activity-core/activity-definitions/weekly-sbom-staleness.md

id, name, enabled, owner, governance, status, trigger, context_sources

id	name	enabled	owner	governance	status	trigger	context_sources
weekly-sbom-staleness	Weekly SBOM Staleness Check	true	custodian-agent	custodian	active	type cron_expression timezone misfire_policy cron 0 9 * * 1 Europe/Berlin skip	type query params bind_to state-hub repo_sbom_status repos all context.repos

Weekly SBOM Staleness Check

Runs every Monday at 09:00 Berlin time. Checks all tracked repositories for SBOM staleness and flags any repository whose SBOM is older than 30 days.

id: flag-stale-sbom
for_each: context.repos.repos
bind_as: repo
condition: 'context.repo.sbom_age_days > 30'
action:
  task_template: Run SBOM rescan for {context.repo.repo_slug}
  target_repo: context.repo.repo_slug
  priority: medium
  labels: ["sbom", "security", "automated"]

The bulk resolver exposes the per-repo entries under context.repos.repos. The rule uses explicit for_each binding so the workflow evaluates the condition once per repository and emits one task per stale repo. Action fields may reference the bound item with context.repo.*.