# .github/workflows/sloppy.yml
name: Sloppy
on: [pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      models: read
    steps:
      - uses: actions/checkout@v4
      - uses: braedonsaunders/sloppy@main

name: Sloppy
on:
  pull_request:
  schedule:
    - cron: '0 6 * * 1'
jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      models: read
    steps:
      - uses: actions/checkout@v4
      - uses: braedonsaunders/sloppy@main
        with:
          scan-scope: auto

# .sloppy.yml
scan-provider: agent    # use fix-mode agent for scans
agent: claude            # claude | codex
model: ""                # optional model override

- uses: braedonsaunders/sloppy@main
  with:
    mode: scan
    scan-provider: agent
    agent: claude
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

# .github/workflows/sloppy-fix.yml
name: Sloppy Fix
on:
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:
jobs:
  fix:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: braedonsaunders/sloppy@main
        with:
          mode: fix
          agent: claude
          timeout: 30m
          max-cost: '$5.00'
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

      - uses: braedonsaunders/sloppy@main
        with:
          mode: fix
          agent: codex
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

      - uses: braedonsaunders/sloppy@main
        with:
          mode: fix
          agent: claude
        env:
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

- uses: braedonsaunders/sloppy@main
  with:
    fail-below: '70'

# ──────────────────────────────────────────────
# .sloppy.yml — Complete configuration reference
# ──────────────────────────────────────────────

# ── Operational ───────────────────────────────
mode: scan                          # scan | fix
agent: claude                       # claude | codex
timeout: 30m                        # e.g. 30m, 2h, 5h50m, 90s
max-cost: "$5.00"                   # max API spend per run
max-passes: 10                      # max scan/fix iterations
min-passes: 2                       # consecutive clean passes to confirm clean
max-chains: 3                       # max self-continuations (6h each)
model: ""                           # override AI model (e.g. claude-sonnet-4-5-20250929)
github-models-model: openai/gpt-4o-mini  # model for free scan tier
scan-scope: auto                    # auto | pr | full
scan-provider: github-models        # github-models (free) | agent (uses fix-mode provider)
verbose: false                      # stream agent output to logs
max-turns: 30                       # max agent turns per invocation
max-issues-per-pass: 0              # 0 = unlimited
output-file: ""                     # path for full issues JSON export
parallel-agents: 1                  # 1-8, uses git worktrees
plugins: true                       # enable/disable plugin system
custom-prompt: ""                   # inline custom prompt text
custom-prompt-file: ""              # path to prompt file

# ── Filtering ─────────────────────────────────
strictness: high                    # low | medium | high
min-severity: low                   # critical | high | medium | low
                                    #   Only report/fix issues at or above this level
                                    #   Example: "high" → only critical + high issues
fail-below: 0                       # fail action if score drops below this (0 = disabled)
test-command: "npm run test:ci"     # override auto-detected test runner

fix-types:                          # which issue types to scan/fix
  - security
  - bugs
  - types
  - lint
  - dead-code
  - stubs
  - duplicates
  - coverage

ignore:                             # glob patterns to exclude
  - "**/*.test.ts"
  - "vendor/"
  - "generated/"

rules:                              # per-type severity overrides
  lint: medium                      #   critical | high | medium | low
  dead-code: off                    #   'off' disables the type entirely

# ── App Context ───────────────────────────────
# Tells the AI about your application so it can calibrate severity.
# A hardcoded localhost URL in a CLI tool is not a security issue.
# An unauthenticated endpoint behind a VPN is different from a public API.
app:
  type: web-app                     # web-app | api | cli | library | worker | mobile | desktop
  exposure: public                  # public | internal | local
  auth: true                        # has authentication layer
  network: internet                 # internet | vpn | localhost
  data-sensitivity: high            # high | medium | low (PII, financial, public data)

# ── Technology Context ────────────────────────
framework: next.js                  # helps AI understand framework-specific patterns
runtime: node-20                    # runtime version hint

# ── Trust Boundaries ──────────────────────────
trust-internal:                     # packages to treat as first-party (don't flag imports)
  - "@myorg/*"
  - "@mycompany/shared-utils"

trust-untrusted:                    # files that handle external/user input (stricter scrutiny)
  - "src/api/routes/*"
  - "src/webhooks/*"

# ── False Positive Suppressions ───────────────
# Patterns matching issue descriptions or file paths are suppressed.
allow:
  - pattern: "eval\\("
    reason: "Used in build-time template engine, not user input"
  - pattern: "dangerouslySetInnerHTML"
    reason: "Content is sanitized by DOMPurify upstream"

# Only fix critical and high severity issues — ignore medium and low
min-severity: high

# Only fix critical issues (security emergencies)
min-severity: critical

strictness: high
fail-below: 80
min-severity: medium

fix-types:
  - security
min-severity: high
strictness: high

- uses: braedonsaunders/sloppy@main
  with:
    profile: ci

name: my-rules
description: Custom code patterns

prompt: |
  Additional scanning instructions injected into every prompt...

patterns:
  - regex: 'mySecretPattern'
    type: security
    severity: critical
    description: "Custom secret detected"
    extensions: [.ts, .js]

hooks:
  pre-scan: ./scripts/setup.sh
  post-scan: ./scripts/report.sh
  pre-fix: ./scripts/before-fix.sh
  post-fix: ./scripts/cleanup.sh

filters:
  exclude-paths:
    - "**/*.test.ts"
    - "generated/"
  exclude-types:
    - lint
  min-severity: high

- uses: braedonsaunders/sloppy@main
  with:
    gist-id: 'your-gist-id-here'
    gist-token: ${{ secrets.GIST_TOKEN }}

- uses: actions/upload-artifact@v4
  with:
    name: sloppy-dashboard
    path: .sloppy/site/