skip to content
iii / worker
$worker

security-scan

v0.1.5

Report-only security reviews of operator-configured repositories at immutable Git commits, dispatched through a read-only Harness policy.

iiiverified
0 installs0 in 7d0 today
install
$iii trigger compose::add worker=security-scan@0.1.5
binarylicense: Apache-2.0code-reviewgitscanningsecuritysupply-chain
  • macOS: arm64 · x64
  • Linux: arm64 · armv7 · x64
  • Windows: arm64 · x64 · x86
15functions0triggers0skills10depsv0.1.5version
repoiii-hq/workers

exact versions are immutable; binary and bundle artifacts are digest-pinned.

functions

15

security-scan::action

function

Start an approval-gated GitHub issue or draft fix PR for one validated Harness finding. Duplicate run, finding, and action requests return the same action id.

request
  • actionstringrequiredenum: issue, fix_pr
  • finding_indexinteger· uint32requiredmin 0
  • run_idstringrequired
response
  • actionstringrequiredenum: issue, fix_pr
  • action_idstringrequired
  • deduplicatedbooleanrequired
  • finding_indexinteger· uint32requiredmin 0
  • run_idstringrequired
  • statusstringrequiredenum: queued, preparing, awaiting_approval, completed, failed, cancelled

security-scan::action-commit

function

Commit the current fix action through its checkout-bound capability.

request
  • action_idstringrequired
  • capabilitystringrequired
  • messagestringrequired
response
  • commit_shastringrequired

security-scan::action-execute

function

Internal durable queue step for approval-gated GitHub issue and draft PR publication.

request
  • action_idstringrequired
  • attemptinteger· uint32requiredmin 0
  • run_idstringrequired
  • stepinteger· uint64requiredmin 0
response
  • skippedbooleanrequired
  • statusstringrequiredenum: queued, preparing, awaiting_approval, completed, failed, cancelled
  • stepinteger· uint64requiredmin 0

security-scan::action-push

function

Push the current fix action through its checkout-bound capability.

request
  • action_idstringrequired
  • capabilitystringrequired
response
  • branchstringrequired

security-scan::action-read

function

Read a durable security-scan GitHub action without exposing internal checkout paths or Harness session identifiers.

request
  • action_idstringrequired
response
  • actionany of
    any of (2)
    variant 1
    • actionstringrequiredenum: issue, fix_pr
    • action_idstringrequired
    • attemptinteger· uint32requiredmin 0
    • completed_atinteger· int64
    • created_atinteger· int64required
    • errorany of
      … expand 2 nested
      any of (2)
      variant 1
      • codestringrequired
      • messagestringrequired
      • retryablebooleanrequired
      variant 2
      valuenull
    • finding_indexinteger· uint32requiredmin 0
    • repositorystringrequired
    • resultany of
      … expand 2 nested
      any of (2)
      variant 1
      • branchstring
      • commit_shastring
      • draftboolean
      • kindstringrequired
      • urlstringrequired
      • validationstring
      variant 2
      valuenull
    • run_idstringrequired
    • schema_versionstringrequired
    • statusstringrequiredenum: queued, preparing, awaiting_approval, completed, failed, cancelled
    • target_shastringrequired
    • updated_atinteger· int64required
    variant 2
    valuenull

security-scan::analysis-chat

function

Make a run's Harness review discoverable through session metadata and report whether it is available, without returning the private session identifier.

request
  • run_idstringrequired
response
  • availablebooleanrequired

security-scan::cancel

function

Stop an in-flight security-scan run. Queued and materializing runs are marked cancelled; analyzing runs stop the Harness turn and clean up the isolated checkout.

request
  • run_idstringrequired
response
  • deduplicatedbooleanrequired
  • run_idstringrequired
  • statusstringrequiredenum: queued, materializing, materialized, dispatching, analyzing, completed, …

security-scan::execute

function

Internal durable queue step for target materialization and read-only Harness dispatch.

