[golanglemonade]

(originally wrote in harmonize, ported to core + translated to gala events + listeners)

• Adds a gemini integration
• Adds support for soc2 report parsing via a gemini runtime integration + scan setup
  • Takes a soc2 report and:
    • validates it is a soc 2 report
    • runs through model armor if using the type vertex to ensure there is no prompt injectino
    • Attempts to pull out: controls, reviews, findings, vendors, assets, groups, domains for the soc 2
    • UI work to be done, but will allow user to review + import the data similar to the domain scan today
    • Can just be run on certain object types instead of all if wanted
    • Notifies user via email + in-app notification when its completed
    • restricts run to once every 24 hours to prevent abuse
• Moves notifications to gala + adds email notifications to work with the notify spec (with entx update)
  • when channel is not set on a notification, it will always go to IN-APP, if it is set, the settings are respected (e.g. in-app, email goes to both)
  • internal/ent/hooks/listeners_notification_delivery.go now handles in-app notification delivery
  • internal/ent/hooks/listeners_notification_email.go handles email notifications sent via the NotifySpec. I have not migrated any existing email delivery to this as part of this pr.
    • Batch can be used to send email to all users in one email send with the resend BatchSend. These cannot use personalized emails for each user, all emails sent will be identical.
    • today this is handled off the notify spec, and not its own listener off the table. I want to change this around some, but would prefer to do that in a PR just about email notifications and not grouped here
• new ScanOrigin field - looking at using this to restrict how certain scans are created to prevent something like a soc2 report scan to be done via a direct API request, for now its just informational
• adds a new REPORT_SCAN type
• prompts will be stored in configs, rather than in-repo to make adjustments easier
• adds a jobtimeout override for jobs that need longer than 15 minutes to run (these originally did but ended up delegating differently, splitting up reviews based on found controls first)
• pulls in the RowMatch feature from entx to use for notification spec here when only the status changes but we want a notification specific to other fields
• local test ui so I could test easier before frontend was built
• adds ability to add tables to emails

example: (report name redacted)

depends on: theopenlane/entx#337

[theopenlane-bender]

🔧 Configuration Changes Detected

This PR contains changes that will affect the Helm chart configuration. A draft infrastructure PR has been automatically created to preview these changes:

📋 Draft PR: https://github.com/theopenlane/openlane-infra/pull/1272

Changes Preview:

✅ Updated ConfigMap template

• 🔄 Merged Helm values.yaml
• 🔐 External secrets configuration updated
• ✅ Updated ConfigMap template

The draft infrastructure PR will be closed automatically after this core PR is merged.