir .guardlink/cxg-replay/ --scope-file "$scope" --attestation "$attest" --session-dir "$run" --ci
+          code=$?
+          set -e
+          echo "exit=$code" >> "$GITHUB_OUTPUT"
+          case "$code" in
+            0|2) guardlink hypothesis confirm --from-scan "$run/report.json" --write || true
+                 echo "ran=true" >> "$GITHUB_OUTPUT" ;;
+            *) echo "::warning::cxg pentest run exited $code: nothing was proven"; echo "ran=false" >> "$GITHUB_OUTPUT" ;;
+          esac
+
+      - name: Open the pull request
+        env:
+          SCAN_RAN: ${{ steps.scan.outputs.ran }}
+          SCAN_EXIT: ${{ steps.scan.outputs.exit }}
+          SCAN_TARGET: ${{ vars.BRAVOS_SCAN_TARGET }}
+          GH_TOKEN: ${{ github.token }}
+          START: ${{ steps.start.outputs.sha }}
+          BEFORE: ${{ steps.start.outputs.coverage }}
+        run: |
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "Nothing new to annotate."
+            exit 0
+          fi
+          guardlink ci -f json > "$RUNNER_TEMP/ci-after.json" || true
+          after=$(jq -r '.summary.coverage.percent // "unknown"' "$RUNNER_TEMP/ci-after.json")
+          base=$(gh repo view --json defaultBranchRef -q .defaultBranchRef.name)
+          branch="bravos/nightly-$(date -u +%Y%m%d-%H%M)"
+          git config user.name "bravos-nightly[bot]"
+          git config user.email "bravos-nightly@users.noreply.github.com"
+          git switch -c "$branch"
+          git add -A
+          git commit -m "annotate: nightly coverage slice (${BEFORE}% -> ${after}%)"
+          git push origin "$branch"
+          {
+            echo "Nightly coverage slice by bravos-annotate: ${BEFORE}% -> ${after}%."
+            echo
+            echo "## Security gate"
+            echo "validate ✔ · lint 0 errors · exposures recorded by this slice are listed below and stay open"
+            if [ "$SCAN_RAN" = "true" ]; then
+              echo "Tested: retest kits replayed against $SCAN_TARGET (exit code $SCAN_EXIT); outcomes recorded in .guardlink/hypotheses.json."
+            else
+              echo "Not tested: the gated scan did not run (see the job's notices)."
+            fi
+            echo
+            guardlink diff "$START" --markdown || true
+          } > "$RUNNER_TEMP/body.md"
+          gh pr create --base "$base" --head "$branch" --title "annotate: nightly coverage slice" --body-file "$RUNNER_TEMP/body.md"

package/templates/workflows/bravos-pr-gate.yml

@@ -0,0 +1,142 @@
+# bravos:generated — written by `bravos init --ci`; `bravos sync --ci` refreshes it while this line stays.
+# The bravos-ship gate as a pull-request check, the same rulings as the opt-in pre-PR hook.
+# Deterministic: it runs guardlink only, spends no model, and needs no secret. A gate input that
+# fails or does not parse fails the job as "unknown", never passes. Pin the actions below to
+# commit SHAs if your organisation requires it.
+name: bravos security gate
+
+on:
+  pull_request:
+    # edited: adding the disclosure to the PR body re-runs the gate.
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+  security-events: write
+  # upload-sarif reads the run's metadata; private repositories need this to upload.
+  actions: read
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install guardlink
+        run: npm install -g guardlink
+
+      - name: Merge base
+        id: base
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: echo "sha=$(git merge-base HEAD "origin/$BASE_REF")" >> "$GITHUB_OUTPUT"
+
+      # Whole-token id matching shared by the disclosure and @ticket checks: `#api` is not `#api-key`.
+      - name: jq helpers
+        run: |
+          cat > "$RUNNER_TEMP/named.jq" <<'EOF'
+          def esc: gsub("(?<c>[.*+?^${}()|\\[\\]\\\\])"; "\\\(.c)");
+          def named($text; $id): ($id | type) == "string" and ($text | test("(?<![\\w#.-])" + ($id | esc) + "(?![\\w-])"));
+          EOF
+
+      - name: Threat model parses and resolves
+        run: guardlink validate .
+
+      - name: New claims meet the evidence bar
+        env:
+          BASE_SHA: ${{ steps.base.outputs.sha }}
+        run: |
+          status=0
+          guardlink lint . --since "$BASE_SHA" --json > lint.json || status=$?
