@codyswann/lisa 1.51.4 → 1.52.0

package/typescript/copy-overwrite/.github/workflows/quality.yml

@@ -1,2049 +0,0 @@
-# This file is managed by Lisa.
-# Do not edit directly — changes will be overwritten on the next `lisa` run.
-# -----------------------------------------------------------------------------
-# Quality Checks Workflow
-# -----------------------------------------------------------------------------
-# ⚠️ WARNING: THIS FILE IS AUTO-GENERATED. DO NOT EDIT MANUALLY! ⚠️
-# Any changes may be overwritten by the generation process.
-# This workflow runs various quality checks on the codebase including:
-# - Linting
-# - Type checking
-# - Unit tests
-# - Format checking
-# - Build verification
-# - Security scanning
-# - AI-powered code quality and security analysis (non-blocking)
-# - Enterprise security tools:
-#   - SonarCloud SAST analysis
-#   - Snyk dependency vulnerability scanning
-#   - GitGuardian secret detection
-#   - FOSSA license compliance checking
-#   - OWASP ZAP DAST baseline scanning
-# - E2E testing:
-#   - Playwright web E2E tests (auto-detects playwright.config.ts)
-#   - Maestro Cloud mobile E2E tests (requires MAESTRO_API_KEY, project ID, and app binary)
-#
-# Example usage in another workflow:
-# ```yaml
-# quality:
-#   uses: ./.github/workflows/quality.yml
-#   with:
-#     node_version: '22.21.1'
-#     package_manager: 'npm'
-#     skip_jobs: 'npm_security_scan,sonarcloud,snyk'
-#   secrets:
-#     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}  # For SonarCloud SAST
-#     SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}  # For Snyk dependency scanning
-#     GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}  # For secret detection
-#     FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}  # For license compliance
-#     MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}  # For Maestro Cloud E2E
-# ```
-
-name: 🔍 Quality Checks
-
-on:
-  workflow_call:
-    inputs:
-      node_version:
-        description: 'Node.js version to use'
-        required: false
-        default: '22.21.1'
-        type: string
-      package_manager:
-        description: 'Package manager to use (npm, yarn, or bun)'
-        required: false
-        default: 'npm'
-        type: string
-      skip_jobs:
-        description: 'Jobs to skip (comma-separated: lint,lint_slow,typecheck,test,test:unit,test:integration,test:e2e,maestro_e2e,playwright_e2e,format,build,dead_code,sg_scan,npm_security_scan,zap_baseline,github_issue)'
-        required: false
-        default: ''
-        type: string
-      zap_target_url:
-        description: 'Target URL for OWASP ZAP baseline scan (leave empty to skip ZAP)'
-        required: false
-        default: ''
-        type: string
-      zap_rules_file:
-        description: 'Path to ZAP rules configuration file'
-        required: false
-        default: '.zap/baseline.conf'
-        type: string
-      working_directory:
-        description: 'Directory to run commands in (if not root)'
-        required: false
-        default: ''
-        type: string
-      compliance_framework:
-        description: 'Compliance framework to validate against (none, soc2, iso27001, hipaa, pci-dss)'
-        required: false
-        default: 'none'
-        type: string
-      require_approval:
-        description: 'Require approval for production deployments (uses GitHub environments)'
-        required: false
-        default: false
-        type: boolean
-      audit_retention_days:
-        description: 'Number of days to retain audit logs'
-        required: false
-        default: 90
-        type: number
-      generate_evidence_package:
-        description: 'Generate compliance evidence package for audits'
-        required: false
-        default: false
-        type: boolean
-      approval_environment:
-        description: 'GitHub environment name for approval gate (must exist in repo settings). Set to empty string to skip even when require_approval is true.'
-        required: false
-        default: 'production'
-        type: string
-      maestro_app_file:
-        description: 'Path to app binary for Maestro Cloud E2E tests (e.g., app-release.apk or App.app). Required for Maestro tests to run.'
