sharang/tramiton lists sharang as a Collaborative Owner (tramiton → Settings →
Actions), so this repo's Actions can read tramiton. Use ${{ github.token }} in
the git credential rewrite instead of a TRAMITON_FETCH_TOKEN PAT — no secret to
manage. If cargo's git fetch 403s (feature scoped to uses:-actions only), fall
back to a PAT.
Refs #118.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Replace the `tramiton detect --json` CLI shell-out with a direct dependency on
tramiton-core (same-company IP), so firmware bare-metal/RTOS classification runs
in-process and the whole tramiton suite is available to onboarding.
- compliance-agent depends on tramiton-core (git, tag v0.4.0).
- classify/firmware.rs: TramitonNative runs tramiton_core::provider::analyze on a
blocking thread and maps its BuildPlan → a minimal FirmwareDetection. Drops the
mirrored JSON structs and the CLI wrapper. FirmwareDetector port + a
deterministic MockFirmwareDetector are kept so unit tests need neither the
tramiton sources nor a firmware tree.
- CI: enable CARGO_NET_GIT_FETCH_WITH_CLI and add a git-auth step so the runner
can fetch the private tramiton repo. Requires a repo secret TRAMITON_FETCH_TOKEN
(Gitea PAT with read access to sharang/tramiton).
Refs #118, #121, #135.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Each deploy job now builds the per-service image, pushes to the
private registry as :latest and :sha, then triggers an HMAC-signed
orca redeploy webhook. Coolify webhooks are no longer used.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New `compliance-mcp` crate providing a Model Context Protocol server
with 7 tools: list/get/summarize findings, list SBOM packages, SBOM
vulnerability report, list DAST findings, and DAST scan summary.
Supports stdio (local dev) and Streamable HTTP (deployment via MCP_PORT).
Includes Dockerfile, CI clippy check, and Coolify deploy job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #5
Deploys agent, dashboard, and docs independently based on which
files changed. Only triggers on main after tests pass.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Format, clippy, security audit, and test stages adapted from certifai.
Clippy and tests run per-crate with proper feature gating for the
dashboard's server/web split.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sharang