flagon-io/g1t

public

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

git agents cloudflare rust forge mcp

g1t/services/security/migrations/0001_init.sql

101 lines2,907 bytesCode Blame

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API1d ago	1	-- The security service: secrets found in pushes and history, vulnerable
	2	-- dependencies, and the upgrade issues opened for them.
	3
	4	-- Each repository the service has seen, and where its scans stand.
	5	CREATE TABLE repos (
	6	repo_id TEXT PRIMARY KEY,
	7	namespace TEXT NOT NULL,
	8	name TEXT NOT NULL,
	9	-- Whether g1t opens upgrade issues and puts its agent on them.
	10	upkeep INTEGER NOT NULL DEFAULT 1,
	11	upkeep_by TEXT,
	12	upkeep_at TEXT,
	13	-- pending \| running \| done \| stopped
	14	history TEXT NOT NULL DEFAULT 'pending',
	15	-- The commit the next page of history starts from.
	16	history_cursor TEXT,
	17	history_commits INTEGER NOT NULL DEFAULT 0,
	18	history_finished_at TEXT,
	19	deps_scanned_at TEXT,
	20	deps_commit TEXT,
	21	deps_error TEXT,
	22	-- JSON array of lockfile paths last read.
	23	lockfiles TEXT NOT NULL DEFAULT '[]',
	24	created_at TEXT NOT NULL
	25	);
	26	CREATE INDEX repos_namespace ON repos (namespace);
	27	CREATE INDEX repos_history ON repos (history);
	28
	29	-- A secret is kept as a fingerprint and a preview, never itself.
	30	CREATE TABLE secrets (
	31	id TEXT PRIMARY KEY,
	32	repo_id TEXT NOT NULL,
	33	fingerprint TEXT NOT NULL,
	34	kind TEXT NOT NULL,
	35	path TEXT NOT NULL,
	36	line INTEGER NOT NULL,
	37	commit_hash TEXT NOT NULL,
	38	preview TEXT NOT NULL,
	39	-- open \| blocked \| allowed \| resolved
	40	status TEXT NOT NULL,
	41	-- push \| history
	42	source TEXT NOT NULL,
	43	found_by TEXT,
	44	found_at TEXT NOT NULL,
	45	decided_by TEXT,
	46	reason TEXT,
	47	decided_at TEXT,
	48	UNIQUE (repo_id, fingerprint)
	49	);
	50
	51	CREATE TABLE vulnerabilities (
	52	id TEXT PRIMARY KEY,
	53	repo_id TEXT NOT NULL,
	54	ecosystem TEXT NOT NULL,
	55	package TEXT NOT NULL,
	56	version TEXT NOT NULL,
	57	manifest TEXT NOT NULL,
	58	osv_id TEXT NOT NULL,
	59	advisory TEXT NOT NULL,
	60	summary TEXT NOT NULL,
	61	severity TEXT NOT NULL,
	62	fixed_version TEXT,
	63	-- open \| fixed
	64	status TEXT NOT NULL,
	65	found_at TEXT NOT NULL,
	66	fixed_at TEXT,
	67	UNIQUE (repo_id, ecosystem, package, version, manifest, osv_id)
	68	);
	69	CREATE INDEX vulnerabilities_repo ON vulnerabilities (repo_id, status);
	70
	71	-- The issue opened to upgrade one package, so it is opened once.
	72	CREATE TABLE upgrades (
	73	repo_id TEXT NOT NULL,
	74	ecosystem TEXT NOT NULL,
	75	package TEXT NOT NULL,
	76	number INTEGER NOT NULL,
	77	target TEXT NOT NULL,
	78	opened_at TEXT NOT NULL,
	79	-- Whether a g1t agent was put on it, or why not.
	80	assigned INTEGER NOT NULL DEFAULT 0,
	81	note TEXT,
	82	PRIMARY KEY (repo_id, ecosystem, package)
	83	);
	84
	85	-- OSV's records, kept for a week so a rescan does not fetch them again.
	86	CREATE TABLE advisories (
	87	osv_id TEXT PRIMARY KEY,
	88	body TEXT NOT NULL,
	89	fetched_at TEXT NOT NULL
	90	);
	91
	92	-- What scanning cost each workspace, a month at a time.
	93	CREATE TABLE usage (
	94	workspace TEXT NOT NULL,
	95	month TEXT NOT NULL,
	96	reads INTEGER NOT NULL DEFAULT 0,
	97	commits INTEGER NOT NULL DEFAULT 0,
	98	osv_queries INTEGER NOT NULL DEFAULT 0,
	99	cost_micros INTEGER NOT NULL DEFAULT 0,
	100	PRIMARY KEY (workspace, month)
	101	);