# agent.yaml
agent:
  name: my-scanner
  region: ap-southeast-1
  enable_commands: true
  command_poll_interval: 30s
  heartbeat_interval: 1m

server:
  base_url: https://api.exploop.io
  api_key: your-api-key
  agent_id: your-agent-uuid

scanners:
  - name: semgrep
    enabled: true
    config:
      dataflow_traces: true  # Enable taint tracking (default)
  - name: gitleaks
    enabled: true
  - name: trivy-fs
    enabled: true

# Retry queue for network resilience
retry_queue:
  enabled: true
  interval: 5m
  max_attempts: 10

# Targets for standalone mode
targets:
  - /path/to/project1
  - /path/to/project2

# docker-compose.yml
version: "3.8"
services:
  exploop-agent:
    image: exploopio/agent:latest
    container_name: exploop-agent
    restart: unless-stopped
    environment:
      - API_URL=https://api.exploop.io
      - API_KEY=${EXPLOOP_API_KEY}
      - AGENT_ID=${REDIVER_AGENT_ID}
      - REGION=ap-southeast-1
    command: ["-daemon", "-enable-commands", "-verbose"]

# .github/workflows/security-scan.yml
name: Security Scan

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Security Scan
        uses: docker://exploopio/agent:ci
        env:
          API_URL: ${{ secrets.EXPLOOP_API_URL }}
          API_KEY: ${{ secrets.EXPLOOP_API_KEY }}
          AGENT_ID: ${{ secrets.REDIVER_AGENT_ID }}
        with:
          args: -tools semgrep,gitleaks,trivy-fs -target . -push -comments

name: Security Scan

on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Download Agent
        run: |
          curl -sSL https://github.com/exploopio/agent/releases/latest/download/agent_linux_amd64.tar.gz | tar xz
          chmod +x agent

      - name: Run Scan
        env:
          API_URL: ${{ secrets.EXPLOOP_API_URL }}
          API_KEY: ${{ secrets.EXPLOOP_API_KEY }}
          AGENT_ID: ${{ secrets.REDIVER_AGENT_ID }}
        run: ./agent -tools semgrep,gitleaks,trivy-fs -target . -push -comments

# .gitlab-ci.yml
security-scan:
  stage: test
  image: exploopio/agent:ci
  variables:
    API_URL: $EXPLOOP_API_URL
    API_KEY: $EXPLOOP_API_KEY
    AGENT_ID: $REDIVER_AGENT_ID
  script:
    - agent -tools semgrep,gitleaks,trivy-fs -target . -push -comments
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

apiVersion: v1
kind: Secret
metadata:
  name: exploop-agent-secret
  namespace: security
type: Opaque
stringData:
  api-key: "your-api-key"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: exploop-agent
  namespace: security
spec:
  replicas: 1
  selector:
    matchLabels:
      app: exploop-agent
  template:
    metadata:
      labels:
        app: exploop-agent
    spec:
      containers:
        - name: agent
          image: exploopio/agent:latest
          args: ["-daemon", "-enable-commands", "-verbose"]
          env:
            - name: API_URL
              value: "https://api.exploop.io"
            - name: API_KEY
              valueFrom:
                secretKeyRef:
                  name: exploop-agent-secret
                  key: api-key
            - name: AGENT_ID
              value: "your-worker-id"
            - name: REGION
              value: "ap-southeast-1"
          resources:
            requests:
              memory: "256Mi"
              cpu: "100m"
            limits:
              memory: "1Gi"
              cpu: "1000m"

apiVersion: batch/v1
kind: CronJob
metadata:
  name: exploop-scan
  namespace: security
spec:
  schedule: "0 2 * * *"  # Daily at 2 AM
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: agent
              image: exploopio/agent:ci
              args:
                - "-tools"
                - "semgrep,gitleaks,trivy-fs"
                - "-target"
                - "/code"
                - "-push"
              env:
                - name: API_URL
                  value: "https://api.exploop.io"
                - name: API_KEY
                  valueFrom:
                    secretKeyRef:
                      name: exploop-agent-secret
                      key: api-key
              volumeMounts:
                - name: code
                  mountPath: /code
                  readOnly: true
          volumes:
            - name: code
              persistentVolumeClaim:
                claimName: source-code-pvc
          restartPolicy: OnFailure