46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
|
services:
|
||
|
|
polinrider-cleanup:
|
||
|
|
build: .
|
||
|
|
image: polinrider-cleanup:latest
|
||
|
|
container_name: polinrider-cleanup
|
||
|
|
|
||
|
|
environment:
|
||
|
|
# Pass your GitHub PAT (needs repo + org:read scopes)
|
||
|
|
# Set this in your shell: export GH_TOKEN=ghp_...
|
||
|
|
- GH_TOKEN=${GH_TOKEN}
|
||
|
|
- GITHUB_TOKEN=${GH_TOKEN} # gh CLI reads either
|
||
|
|
# Target account — set EXACTLY ONE (comment out the other):
|
||
|
|
- GH_ORG=${GH_ORG:-} # an org name, e.g. mycompany
|
||
|
|
- GH_USER=${GH_USER:-} # OR your personal username (scans repos you own)
|
||
|
|
- DRY_RUN=${DRY_RUN:-false} # set to "true" to skip PR creation
|
||
|
|
- GH_REPO=${GH_REPO:-} # optional: scope to one/few repos (comma-separated) for a pilot
|
||
|
|
- AUTO_MERGE=${AUTO_MERGE:-false} # optional: auto-merge cleanup PRs (respects branch protection)
|
||
|
|
- MERGE_METHOD=${MERGE_METHOD:-squash} # squash | merge | rebase
|
||
|
|
- REPORTS_DIR=${REPORTS_DIR:-reports} # JSON + Markdown run reports land here (mounted below)
|
||
|
|
|
||
|
|
# JSON + Markdown scan/remediation reports are written here (host ./reports).
|
||
|
|
volumes:
|
||
|
|
- ./reports:/app/reports
|
||
|
|
|
||
|
|
# No network access except github.com — drop everything else
|
||
|
|
# (requires Docker with custom network + external DNS)
|
||
|
|
# For stricter isolation remove this and use default bridge
|
||
|
|
network_mode: bridge
|
||
|
|
|
||
|
|
# Drop all Linux capabilities — scanner needs none
|
||
|
|
cap_drop:
|
||
|
|
- ALL
|
||
|
|
|
||
|
|
# Read-only root fs — only /workspace and /app/reports are writable
|
||
|
|
read_only: true
|
||
|
|
tmpfs:
|
||
|
|
- /workspace:exec,mode=1777,size=2g
|
||
|
|
- /tmp:mode=1777,size=128m
|
||
|
|
- /home/scanner:mode=755,size=64m
|
||
|
|
|
||
|
|
# Resource limits
|
||
|
|
deploy:
|
||
|
|
resources:
|
||
|
|
limits:
|
||
|
|
cpus: "2"
|
||
|
|
memory: 3G
|