@boyingliu01/xp-gate 0.27.3 → 0.27.5

package/hooks/gate-7.sh

@@ -10,10 +10,14 @@ GATE_7_START=$(gate_start_ms)
 
 # Check if any IaC files are changed
 IAC_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null | grep -E "\.(tf|yaml|yml)$|Dockerfile" || true)
+# #536: scanned_files makes a trivial PASS (nothing to scan) auditable in the
+# quality report instead of reading like a covered security check.
+GATE_7_SCANNED_FILES=0
 if [ -z "$IAC_FILES" ]; then
   echo "✅ PASSED - No IaC files detected in changes."
   GATE_7_STATUS="PASS"
 else
+  GATE_7_SCANNED_FILES=$(printf '%s\n' "$IAC_FILES" | sed -n '/./p' | wc -l | tr -d '[:space:]')
   # Run IaC adapter. Resolution follows the documented 3-tier convention
   # (adapter-common.sh): global ~/.config/xp-gate/adapters -> project
   # githooks/adapters -> script dir. The old cwd-only test silently SKIPped

package/hooks/pre-commit

@@ -215,34 +215,60 @@ file_exists_in_subdir() {
 AUDIT_SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_ROOT_FOR_AUDIT="$(git rev-parse --show-toplevel 2>/dev/null || echo "$AUDIT_SCRIPT_DIR/../..")"
 
+# Issue #535: a failed `source` used to print one stderr line and keep going,
+# so a missing lib silently removed gate logic from the run while every gate
+# still reported PASS. Fail closed instead: abort with FATAL when the file is
+# absent or its body exits non-zero while being sourced. `exit` inside a
+# sourced file exits the SOURCING shell, so an `if ! source` wrapper cannot
+# catch it — trap EXIT for the duration of the source instead.
+source_gate_lib() {
+  local lib_file="$1"
+  if [ ! -f "$lib_file" ]; then
+    echo "FATAL: cannot load $lib_file (missing)" >&2
+    exit 1
+  fi
+  # Marker the EXIT trap compares against: only a source that never reached
+  # its end counts as a load failure. A lib calling `exit` at top level would
+  # otherwise be misread as a crash after it already did its job.
+  SOURCE_GATE_LIB_COMPLETED=""
+  local prev_trap=""
+  prev_trap="$(trap -p EXIT || true)"
+  # shellcheck disable=SC2064  # expand lib_file NOW: it is the failure target
+  trap "[ -n \"\$SOURCE_GATE_LIB_COMPLETED\" ] || { echo 'FATAL: cannot load $lib_file (source failed)' >&2; exit 1; }" EXIT
+  # shellcheck disable=SC1090  # sourcing the resolved lib is the contract here
+  source "$lib_file"
+  SOURCE_GATE_LIB_COMPLETED=1
+  eval "$prev_trap"
+}
+
 # Issue #370: source cross-platform now_ms() helper (node-preferred, regex-validated)
-source "${AUDIT_SCRIPT_DIR}/lib/now-ms.sh"
+source_gate_lib "${AUDIT_SCRIPT_DIR}/lib/now-ms.sh"
 
 # Issue #473 (+ #454): Gate 5's vitest exit-code judgement, sourced as a library
 # so the fail-closed contract is unit-testable without executing this hook.
-source "${AUDIT_SCRIPT_DIR}/lib/test-failure.sh"
+source_gate_lib "${AUDIT_SCRIPT_DIR}/lib/test-failure.sh"
 
 # Issue #477: Gate 2's jscpd config probe and outcome classification, same reason.
-source "${AUDIT_SCRIPT_DIR}/lib/jscpd-run.sh"
+source_gate_lib "${AUDIT_SCRIPT_DIR}/lib/jscpd-run.sh"
 
 # Issue #476: Gate 11's sprint-gate.sh resolution chain and decision translation.
-source "${AUDIT_SCRIPT_DIR}/lib/sprint-gate-report.sh"
+source_gate_lib "${AUDIT_SCRIPT_DIR}/lib/sprint-gate-report.sh"
 
 # Issue #523: Gate 5's Python coverage parsing and threshold verdict. The old
 # `grep -o '[0-9]*%'` never matched --format=total's bare number, so the 80%
 # branch never ran; sourced as a library so the fail-closed contract is
 # unit-testable without executing this hook.
-source "${AUDIT_SCRIPT_DIR}/lib/coverage-total.sh"
+source_gate_lib "${AUDIT_SCRIPT_DIR}/lib/coverage-total.sh"
 
 # Issue #399: Python smart test selection — strategy decision + related-test
 # lookup, kept in a library so the truth table and the path conventions are
 # unit-testable without executing this hook.
-source "${AUDIT_SCRIPT_DIR}/lib/python-test-selection.sh"
+source_gate_lib "${AUDIT_SCRIPT_DIR}/lib/python-test-selection.sh"
 
 # Issue #534: incremental Python type-check for the pre-commit python branch —
 # staged-only mypy (fast) that complements python.sh's CI-aligned full pass.
 # Kept in a library so the exit-code capture and scope handling are unit-testable.
-source "${AUDIT_SCRIPT_DIR}/lib/python-incremental-typecheck.sh"
+source_gate_lib "${AUDIT_SCRIPT_DIR}/lib/python-incremental-typecheck.sh"
 
