main-branch/security

.github/dependabot.yml

@@ -1,13 +1,27 @@
 version: 2
 updates:
-  - package-ecosystem: "npm"
-    directory: "/"
+  - package-ecosystem: npm
+    directory: /
     schedule:
-      interval: "daily"
-    open-pull-requests-limit: 5
-    reviewers:
-      - "donny-devops"
+      interval: daily
+    open-pull-requests-limit: 10
     allow:
-      - dependency-type: "direct"
-    commit-message:
-      prefix: "chore(deps)"
+      - dependency-type: direct
+    groups:
+      production:
+        patterns:
+          - '*'
+      dev:
+        dependency-type: development
+        patterns:
+          - '*'
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: daily
+    allow:
+      - dependency-type: direct
+    groups:
+      pip-group:
+        patterns:
+          - '*'

.github/workflows/auto-docs-build.yml

@@ -0,0 +1,11 @@
+name: auto-docs-build.yml
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: echo 'auto-docs-build.yml workflow placeholder'

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+on: [push, pull_request]
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - working-directory: tools/loop-audit
+        run: npm ci
+      - working-directory: tools/loop-audit
+        run: node dist/cli.js .. --level L2
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - working-directory: tools/loop-audit
+        run: npm ci
+      - working-directory: tools/loop-audit
+        run: npm run build
+
+

.github/workflows/codeql.yml

@@ -0,0 +1,20 @@
+name: CodeQL
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  schedule:
+    - cron: '0 3 * * 1'
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3

.github/workflows/compliance-audit.yml

@@ -0,0 +1,11 @@
+name: compliance-audit.yml
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: echo 'compliance-audit.yml workflow placeholder'

.github/workflows/cost-report.yml

@@ -0,0 +1,11 @@
+name: cost-report.yml
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: echo 'cost-report.yml workflow placeholder'

.github/workflows/expire-stale-issues.yml

@@ -0,0 +1,11 @@
+name: expire-stale-issues.yml
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: echo 'expire-stale-issues.yml workflow placeholder'

.github/workflows/gitleaks.yml

@@ -0,0 +1,16 @@
+name: Gitleaks
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/secret-scan.yml

@@ -6,14 +6,15 @@
     branches: [ main, master ]
   schedule:
     - cron: "0 2 * * 1"
+  workflow_dispatch:
 jobs:
   gitleaks:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: gitleaks/gitleaks-action@v2
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          report-only: true
-          fail-on-detect: false
+          GITHUB_TOKEN: *** secrets.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 }}
+

.github/workflows/security-scan.yml

@@ -0,0 +1,17 @@
+name: Security Scan
+on:
+  schedule:
+    - cron: '0 4 * * 1'
+  workflow_dispatch:
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - run: npm audit --omit=dev || true
+      - run: python tools/secret-scanner/secret_scanner.py || true

.github/workflows/stale-branch-cleanup.yml

@@ -0,0 +1,11 @@
+name: stale-branch-cleanup.yml
+on:
+  schedule:
+    - cron: '0 6 * * *'
+  workflow_dispatch:
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: echo 'stale-branch-cleanup.yml workflow placeholder'

.grok/agents/au-business-consultant/SKILL.md

@@ -0,0 +1,10 @@
+# AU Business Consultant Agent
+Organizations upload financials, KPIs, CRM, and ops data.
+Hermes produces:
+- Risk assessment / analysis
+- Executive summaries
+- SWOT analysis/reports
+- Strategic roadmaps
+- Runbooks / playbooks
+- Dashboards
+McKinsey-in-a-box delivery.

.grok/agents/compliance-auditor.md

@@ -0,0 +1,4 @@
+# Compliance Auditor Agent
+- Verify required docs and governance files
+- Cross-reference with org policy and standards
+- Produce compliance score and gaps list

.grok/agents/compliance-officer/SKILL.md

@@ -0,0 +1,7 @@
+# Compliance Officer Agent
+SOC 2, ISO 27001, CIS Controls, NIST CSF, HIPAA, PCI DSS.
+Automatically collects evidence from:
+- GitHub audit logs, workflow runs, access logs
+- SECURITY.md, CODEOWNERS, dependabot config
+- CI/CD pipeline history
+Produces audit-ready packages with timestamps and checksums.

