Skip to main content
← back to extensions

Cve Daily

@figy/cve-dailyv2026.10.26.1beta· MIT· 1d agoWORKFLOWSACCEPTED WARNINGS
01README

One daily command that scans the home fleet with every @swamp/cve extension and publishes a single HTML report at cve.x1yoga.fi.gy. WHAT IT DOES

Runs the site-specific half of the CVE fleet pipeline: syncs every @swamp/cve extension (pulling new ones and updating installed ones), inventories connected swamp workers plus the serve host plus probed/reporting fleet hosts, scans locally on workers and the serve and over SSH for the rest, and collates every scanner's result into one self-contained HTML page. Prefer it over running each scanner by hand: new scanners are included automatically, worker hosts do not need SSH, and unreachable hosts are reported instead of being silently treated as clean.

INSTALL

swamp extension pull @figy/cve-daily

DEPENDENCIES

@svendowideit/cve-fleet (discovery, inventory, planning and collation), @svendowideit/fleet-inventory (target list), @svendowideit/caddy (publish), and the @swamp/cve scanners. All are pulled or discovered at run time; the workflow depends on @svendowideit/cve-fleet.

RUN

# The daily entry point: sync, inventory, scan, collate, publish.
swamp workflow run @figy/cve-daily

# Scan and collate without re-running discovery/publish.
swamp workflow run @figy/cve-scan

# Run the generic sync/inventory upgrade path when changing config.
swamp workflow run @svendowideit/cve-fleet-upgrade

CONFIGURE

Workflow inputs: fleetModel (fleet), sshModel (pi-ssh), outputDir (~/.local/share/cve-report), retentionDays (7), includeSilent (false), extraHosts ([]), lockfiles ([deno.lock, package-lock.json]), caddyModel (my-caddy), caddyHostname (cve.x1yoga.fi.gy). Override any of them with --input, e.g. --input includeSilent=true.

UPGRADE

# Site wiring installs nothing on the host; update the workflow package,
# then let the generic extension re-sync its scanners.
swamp extension update @figy/cve-daily
swamp workflow run @svendowideit/cve-fleet-upgrade

WHAT IT INSTALLS

Nothing on the host. It runs swamp workflows and writes the report under outputDir; Caddy serves that directory at cve.x1yoga.fi.gy. No services, cron units or webhooks are installed by this extension.

02Workflows2
@figy/cve-dailybb8d77a5-a2af-4426-b531-a59b1d7098b3

Daily CVE fleet scan and report. Syncs every @swamp/cve extension (pull new, update installed), inventories connected swamp workers + the serve host + probed/reporting fleet hosts, runs the scan fan-out, collates all results into one self-contained HTML page, and publishes it through Caddy at cve.x1yoga.fi.gy. The parent owns discovery and publication; @figy/cve-scan owns the fan-out and collation. The split gives the serve reload a clean evaluation boundary, so a scanner pulled by sync in thi

syncDiscover, pull and update every @swamp/cve extension.
1.sync— Pull new scanners, update installed ones, reload serve.
inventoryBuild the worker, serve and SSH fallback target list.
1.inventory— Read worker data and fleet inventory, deduplicate targets.
scanRun the scan fan-out and collate the HTML report.
1.scan— Invoke @figy/cve-scan with the site configuration.
publishServe the report directory through Caddy.
1.publish— Ensure cve.x1yoga.fi.gy serves the report directory.
@figy/cve-scanb3443a6a-bf0b-4672-9dc5-2409d3942a96

Scan every host with every discovered @swamp/cve host scanner. Reads the catalog and target list written by @figy/cve-daily, builds a plan, runs local scans on workers and the serve host, runs SSH fallback scans for the remaining hosts, runs lockfile and research extensions, then collates everything into one HTML report. Inputs mirror @figy/cve-daily so the parent can pass its configuration through. Every scan step is allowFailure: a single unreachable host must not hide the findings from the

planBuild the executable scan plan from the catalog and targets.
1.plan— Turn the catalog and targets into fan-out items.
scan-workersRun each host scanner locally on each connected worker.
1.scan-worker-${{ self.item.id }}— Run ${{ self.item.scannerName }} locally on ${{ self.item.host }}.
scan-serveRun each host scanner locally on the serve host.
1.scan-serve-${{ self.item.id }}— Run ${{ self.item.scannerName }} locally on ${{ self.item.host }}.
scan-sshRun each host scanner's scanFleet over SSH for the fallback hosts.
1.scan-ssh-${{ self.item.id }}— Run ${{ self.item.scannerName }} over SSH.
scan-lockfilesRun every lockfile scanner against the configured lockfiles.
1.scan-lockfile-${{ self.item.id }}— Run ${{ self.item.scannerName }} on ${{ self.item.lockfilePath }}.
researchRun every research pipeline extension.
1.research-${{ self.item.id }}— Run ${{ self.item.scannerName }} research.
collateCollate every scanner result from this run into one HTML report.
1.collate— Read this run's data, write index.html/report.md/summary.json.
03Stats
A
100 / 100
Downloads
4
Archive size
6.1 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Docs keep secrets in a vault1/1earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
Repository
https://github.com/svendowideit/swamp-extensions

05Platforms