-        required: false
-        default: ''
-        type: string
-      maestro_workspace:
-        description: 'Path to Maestro workspace directory containing test flows (default: .maestro)'
-        required: false
-        default: '.maestro'
-        type: string
-      maestro_include_tags:
-        description: 'Comma-separated tags to include in Maestro test run (e.g., smoke,critical)'
-        required: false
-        default: ''
-        type: string
-      maestro_project_id:
-        description: 'Maestro Cloud project ID. Required for Maestro tests to run.'
-        required: false
-        default: ''
-        type: string
-    secrets:
-      SONAR_TOKEN:
-        description: 'SonarCloud token for SAST analysis'
-        required: false
-      SNYK_TOKEN:
-        description: 'Snyk token for dependency vulnerability scanning'
-        required: false
-      GITGUARDIAN_API_KEY:
-        description: 'GitGuardian API key for secret detection'
-        required: false
-      FOSSA_API_KEY:
-        description: 'FOSSA API key for license compliance checking'
-        required: false
-      MAESTRO_API_KEY:
-        description: 'Maestro Cloud API key for mobile E2E testing'
-        required: false
-
-# Concurrency is managed by the parent workflow that calls this one
-# This avoids deadlocks between parent and child workflows
-
-jobs:
-  # Central dependency installation job to optimize performance
-  install_dependencies:
-    name: 📦 Install Dependencies
-    runs-on: ubuntu-latest
-    outputs:
-      cache-key: ${{ steps.cache.outputs.cache-key }}
-      cache-hit: ${{ steps.cache.outputs.cache-hit }}
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 🔑 Generate cache key
-        id: cache
-        run: |
-          if [ -f "package-lock.json" ]; then
-            echo "cache-key=${{ runner.os }}-node-${{ inputs.node_version }}-npm-${{ hashFiles('package-lock.json') }}" >> $GITHUB_OUTPUT
-          elif [ -f "yarn.lock" ]; then
-            echo "cache-key=${{ runner.os }}-node-${{ inputs.node_version }}-yarn-${{ hashFiles('yarn.lock') }}" >> $GITHUB_OUTPUT
-          elif [ -f "bun.lockb" ]; then
-            echo "cache-key=${{ runner.os }}-node-${{ inputs.node_version }}-bun-${{ hashFiles('bun.lockb') }}" >> $GITHUB_OUTPUT
-          else
-            echo "cache-key=${{ runner.os }}-node-${{ inputs.node_version }}-${{ inputs.package_manager }}-${{ hashFiles('package.json') }}" >> $GITHUB_OUTPUT
-          fi
-
-      - name: 📦 Cache node_modules
-        id: cache-modules
-        uses: actions/cache@v4
-        with:
-          path: |
-            node_modules
-            ~/.npm
-            ~/.yarn/cache
-            ~/.bun/install/cache
-          key: ${{ steps.cache.outputs.cache-key }}
-          restore-keys: |
-            ${{ runner.os }}-node-${{ inputs.node_version }}-${{ inputs.package_manager }}-
-            ${{ runner.os }}-node-${{ inputs.node_version }}-
-            ${{ runner.os }}-node-
-
-      - name: 📥 Install dependencies
-        if: steps.cache-modules.outputs.cache-hit != 'true'
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          else
-            echo "Unsupported package manager: ${{ inputs.package_manager }}"
-            exit 1
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 📤 Upload dependencies artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: node-modules-${{ github.run_id }}
-          path: |
-            node_modules
-            package.json
-            package-lock.json
-            yarn.lock
-            bun.lockb
-          retention-days: 1
-          if-no-files-found: error
-
-      - name: 📊 Cache status
-        run: |
-          echo "cache-hit=${{ steps.cache-modules.outputs.cache-hit }}" >> $GITHUB_OUTPUT
-        id: cache-status
-  lint:
-    name: 🧹 Lint
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    if: ${{ !contains(inputs.skip_jobs, 'lint') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📥 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-
-      - name: 🧹 Run linter
-        run: ${{ inputs.package_manager }} run lint
-        env:
-          NODE_OPTIONS: --max-old-space-size=6144
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-  lint_slow:
-    name: 🐢 Slow Lint Rules
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: ${{ !contains(inputs.skip_jobs, 'lint_slow') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📥 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🐢 Run slow lint rules