request
  • attemptinteger· uint32requiredmin 0
  • repositorystringrequired
  • run_idstringrequired
  • stepinteger· uint64requiredmin 0
response
  • skippedbooleanrequired
  • statusstringrequiredenum: queued, materializing, materialized, dispatching, analyzing, completed, …
  • stepinteger· uint64requiredmin 0

security-scan::list

function

List security-scan runs as sanitized lightweight summaries, newest update first. Optional repository and status filters are applied before the bounded result limit.

request
  • limitinteger· uint32min 0
  • repositorystring
  • statusany of
    any of (2)
    variant 1
    valuestringenum: queued, materializing, materialized, dispatching, analyzing, completed, …
    variant 2
    valuenull
response
  • runsobject[]required
    • attemptinteger· uint32requiredmin 0
    • completed_atinteger· int64
    • created_atinteger· int64required
    • errorany of
      any of (2)
      variant 1
      • codestringrequired
      • messagestringrequired
      • retryablebooleanrequired
      variant 2
      valuenull
    • finding_countinteger· uint32requiredmin 0
    • modestringrequiredenum: scan, suggest
    • modelstring
    • repositorystringrequired
    • resolved_from_headboolean
    • run_idstringrequired
    • statusstringrequiredenum: queued, materializing, materialized, dispatching, analyzing, completed, …
    • target_shastringrequired
    • updated_atinteger· int64required

security-scan::on-schedule

function

Internal UTC cron target that uses invocation metadata only to look up an operator-configured repository schedule, resolves its local Git ref at fire time, and queues the exact commit through security-scan::request.

request
  • actual_timestringrequired
  • job_idstringrequired
  • scheduled_timestringrequired
  • triggerstringrequired
response
  • deduplicatedbooleanrequired
  • modestringrequiredenum: scan, suggest
  • repositorystringrequired
  • run_idstringrequired
  • statusstringrequiredenum: queued, materializing, materialized, dispatching, analyzing, completed, …
  • target_shastringrequired

security-scan::on-turn-completed

function

Internal Harness completion doorbell that validates and checkpoints a structured report.

request
  • reasonstring
  • resultunknown
  • result_errorstring
  • session_idstring
  • statusstring
  • terminalboolean
  • turn_idstring
response
  • statusany of
    any of (2)
    variant 1
    valuestringenum: queued, materializing, materialized, dispatching, analyzing, completed, …
    variant 2
    valuenull
  • wokebooleanrequired

security-scan::read

function

Read a security-scan run and its validated report without exposing internal checkout paths or Harness session identifiers.

request
  • run_idstringrequired
response
  • runany of
    any of (2)
    variant 1
    • attemptinteger· uint32requiredmin 0
    • completed_atinteger· int64
    • created_atinteger· int64required
    • errorany of
      … expand 2 nested
      any of (2)
      variant 1
      • codestringrequired
      • messagestringrequired
      • retryablebooleanrequired
      variant 2
      valuenull
    • modestringrequiredenum: scan, suggest
    • modelstring
    • reportany of
      … expand 2 nested
      any of (2)
      variant 1
      • assessmentsobjectrequired
        … expand 4 nested
        • dependenciesobjectrequired
          … expand 2 nested
          • reasonstring
          • statusstringrequiredenum: assessed, not_assessed, unknown
        • secretsobjectrequired
          … expand 2 nested
          • reasonstring
          • statusstringrequiredenum: assessed, not_assessed, unknown
        • supply_chainobjectrequired
          … expand 2 nested
          • reasonstring
          • statusstringrequiredenum: assessed, not_assessed, unknown
        • vulnerabilitiesobjectrequired
          … expand 2 nested
          • reasonstring
          • statusstringrequiredenum: assessed, not_assessed, unknown
      • findingsobject[]required
        … expand 8 nested
        • descriptionstringrequired
        • evidencestringrequired
        • locationany of
          … expand 2 nested
          any of (2)
          variant 1
          • line_endinteger· uint64min 0
          • line_startinteger· uint64min 0
          • pathstringrequired
          variant 2
          valuenull
        • remediationstringrequired
        • rule_idstringrequired
        • severitystringrequiredenum: critical, high, medium, low, info
        • suggested_patchstring
        • titlestringrequired
      • summarystringrequired
      variant 2
      valuenull
    • repositorystringrequired
    • resolved_from_headboolean
    • run_idstringrequired
    • schema_versionstringrequired
    • statusstringrequiredenum: queued, materializing, materialized, dispatching, analyzing, completed, …
    • target_shastringrequired
    • updated_atinteger· int64required
    variant 2
    valuenull

security-scan::reconciliation

function

Read or refresh a persisted, sanitized comparison of one Harness report with separately counted Dependabot and code-scanning snapshots. Supports bounded source, severity, lifecycle, and cursor filters; never reports a combined unique total.

