Adopt werkpilot's CI compile-acceleration setup so builds are crates.io-
independent and cached across runs:
- Resolve crates.io deps through the self-hosted Kellnr mirror
(crates.meghsakha.com) via a .cargo/config.toml source replacement. Git deps
(tramiton-core) are unaffected.
- Back sccache with Hetzner S3 (breakpilot-sccache bucket, key prefix
compliance-scanner) instead of an ephemeral /tmp dir — persistent across CI
runs. Bump sccache to v0.10.0.
- Throttle cargo (CARGO_NET_RETRY, HTTP/1.1) so the ~670-crate download burst
doesn't 429 the mirror.
Requires repo secrets HETZNER_S3_ACCESS_KEY and HETZNER_S3_SECRET_KEY (same
bucket/creds as werkpilot). Closes#139.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Each deploy job now builds the per-service image, pushes to the
private registry as :latest and :sha, then triggers an HMAC-signed
orca redeploy webhook. Coolify webhooks are no longer used.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New `compliance-mcp` crate providing a Model Context Protocol server
with 7 tools: list/get/summarize findings, list SBOM packages, SBOM
vulnerability report, list DAST findings, and DAST scan summary.
Supports stdio (local dev) and Streamable HTTP (deployment via MCP_PORT).
Includes Dockerfile, CI clippy check, and Coolify deploy job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Sharang Parnerkar <parnerkarsharang@gmail.com>
Reviewed-on: #5
Deploys agent, dashboard, and docs independently based on which
files changed. Only triggers on main after tests pass.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Format, clippy, security audit, and test stages adapted from certifai.
Clippy and tests run per-crate with proper feature gating for the
dashboard's server/web split.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
sharang