-        run: ${{ inputs.package_manager }} run lint:slow
-        env:
-          NODE_OPTIONS: --max-old-space-size=6144
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-  typecheck:
-    name: 🔍 Type Check
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    if: ${{ !contains(inputs.skip_jobs, 'typecheck') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔍 Run type check
-        run: ${{ inputs.package_manager }} run typecheck
-        env:
-          NODE_OPTIONS: --max-old-space-size=6144
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-  test:
-    name: 🧪 Run Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: ${{ !contains(inputs.skip_jobs, 'test') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🧪 Run tests
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm test
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn test
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun run test
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-  test_unit:
-    name: 🧪 Run Unit Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    if: ${{ !contains(inputs.skip_jobs, 'test:unit') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔍 Check for test:unit script
-        id: check_script
-        run: |
-          if [ -f "package.json" ]; then
-            if grep -q '"test:unit"' package.json; then
-              echo "exists=true" >> $GITHUB_OUTPUT
-            else
-              echo "exists=false" >> $GITHUB_OUTPUT
-            fi
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🧪 Run unit tests with coverage
-        if: steps.check_script.outputs.exists == 'true'
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm run test:cov
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn test:cov
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun run test:cov
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: ⏭️ Skip unit tests (no test:unit script)
-        if: steps.check_script.outputs.exists == 'false'
-        run: echo "Skipping unit tests - test:unit script not found in package.json"
-
-  test_integration:
-    name: 🧪 Run Integration Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    if: ${{ !contains(inputs.skip_jobs, 'test:integration') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔍 Check for test:integration script
-        id: check_script
-        run: |
-          if [ -f "package.json" ]; then
-            if grep -q '"test:integration"' package.json; then
-              echo "exists=true" >> $GITHUB_OUTPUT
-            else
-              echo "exists=false" >> $GITHUB_OUTPUT
-            fi
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🧪 Run integration tests
-        if: steps.check_script.outputs.exists == 'true'
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm run test:integration
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn test:integration
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun run test:integration
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: ⏭️ Skip integration tests (no test:integration script)
-        if: steps.check_script.outputs.exists == 'false'
-        run: echo "Skipping integration tests - test:integration script not found in package.json"
-
-  test_e2e:
-    name: 🧪 Run E2E Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-    if: ${{ !contains(inputs.skip_jobs, 'test:e2e') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔍 Check for test:e2e script
-        id: check_script
-        run: |
-          if [ -f "package.json" ]; then
-            if grep -q '"test:e2e"' package.json; then
-              echo "exists=true" >> $GITHUB_OUTPUT
-            else
-              echo "exists=false" >> $GITHUB_OUTPUT
-            fi
-          else
-            echo "exists=false" >> $GITHUB_OUTPUT
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🧪 Run E2E tests
-        if: steps.check_script.outputs.exists == 'true'
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm run test:e2e
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn test:e2e
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun run test:e2e
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: ⏭️ Skip E2E tests (no test:e2e script)
-        if: steps.check_script.outputs.exists == 'false'
-        run: echo "Skipping E2E tests - test:e2e script not found in package.json"
-
-  maestro_e2e:
-    name: 📱 Maestro Cloud E2E Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    if: ${{ !contains(inputs.skip_jobs, 'maestro_e2e') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔍 Check for Maestro API key