request
  • cursorstring
  • lifecycleany of
    any of (2)
    variant 1
    valuestringenum: open
    variant 2
    valuenull
  • limitinteger· uint32min 0
  • refreshboolean
  • run_idstringrequired
  • severityany of
    any of (2)
    variant 1
    valuestringenum: critical, high, medium, low, info
    variant 2
    valuenull
  • sourceany of
    any of (2)
    variant 1
    valuestringenum: dependabot, code_scanning
    variant 2
    valuenull
response
  • github_repositorystring
  • harnessobjectrequired
    • scopestringrequiredenum: exact_commit, repository_default_branch, repository_snapshot
    • statusstringrequiredenum: verified, not_available
    • verified_atinteger· int64
    • verified_countinteger· uint32min 0

      Validated Harness report findings. This is never added to GitHub source counts.

  • matchingobjectrequired
    • matched_recordsinteger· uint32min 0

      Present only when exact structured identifiers produced matches.

    • statusstringrequiredenum: available, unavailable
  • next_cursorstring
  • recordsobject[]required
    • descriptionstringrequired
    • end_lineinteger· uint64min 0
    • lifecyclestringrequiredenum: open
    • numberinteger· uint64requiredmin 0
    • observed_atstring
    • pathstring
    • public_urlstringrequired

      Reconstructed public github.com URL. Dependency-provided URLs are never persisted.

    • scopestringrequiredenum: exact_commit, repository_default_branch, repository_snapshot
    • severitystringrequiredenum: critical, high, medium, low, info
    • sourcestringrequiredenum: dependabot, code_scanning
    • start_lineinteger· uint64min 0
    • structured_idsstring[]

      Exact source identifiers only, such as GHSA, CVE, or scanner rule IDs.

    • titlestringrequired
  • repositorystringrequired
  • run_idstringrequired
  • schema_versionstringrequired
  • sourcesobject[]required
    • collected_atinteger· int64

      Collection time in Unix milliseconds. Null means the source was not queried.

    • healthobjectrequired
      • commit_shastring
      • observed_atstring
      • statusstringrequiredenum: healthy, warning, error, unknown
      • toolstring
    • record_countinteger· uint32min 0

      Number of normalized records when collection returned usable data. Null is unavailable/not-collected and is deliberately distinct from zero.

    • scopestringrequiredenum: exact_commit, repository_default_branch, repository_snapshot
    • sourcestringrequiredenum: dependabot, code_scanning
    • statusstringrequiredenum: complete, partial, unavailable, authentication_required, permission_denied, disabled, …
  • target_shastringrequired

security-scan::request

function

Queue a report-only security review of an operator-configured repository at an exact 40-character commit SHA; omit target_sha to review HEAD. Duplicate repository, commit, mode and model requests return the same run id.

request
  • modestringrequiredenum: scan, suggest
  • modelstring

    Catalog model id from the Console composer. Omitted requests use operator `analysis.model`.

  • providerstring

    Optional explicit provider. Omitted when `model` is a catalog id such as `deepseek::…`.

  • repositorystringrequired
  • target_shastring

    Exact 40-character commit SHA. Omit or leave empty to analyze the entire repository at HEAD.

response
  • deduplicatedbooleanrequired
  • run_idstringrequired
  • statusstringrequiredenum: queued, materializing, materialized, dispatching, analyzing, completed, …

security-scan::ui-content

function

Serve the security-scan worker's injected console UI assets (content function for its console:script / console:style triggers).

request
  • pathstringrequired

    The asset path from the trigger config (e.g. `state/page.js`).

response
  • contentstringrequired

    The asset source, verbatim.

  • content_typestringrequired

    MIME type the console should serve the asset with.

triggers

0
no triggers registered