 # Read max_duration_ms from .xp-gate-config.json (default 7200000 = 2 hours)
 _MAX_DURATION_MS=$(node -e "try{const c=JSON.parse(require('fs').readFileSync('${PROJECT_ROOT_FOR_AUDIT}/.xp-gate-config.json','utf8'));console.log((c.audit&&c.audit.max_duration_ms)||7200000);}catch(e){console.log(7200000);}" 2>/dev/null || echo "7200000")
@@ -1061,7 +1087,7 @@ else
       ; source "${AUDIT_SCRIPT_DIR}/lib/typecheck.sh" && run_typescript_typecheck )
     TS_CHECK_EXIT=$?
   else
-    source "${AUDIT_SCRIPT_DIR}/lib/typecheck.sh"
+    source_gate_lib "${AUDIT_SCRIPT_DIR}/lib/typecheck.sh"
     run_typescript_typecheck
     TS_CHECK_EXIT=$?
   fi
@@ -3264,10 +3290,14 @@ if any_changed_files_match "\.(ts|tsx|js|jsx|py|go|java|kt|cpp|c|swift|m|dart|sh
   else
     echo "⏭️  SKIPPED - SAST (gate-10.sh not found)"
     GATE_10_STATUS="SKIP"
+    GATE_10_REASON="gate_script_missing"
   fi
 else
-  echo "✅ PASSED - No code files changed, skipping SAST scan."
-  GATE_10_STATUS="PASS"
+  echo "⏭️  SKIPPED - No code files changed, skipping SAST scan."
+  # #536: "nothing to scan" is NOT "scanned and clean". Record SKIP with a
+  # reason so the quality report never renders this path as a PASS claim.
+  GATE_10_STATUS="SKIP"
+  GATE_10_REASON="no_code_files_changed"
 fi
 # ============================================================================
 
@@ -3389,6 +3419,11 @@ generate_quality_report() {
   # non-passing gates INSIDE the effective denominator only -- a skipped gate
   # is out of scope, not a failure.
   local gate_status gate_default
+  # #536: a WARN means the check could not run (typically tool_not_installed)
+  # -- degraded coverage, kept in the denominator but flagged separately so a
+  # degraded gate is never confused with a real PASS.
+  local DEGRADED_COUNT=0
+  local DEGRADED_JSON=""
   for gate in 1 2 3 4 5 6 7 8 9 10 11 12; do
     local status_var="GATE_${gate}_STATUS"
     # Default mirrors the JSON report rendering below EXACTLY (gates 1-11
@@ -3401,7 +3436,7 @@ generate_quality_report() {
     case "$gate_status" in
       PASS) PASSED_COUNT=$((PASSED_COUNT + 1)) ;;
       SKIP) SKIP_COUNT=$((SKIP_COUNT + 1)) ;;
-      WARN) WARN_COUNT=$((WARN_COUNT + 1)); NONPASS_COUNT=$((NONPASS_COUNT + 1)) ;;
+      WARN) WARN_COUNT=$((WARN_COUNT + 1)); NONPASS_COUNT=$((NONPASS_COUNT + 1)); DEGRADED_COUNT=$((DEGRADED_COUNT + 1)); DEGRADED_JSON="${DEGRADED_JSON:+$DEGRADED_JSON, }\"gate${gate}\"";;
       *) NONPASS_COUNT=$((NONPASS_COUNT + 1)) ;;
     esac
   done
@@ -3480,6 +3515,8 @@ generate_quality_report() {
     "gatesPassed": $PASSED_COUNT,
     "gatesTotal": $TOTAL_GATES,
     "gatesSkipped": $SKIP_COUNT,
+    "gatesDegraded": $DEGRADED_COUNT,
+    "degradedGates": [$DEGRADED_JSON],
     "gatesEffective": $EFFECTIVE_TOTAL,
     "effectivePassRate": $EFFECTIVE_PASS_RATE_JSON,
     "score": $SCORE_JSON,
@@ -3499,6 +3536,7 @@ generate_quality_report() {
     "gate3_complexity": {
       "name": "Cyclomatic Complexity",
       "status": "${GATE_3_STATUS:-PASS}",
+      "reason": "${GATE_3_REASON:-}",
       "threshold": "${CCN_THRESHOLD:-5}",
       "blockThreshold": "${CCN_THRESHOLD:-5}",
       "warnings": ${CC_WARNINGS:-0}
@@ -3506,6 +3544,7 @@ generate_quality_report() {
     "gate4_principles": {
       "name": "Clean Code + SOLID",
       "status": "${GATE_4_STATUS:-PASS}",
+      "reason": "${GATE_4_REASON:-}",
       "warnings": ${WARNING_COUNT:-0}
     },
     "gate5_tests": {
@@ -3524,6 +3563,7 @@ generate_quality_report() {
     "gate7_iac_security": {
       "name": "IaC Security Scanning",
       "status": "${GATE_7_STATUS:-PASS}",
+      "scanned_files": ${GATE_7_SCANNED_FILES:-0},
       "tools": "checkov, hadolint, kube-score, tflint"
     },
     "gate8_secret_scanning": {
@@ -3539,6 +3579,8 @@ generate_quality_report() {
     "gate10_sast": {
       "name": "SAST Security Scan",
       "status": "${GATE_10_STATUS:-PASS}",
+      "reason": "${GATE_10_REASON:-}",
+      "scanned_files": ${GATE_10_SCANNED_FILES:-0},
       "tool": "semgrep"
     },
     "gate11_sprint_flow": {