-        id: check_maestro
-        run: |
-          if [[ -z "${MAESTRO_API_KEY// }" ]]; then
-            echo "has_token=false" >> $GITHUB_OUTPUT
-            echo "⚠️ MAESTRO_API_KEY is not configured"
-          else
-            echo "has_token=true" >> $GITHUB_OUTPUT
-            echo "✅ MAESTRO_API_KEY is available"
-          fi
-        env:
-          MAESTRO_API_KEY: ${{ secrets.MAESTRO_API_KEY }}
-
-      - name: 🔍 Check for project ID
-        id: check_project_id
-        if: steps.check_maestro.outputs.has_token == 'true'
-        run: |
-          PROJECT_ID="${{ inputs.maestro_project_id }}"
-          if [[ -z "$PROJECT_ID" ]]; then
-            echo "has_project_id=false" >> $GITHUB_OUTPUT
-            echo "⚠️ maestro_project_id input not provided"
-          else
-            echo "has_project_id=true" >> $GITHUB_OUTPUT
-            echo "✅ Project ID configured"
-          fi
-
-      - name: 🔍 Check for app file
-        id: check_app_file
-        if: steps.check_maestro.outputs.has_token == 'true' && steps.check_project_id.outputs.has_project_id == 'true'
-        run: |
-          APP_FILE="${{ inputs.maestro_app_file }}"
-          if [[ -z "$APP_FILE" ]]; then
-            echo "has_app_file=false" >> $GITHUB_OUTPUT
-            echo "⚠️ maestro_app_file input not provided"
-          elif [[ -f "$APP_FILE" ]]; then
-            echo "has_app_file=true" >> $GITHUB_OUTPUT
-            echo "✅ App file found: $APP_FILE"
-          else
-            echo "has_app_file=false" >> $GITHUB_OUTPUT
-            echo "⚠️ App file not found at: $APP_FILE"
-          fi
-
-      - name: 📱 Run Maestro Cloud tests
-        if: steps.check_maestro.outputs.has_token == 'true' && steps.check_project_id.outputs.has_project_id == 'true' && steps.check_app_file.outputs.has_app_file == 'true'
-        uses: mobile-dev-inc/action-maestro-cloud@v2.0.1
-        with:
-          api-key: ${{ secrets.MAESTRO_API_KEY }}
-          project-id: ${{ inputs.maestro_project_id }}
-          app-file: ${{ inputs.maestro_app_file }}
-          workspace: ${{ inputs.maestro_workspace }}
-          include-tags: ${{ inputs.maestro_include_tags }}
-
-      - name: 📱 Maestro Tests Skipped (no API key)
-        if: steps.check_maestro.outputs.has_token != 'true'
-        run: |
-          echo "::warning::Maestro Cloud E2E tests skipped - MAESTRO_API_KEY not configured"
-          echo "To enable Maestro Cloud testing, add MAESTRO_API_KEY to your repository secrets"
-
-      - name: 📱 Maestro Tests Skipped (no project ID)
-        if: steps.check_maestro.outputs.has_token == 'true' && steps.check_project_id.outputs.has_project_id != 'true'
-        run: |
-          echo "::warning::Maestro Cloud E2E tests skipped - maestro_project_id not provided"
-          echo "To run Maestro tests, provide the maestro_project_id input with your Maestro Cloud project ID"
-
-      - name: 📱 Maestro Tests Skipped (no app file)
-        if: steps.check_maestro.outputs.has_token == 'true' && steps.check_project_id.outputs.has_project_id == 'true' && steps.check_app_file.outputs.has_app_file != 'true'
-        run: |
-          echo "::warning::Maestro Cloud E2E tests skipped - no app file provided"
-          echo "To run Maestro tests, provide the maestro_app_file input with the path to your app binary"
-
-  playwright_e2e:
-    name: 🎭 Playwright E2E Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    if: ${{ !contains(inputs.skip_jobs, 'playwright_e2e') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔍 Check for Playwright config
-        id: check_playwright
-        run: |
-          if [ -f "playwright.config.ts" ] || [ -f "playwright.config.js" ]; then
-            echo "has_config=true" >> $GITHUB_OUTPUT
-            echo "✅ Playwright config found"
-          else
-            echo "has_config=false" >> $GITHUB_OUTPUT
-            echo "⚠️ No Playwright config found"
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🌐 Build web export
-        if: steps.check_playwright.outputs.has_config == 'true'
-        run: npx expo export --platform web
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🎭 Install Playwright browsers
-        if: steps.check_playwright.outputs.has_config == 'true'
-        run: npx playwright install --with-deps
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🎭 Run Playwright tests
