chore: manage development services with Compose

.gitignore

@@ -1,4 +1,5 @@
 node_modules/
+.pnpm-store/
 dist/
 __pycache__/
 .pytest_cache/

.ona/automations.yml

@@ -12,10 +12,26 @@ tasks:
       pnpm --dir sdk/typescript install --frozen-lockfile
       npm ci --prefix plugins/codex-security/mcp-app --no-audit --no-fund
       python -m pip install --disable-pip-version-check --no-input -e 'plugins/codex-security[test]'
+      docker compose build codex-security findings
     triggeredBy:
       - manual
       - prebuild
 
+  compose-up:
+    name: Compose up
+    command: docker compose up --detach --no-build && ona environment port open 3000 --name findings --admission creator_only
+    dependsOn:
+      - install
+    triggeredBy:
+      - manual
+      - postDevcontainerStart
+
+  compose-down:
+    name: Compose down
+    command: docker compose down
+    triggeredBy:
+      - manual
+
   build:
     name: Build
     command: pnpm --dir sdk/typescript run build

compose.yaml

@@ -1,9 +1,12 @@
 services:
   codex-security:
     image: ${CODEX_SECURITY_IMAGE:-codex-security:local}
+    profiles:
+      - scan
     build:
       context: .
     init: true
+    network_mode: host
     user: ${CODEX_SECURITY_USER:-10001:10001}
     cap_drop:
       - ALL
@@ -38,3 +41,19 @@ services:
       - /input/repositories.csv
       - --output-dir
       - /output
+
+  findings:
+    image: ${CODEX_SECURITY_FINDINGS_IMAGE:-codex-security-findings:local}
+    build:
+      context: .
+      target: findings-service
+    init: true
+    network_mode: host
+    environment:
+      OPENAI_API_KEY:
+      CODEX_API_KEY:
+    volumes:
+      - findings-state:/state
+
+volumes:
+  findings-state: