Feature/honest readmes

.github/workflows/gitgalaxy.yml

@@ -1,53 +1,116 @@
 name: GitGalaxy Zero-Trust Pipeline
 
 on:
-  push:
-    branches: [main]
   pull_request:
     branches: [main]
+  push:
+    branches: [main]
 
 permissions:
   contents: read
 
 jobs:
+  # ============================================================
+  # PRE-GATE — runs on every PR, blocks the merge on failure.
+  # Fast; no heavy ML/graph dependencies installed.
+  # ============================================================
   vault-sentinel:
+    if: github.event_name == 'pull_request'
     name: Vault Sentinel
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-
       - uses: ./
         with:
           tool: vault-sentinel
           target: .
           version: local
 
   xray-inspector:
+    if: github.event_name == 'pull_request'
     name: X-Ray Inspector
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-
       - uses: ./
         with:
           tool: xray-inspector
           target: .
           version: local
 
   supply-chain-firewall:
+    if: github.event_name == 'pull_request'
     name: Supply Chain Firewall
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-
       - uses: ./
         with:
           tool: supply-chain-firewall
           target: .
-          version: local
+          version: local
+
+  # ============================================================
+  # POST-GATE — runs only once code is on main (merge or direct
+  # push). One galaxyscope pass produces all 6 outputs; we route
+  # 3 of them and let the rest live only in the ephemeral runner.
+  # --fail-on-malware stays on here too, as a safety net in case
+  # branch protection is ever bypassed.
+  # ============================================================
+  full-report:
+    if: github.event_name == 'push'
+    name: Full Report (SARIF, SBOM, LLM Brief)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write        # commits the LLM brief back to docs/
+      security-events: write # uploads SARIF to the Security tab
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Setup Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+          cache: "pip"
+
+      - name: Install GitGalaxy & Full Precision Engines
+        run: |
+          python -m pip install --upgrade pip
+          pip install gitgalaxy networkx tiktoken xgboost pandas numpy
+
+      - name: Run GalaxyScope (single pass — all 6 outputs)
+        env:
+          GITGALAXY_LICENSE_KEY: "COMMUNITY_FREE_TIER"
+        run: |
+          galaxyscope . --config .galaxyscope.yaml --fail-on-malware --output gitgalaxy-results
+
+      - name: Upload SARIF to GitHub Security Tab
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        with:
+          sarif_file: gitgalaxy-results_sarif.json
+
+      - name: Upload SBOM as Build Artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: gitgalaxy-sbom
+          path: gitgalaxy-results_sbom.json
+
+      - name: Commit LLM Brief to Docs
+        run: |
+          mkdir -p docs
+          mv *_galaxy_llm.md docs/gitgalaxy_architecture_brief.md
+
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add docs/gitgalaxy_architecture_brief.md
+          git diff --quiet && git diff --staged --quiet || (git commit -m "docs: auto-update LLM architectural brief" && git push)

action.yml

@@ -1,5 +1,5 @@
 name: 'GitGalaxy Scanner'
-description: 'High-velocity, AST-free DevSecOps scanner for zero-trust CI/CD, SBOMs, secret detection, and supply chain security.'
+description: 'Repo intelligence for humans and AI, without compilation: architecture mapping, risk scoring, and SBOM/SARIF generation for zero-trust CI/CD — SARIF output is ready for upload to security dashboard.'
 branding:
   icon: 'shield'
   color: 'purple'

templates/azure/azure-pipelines.yml

@@ -10,51 +10,92 @@ trigger:
       - v*
 
 variables:
-  GG_TOOL: 'galaxyscope'
-  GG_TARGET: '.'
-  GG_ARGS: '--config .galaxyscope.yaml --max-risk-exposure 120 --fail-on-malware --sarif-only --output $(Build.ArtifactStagingDirectory)/gitgalaxy-results.json'
   PIP_CACHE_DIR: '$(Pipeline.Workspace)/.pip-cache'
   GITGALAXY_LICENSE_KEY: 'COMMUNITY_FREE_TIER'
 
 stages:
 - stage: SecurityScan
   displayName: 'GitGalaxy Zero-Trust Audit'
   jobs:
-  - job: RunGalaxyScope
-    displayName: 'GalaxyScope Static Analysis'
+
+  - job: VaultSentinel
+    displayName: 'Vault Sentinel'
     pool:
       vmImage: 'ubuntu-latest'
     steps:
     - task: UsePythonVersion@0
       inputs:
         versionSpec: '3.12'
-      displayName: 'Initialize Python Environment'
+    - script: |
+        python -m pip install --upgrade pip
+        pip install gitgalaxy
+      displayName: 'Install GitGalaxy'
+    - checkout: self
+      fetchDepth: 0
+    - script: vault-sentinel .
+      displayName: 'Run Vault Sentinel'
 
+  - job: XrayInspector
+    displayName: 'X-Ray Inspector'
+    pool:
+      vmImage: 'ubuntu-latest'
+    steps:
+    - task: UsePythonVersion@0
+      inputs:
+        versionSpec: '3.12'
+    - script: |
+        python -m pip install --upgrade pip
+        pip install gitgalaxy
+      displayName: 'Install GitGalaxy'
+    - checkout: self
+      fetchDepth: 0
+    - script: xray-inspector .
+      displayName: 'Run X-Ray Inspector'
+
+  - job: SupplyChainFirewall
+    displayName: 'Supply Chain Firewall'
+    pool:
+      vmImage: 'ubuntu-latest'
+    steps:
+    - task: UsePythonVersion@0
+      inputs:
+        versionSpec: '3.12'
+    - script: |
+        python -m pip install --upgrade pip
+        pip install gitgalaxy
+      displayName: 'Install GitGalaxy'
+    - checkout: self
+      fetchDepth: 0
+    - script: supply-chain-firewall .
+      displayName: 'Run Supply Chain Firewall'
+
+  - job: GalaxyScopeReport
+    displayName: 'GalaxyScope Reporting (SARIF + ML Malware Gate)'
+    pool:
+      vmImage: 'ubuntu-latest'
+    steps:
+    - task: UsePythonVersion@0
+      inputs:
+        versionSpec: '3.12'
     - task: Cache@2
       inputs:
         key: 'pip | "$(Agent.OS)"'
         path: $(PIP_CACHE_DIR)
         cacheHitVar: PIP_CACHE_RESTORED
       displayName: 'Configure Dependency Caching'
-
     - script: |
         python -m pip install --upgrade pip
         pip install gitgalaxy networkx tiktoken xgboost pandas numpy
       displayName: 'Install GitGalaxy & Heavy Physics Engines'
-
     - checkout: self
       fetchDepth: 0
-      displayName: 'Checkout Repository (Full Depth)'
-
     - script: |
-        echo "Running: $(GG_TOOL) $(GG_TARGET)$(GG_ARGS)"
-        $(GG_TOOL) $(GG_TARGET)$(GG_ARGS)
+        galaxyscope . --config .galaxyscope.yaml --fail-on-malware --sarif-only --output $(Build.ArtifactStagingDirectory)/gitgalaxy-results.json
       displayName: 'Execute Zero-Trust Spectral Audit'
-
     - task: PublishPipelineArtifact@1
       inputs:
         targetPath: '$(Build.ArtifactStagingDirectory)/gitgalaxy-results_sarif.json'
         artifact: 'GitGalaxySecurityLogs'
         publishLocation: 'pipeline'
       displayName: 'Upload SARIF Security Metrics'
-      condition: always()
+      condition: always()