+          if ! errors=$(jq -er '.summary.errors | numbers' lint.json); then
+            echo "::error::unknown: guardlink lint --since $BASE_SHA exited $status without guardlink.lint JSON"
+            exit 1
+          fi
+          if [ "$errors" != "0" ]; then
+            echo "::error::guardlink lint reports $errors error(s) in this PR's claims; apply each violation's fix (bravos-ship)."
+            jq '.violations' lint.json
+            exit 1
+          fi
+
+      # Each new unmitigated exposure must be disclosed in the PR body by both its threat and its
+      # asset id (bravos-ship's Security gate section lists them), so an honest @exposes + @audit is
+      # reported rather than blocked forever. The body reaches the shell through env, never inline,
+      # so its text cannot run as a command.
+      - name: No undisclosed new exposure
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+          BASE_SHA: ${{ steps.base.outputs.sha }}
+        run: |
+          if ! guardlink diff "$BASE_SHA" --json > diff.json; then
+            echo "::error::unknown: guardlink diff $BASE_SHA --json failed"
+            exit 1
+          fi
+          if ! jq -e '.newUnmitigatedExposures | arrays' diff.json > /dev/null; then
+            echo "::error::unknown: guardlink diff $BASE_SHA --json has no newUnmitigatedExposures"
+            exit 1
+          fi
+          jq -r '.newUnmitigatedExposures[] | "- \(.threat) on \(.asset) — \(.location.file):\(.location.line)"' diff.json >> "$GITHUB_STEP_SUMMARY"
+          jq -r -L "$RUNNER_TEMP" --arg body "$PR_BODY" 'include "named";
+            .newUnmitigatedExposures[] | select((named($body; .threat) and named($body; .asset)) | not)
+            | "\(.threat) on \(.asset) — \(.location.file):\(.location.line)"' diff.json > undisclosed.txt
+          if [ -s undisclosed.txt ]; then
+            echo "::error::This PR adds unmitigated exposure the PR body does not disclose. Name each threat and asset id in its Security gate section (bravos-ship writes it):"
+            cat undisclosed.txt
+            exit 1
+          fi
+
+      # A confirmed-exploitable claim on a file this PR changes blocks it, unless that same file
+      # carries a ticket line (the @ticket verb) for the same threat and asset (bravos-ship step 7).
+      - name: No confirmed exploit on a changed path
+        env:
+          BASE_SHA: ${{ steps.base.outputs.sha }}
+        run: |
+          if ! guardlink ci -f json > ci.json; then
+            echo "::error::unknown: guardlink ci -f json failed"
+            exit 1
+          fi
+          if ! jq -e '.confirmed | arrays' ci.json > /dev/null; then
+            echo "::error::unknown: guardlink ci -f json did not produce guardlink.ci JSON with confirmed[]"
+            exit 1
+          fi
+          git diff --name-only "$BASE_SHA"...HEAD > changed.txt
+          jq -r '.confirmed[] | [.location.file, (.location.line | tostring), .threat, .asset, (.severity // "unrated")] | @tsv' ci.json > confirmed.tsv
+          hits=""
+          while IFS=$'\t' read -r file line threat asset severity; do
+            grep -qxF -- "$file" changed.txt || continue
+            if [ -f "$file" ] && jq -Rne -L "$RUNNER_TEMP" --arg t "$threat" --arg a "$asset" 'include "named";
+                 [inputs | select(contains("@ticket") and named(.; $t) and named(.; $a))] | length > 0' < "$file" > /dev/null; then
+              continue
+            fi
+            hits+="$severity $threat on $asset — $file:$line"$'\n'
+          done < confirmed.tsv
+          if [ -n "$hits" ]; then
+            echo "::error::Confirmed-exploitable claims on changed files, with no @ticket for them in that file:"
+            printf '%s' "$hits"
+            exit 1
+          fi
+
+      - name: Undefended paths (informational)
+        continue-on-error: true
+        run: guardlink paths --json > paths.json
+
+      - name: SARIF for code scanning
+        run: guardlink sarif . --profile github -o guardlink.sarif
+
+      # A fork's pull_request token cannot write security events; skip the upload there.
+      - name: Upload SARIF
+        if: github.event.pull_request.head.repo.full_name == github.repository
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: guardlink.sarif
+          category: guardlink