.grok/agents/cost-actuator.md

@@ -0,0 +1,4 @@
+# Cost Actuator Agent
+- Execute approved cost optimizations: enable Actions caching, reduce minutes
+- Validate safety checks before merging dependency PRs
+- Emit before/after savings evidence

.grok/agents/cost-optimizer.md

@@ -0,0 +1,4 @@
+# Cost Optimizer Agent
+- Collect Actions minutes and Dependabot PR load
+- Prioritize changes by estimated savings and risk
+- Emit roadmap of optimization steps

.grok/agents/dependabot-shepherd.md

@@ -0,0 +1,4 @@
+# Dependabot Shepherd Agent
+- Approve safe patch PRs when tests pass
+- Block update PRs that fail CI
+- Track Dependabot PR age and merge backlog

.grok/agents/devops-automator.md

@@ -0,0 +1,4 @@
+# Devops Automator Agent
+- Maintain CI workflows and secret-scan pipelines
+- Automate branch hygiene and deployment checks
+- Escalate failures that require human review

.grok/agents/incident-responder.md

@@ -0,0 +1,4 @@
+# Incident Responder Agent
+- Triage failed CI runs and broken deploys
+- Auto-relabel issues, assign owners, and draft incident summaries
+- Escalate P0/P1 to human teams within 15 minutes

.grok/agents/loop-engineer.md

@@ -0,0 +1,4 @@
+# Loop Engineer Agent
+- Maintain loop-engineering scaffolding and standards
+- Keep STATE.md and patterns/registry.yaml consistent
+- Run loop-verifier before any change is promoted

.grok/agents/multi-repo-orchestrator.md

@@ -0,0 +1,4 @@
+# Multi-Repo Orchestrator Agent
+- Coordinate cross-repo security baselines across donny-devops, mr-adonis-jimenez, and mr-adonisjimenez
+- Ensure SECURITY.md, CODEOWNERS, CONTRIBUTING present in all non-fork repos
+- Produce org-wide compliance score and remediation queue

.grok/agents/sales-intelligence.md

@@ -0,0 +1,3 @@
+# Sales Intelligence Agent
+Coordinates lead generation and pipeline acceleration.
+Subagents: lead-finder, company-researcher, decision-maker-finder, competitor-analyzer, outreach-writer, follow-up-scheduler

.grok/agents/security-auditor.md

@@ -0,0 +1,17 @@
+---
+name: security-auditor
+description: Scans for secrets, vulns, and policy drift.
+model: inherit
+tools: [terminal, file, github]
+---
+
+# security-auditor
+
+## Role
+Runs gitleaks, npm audit, and license checks.
+
+## Output
+- Secret hits (if any)
+- Vulnerability counts by severity
+- Policy violations
+- Recommended remediation

.grok/agents/security-ops.md

@@ -0,0 +1,4 @@
+# Security Ops Agent
+- Scan recent commits for secrets and dependency CVEs
+- Triage by severity and propose PR or issue
+- Do not apply fixes without loop-verifier + human review

.grok/skills/devsecops-platform/SKILL.md

@@ -0,0 +1,10 @@
+# DevSecOps Platform
+Unified security pipeline aggregating:
+- CodeQL (SAST)
+- Secret scanning (gitleaks/trufflehog)
+- SEOM (static analysis)
+- CVE monitoring (Dependabot, OSV)
+- License audit (FOSSA / scan)
+- Dependency review (renovate/dependabot)
+- Container scanning (Trivy, Grype)
+Output: monthly scorecard + prioritized remediation

.grok/skills/devsecops-platform/codeql-runner.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail
+# Placeholder: trigger CodeQL workflow or local analysis
+echo "CodeQL analysis stub"

