services:
  polinrider-cleanup:
    build: .
    image: polinrider-cleanup:latest
    container_name: polinrider-cleanup

    environment:
      # Pass your GitHub PAT (needs repo + org:read scopes)
      # Set this in your shell: export GH_TOKEN=ghp_...
      - GH_TOKEN=${GH_TOKEN}
      - GITHUB_TOKEN=${GH_TOKEN}   # gh CLI reads either
      # Target account — set EXACTLY ONE (comment out the other):
      - GH_ORG=${GH_ORG:-}         # an org name, e.g. mycompany
      - GH_USER=${GH_USER:-}       # OR your personal username (scans repos you own)
      - DRY_RUN=${DRY_RUN:-false}  # set to "true" to skip PR creation
      - GH_REPO=${GH_REPO:-}       # optional: scope to one/few repos (comma-separated) for a pilot
      - AUTO_MERGE=${AUTO_MERGE:-false}     # optional: auto-merge cleanup PRs (respects branch protection)
      - MERGE_METHOD=${MERGE_METHOD:-squash} # squash | merge | rebase
      - REPORTS_DIR=${REPORTS_DIR:-reports}  # JSON + Markdown run reports land here (mounted below)

    # JSON + Markdown scan/remediation reports are written here (host ./reports).
    volumes:
      - ./reports:/app/reports

    # No network access except github.com — drop everything else
    # (requires Docker with custom network + external DNS)
    # For stricter isolation remove this and use default bridge
    network_mode: bridge

    # Drop all Linux capabilities — scanner needs none
    cap_drop:
      - ALL

    # Read-only root fs — only /workspace and /app/reports are writable
    read_only: true
    tmpfs:
      - /workspace:exec,mode=1777,size=2g
      - /tmp:mode=1777,size=128m
      - /home/scanner:mode=755,size=64m

    # Resource limits
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: 3G