flagon-io/g1t

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

The runner base keeps its old comment, so the pushed base image still matches its folder1w ago		1	-- The security service: secrets found in pushes and history, vulnerable
		2	-- dependencies, and the upgrade issues opened for them.
		3
		4	-- Each repository the service has seen, and where its scans stand.
		5	CREATE TABLE repos (
		6	repo_id TEXT PRIMARY KEY,
		7	namespace TEXT NOT NULL,
		8	name TEXT NOT NULL,
		9	-- Whether g1t opens upgrade issues and puts its agent on them.
		10	upkeep INTEGER NOT NULL DEFAULT 1,
		11	upkeep_by TEXT,
		12	upkeep_at TEXT,
		13	-- pending | running | done | stopped
		14	history TEXT NOT NULL DEFAULT 'pending',
		15	-- The commit the next page of history starts from.
		16	history_cursor TEXT,
		17	history_commits INTEGER NOT NULL DEFAULT 0,
		18	history_finished_at TEXT,
		19	deps_scanned_at TEXT,
		20	deps_commit TEXT,
		21	deps_error TEXT,
		22	-- JSON array of lockfile paths last read.
		23	lockfiles TEXT NOT NULL DEFAULT '[]',
		24	created_at TEXT NOT NULL
		25	);
		26	CREATE INDEX repos_namespace ON repos (namespace);
		27	CREATE INDEX repos_history ON repos (history);
		28
		29	-- A secret is kept as a fingerprint and a preview, never itself.
		30	CREATE TABLE secrets (
		31	id TEXT PRIMARY KEY,
		32	repo_id TEXT NOT NULL,
		33	fingerprint TEXT NOT NULL,
		34	kind TEXT NOT NULL,
		35	path TEXT NOT NULL,
		36	line INTEGER NOT NULL,
		37	commit_hash TEXT NOT NULL,
		38	preview TEXT NOT NULL,
		39	-- open | blocked | allowed | resolved
		40	status TEXT NOT NULL,
		41	-- push | history
		42	source TEXT NOT NULL,
		43	found_by TEXT,
		44	found_at TEXT NOT NULL,
		45	decided_by TEXT,
		46	reason TEXT,
		47	decided_at TEXT,
		48	UNIQUE (repo_id, fingerprint)
		49	);
		50
		51	CREATE TABLE vulnerabilities (
		52	id TEXT PRIMARY KEY,
		53	repo_id TEXT NOT NULL,
		54	ecosystem TEXT NOT NULL,
		55	package TEXT NOT NULL,
		56	version TEXT NOT NULL,
		57	manifest TEXT NOT NULL,
		58	osv_id TEXT NOT NULL,
		59	advisory TEXT NOT NULL,
		60	summary TEXT NOT NULL,
		61	severity TEXT NOT NULL,
		62	fixed_version TEXT,
		63	-- open | fixed
		64	status TEXT NOT NULL,
		65	found_at TEXT NOT NULL,
		66	fixed_at TEXT,
		67	UNIQUE (repo_id, ecosystem, package, version, manifest, osv_id)
		68	);
		69	CREATE INDEX vulnerabilities_repo ON vulnerabilities (repo_id, status);
		70
		71	-- The issue opened to upgrade one package, so it is opened once.
		72	CREATE TABLE upgrades (
		73	repo_id TEXT NOT NULL,
		74	ecosystem TEXT NOT NULL,
		75	package TEXT NOT NULL,
		76	number INTEGER NOT NULL,
		77	target TEXT NOT NULL,
		78	opened_at TEXT NOT NULL,
		79	-- Whether a g1t agent was put on it, or why not.
		80	assigned INTEGER NOT NULL DEFAULT 0,
		81	note TEXT,
		82	PRIMARY KEY (repo_id, ecosystem, package)
		83	);
		84
		85	-- OSV's records, kept for a week so a rescan does not fetch them again.
		86	CREATE TABLE advisories (
		87	osv_id TEXT PRIMARY KEY,
		88	body TEXT NOT NULL,
		89	fetched_at TEXT NOT NULL
		90	);
		91
		92	-- What scanning cost each workspace, a month at a time.
		93	CREATE TABLE usage (
		94	workspace TEXT NOT NULL,
		95	month TEXT NOT NULL,
		96	reads INTEGER NOT NULL DEFAULT 0,
		97	commits INTEGER NOT NULL DEFAULT 0,
		98	osv_queries INTEGER NOT NULL DEFAULT 0,
		99	cost_micros INTEGER NOT NULL DEFAULT 0,
		100	PRIMARY KEY (workspace, month)
		101	);

This file's history is long; its oldest lines are credited to the oldest commit read.