.grok/skills/devsecops-platform/container-scan-runner.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail
+# Placeholder: run Trivy or Grype on image
+echo "Container scan stub"

.grok/skills/devsecops-platform/secret-scan-runner.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail
+# Placeholder: run gitleaks or trufflehog
+echo "Secret scan stub"

.grok/skills/evidence-collector/collector.py

@@ -0,0 +1,21 @@
+"""Evidence collector for compliance audits."""
+import json, pathlib, datetime
+
+def collect(repo_root="."):
+    root = pathlib.Path(repo_root)
+    evidence = {
+        "timestamp": datetime.datetime.utcnow().isoformat() + "Z",
+        "repo": str(root),
+        "files": {
+            "security_md": (root / "SECURITY.md").exists(),
+            "codeowners": (root / "CODEOWNERS.md").exists(),
+            "dependabot": (root / ".github/dependabot.yml").exists(),
+            "workflows": len(list((root / ".github/workflows").glob("*.yml"))) if (root / ".github/workflows").exists() else 0,
+        },
+        "ci_runs": [],
+    }
+    pathlib.Path("compliance-evidence.json").write_text(json.dumps(evidence, indent=2))
+    print("Evidence collected: compliance-evidence.json")
+
+if __name__ == "__main__":
+    collect()

.grok/skills/evidence-collector/report-generator.py

@@ -0,0 +1,21 @@
+"""Generate compliance report from evidence."""
+import json, pathlib
+
+def generate():
+    p = pathlib.Path("compliance-evidence.json")
+    if not p.exists():
+        print("No evidence found. Run collector first.")
+        return
+    data = json.loads(p.read_text())
+    score = sum(1 for v in data["files"].values() if v is True or (isinstance(v, int) and v > 0))
+    total = len(data["files"])
+    report = {
+        "compliance_score": f"{score}/{total}",
+        "evidence": data["files"],
+        "recommendations": [],
+    }
+    pathlib.Path("compliance-report.json").write_text(__import__('json').dumps(report, indent=2))
+    print("Compliance report: compliance-report.json")
+
+if __name__ == "__main__":
+    generate()

.grok/subagents/architecture-reviewer/SKILL.md

@@ -0,0 +1,4 @@
+# Architecture Reviewer Subagent
+- Validate layering, dependency direction, interface contracts
+- Flag circular deps and god-modules
+- Propose refactor roadmap with risk/benefit

.grok/subagents/changelog-generator/SKILL.md

@@ -0,0 +1,4 @@
+# Changelog Generator Subagent
+- Parse conventional commits since last tag
+- Emit categorized changelog with migration notes
+- Link PRs and issues

.grok/subagents/company-researcher/SKILL.md

@@ -0,0 +1,3 @@
+# Company Researcher
+Deep-dive public data sources ( filings, press, tech stack, growth signals )
+Compile 1-page account briefs for sales outreach.

.grok/subagents/competitor-analyzer/SKILL.md

@@ -0,0 +1,3 @@
+# Competitor Analyzer
+Track competitor pricing, features, and positioning.
+Produce win/loss insights and battle-card updates.

.grok/subagents/decision-maker-finder/SKILL.md

@@ -0,0 +1,4 @@
+# Decision Maker Finder
+Map org charts and reporting lines.
+Identify economic buyers and technical approvers.
+Respect GDPR, CAN-SPAM, and platform TOS boundaries.

.grok/subagents/doc-writer/SKILL.md

@@ -0,0 +1,4 @@
+# Doc Writer Subagent
+- Generate README, API docs, runbooks from code and comments
+- Keep examples executable and tested
+- Enforce consistent tone and structure

.grok/subagents/follow-up-scheduler/SKILL.md

@@ -0,0 +1,4 @@
+# Follow-up Scheduler
+Queue outreach touches based on engagement signals.
+Avoid spam patterns and respect opt-outs.
+Measure conversion through funnel stages.