-        if: steps.check_playwright.outputs.has_config == 'true'
-        run: npx playwright test
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 📤 Upload Playwright report
-        if: steps.check_playwright.outputs.has_config == 'true' && always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: playwright-report-${{ github.run_id }}
-          path: ${{ inputs.working_directory || '.' }}/playwright-report
-          retention-days: 14
-
-      - name: 🎭 Playwright Tests Skipped (no config)
-        if: steps.check_playwright.outputs.has_config != 'true'
-        run: |
-          echo "::warning::Playwright E2E tests skipped - no playwright.config.ts or playwright.config.js found"
-          echo "To enable Playwright testing, add a Playwright configuration file to your project"
-
-  format:
-    name: 📐 Check Formatting
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    if: ${{ !contains(inputs.skip_jobs, 'format') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 📐 Check formatting
-        run: ${{ inputs.package_manager }} run format:check
-        env:
-          NODE_OPTIONS: --max-old-space-size=6144
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-  build:
-    name: 🏗️ Build
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: ${{ !contains(inputs.skip_jobs, 'build') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🏗️ Build project
-        run: ${{ inputs.package_manager }} run build
-        env:
-          NODE_OPTIONS: --max-old-space-size=6144
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 📤 Upload build artifacts
-        uses: actions/upload-artifact@v4
-        if: success()
-        with:
-          name: build-output-${{ github.run_id }}
-          path: |
-            dist
-            build
-            .next
-            out
-          retention-days: 1
-          if-no-files-found: ignore
-
-  dead_code:
-    name: 🗑️ Dead Code Detection
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    if: ${{ !contains(inputs.skip_jobs, 'dead_code') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🗑️ Run dead code detection (knip)
-        run: ${{ inputs.package_manager }} run knip
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-  sg_scan:
-    name: 🔎 AST Grep Scan
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    if: ${{ !contains(inputs.skip_jobs, 'sg_scan') }}
-
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔍 Check for sgconfig.yml
-        id: check_config
-        run: |
-          if [ -f "sgconfig.yml" ]; then
-            echo "has_config=true" >> $GITHUB_OUTPUT
-          else
-            echo "has_config=false" >> $GITHUB_OUTPUT
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔍 Check for ast-grep rules
-        id: check_rules
-        if: steps.check_config.outputs.has_config == 'true'
-        run: |
-          RULES_DIR="ast-grep/rules"
-          if [ -d "$RULES_DIR" ]; then
-            RULE_COUNT=$(find "$RULES_DIR" -name "*.yml" -o -name "*.yaml" 2>/dev/null | grep -v ".gitkeep" | wc -l | tr -d ' ')
-            if [ "$RULE_COUNT" -gt 0 ]; then
-              echo "has_rules=true" >> $GITHUB_OUTPUT
-              echo "rule_count=$RULE_COUNT" >> $GITHUB_OUTPUT
-            else
-              echo "has_rules=false" >> $GITHUB_OUTPUT
-            fi
-          else
-            echo "has_rules=false" >> $GITHUB_OUTPUT
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔎 Run ast-grep scan
-        if: steps.check_config.outputs.has_config == 'true' && steps.check_rules.outputs.has_rules == 'true'
-        run: ${{ inputs.package_manager }} run sg:scan
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: ⏭️ AST Grep Skipped (no config)
-        if: steps.check_config.outputs.has_config != 'true'
-        run: |
-          echo "::warning::ast-grep scan skipped - no sgconfig.yml found"
-          echo "To enable ast-grep scanning, add sgconfig.yml to your project root"
-
-      - name: ⏭️ AST Grep Skipped (no rules)
-        if: steps.check_config.outputs.has_config == 'true' && steps.check_rules.outputs.has_rules != 'true'
-        run: |
-          echo "::warning::ast-grep scan skipped - no rules defined in ast-grep/rules/"
-          echo "To enable ast-grep scanning, add rule YAML files to ast-grep/rules/"
-
-  npm_security_scan:
-    name: 🔒 Security Scan
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    if: ${{ !contains(inputs.skip_jobs, 'npm_security_scan') }}
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 📋 Load audit exclusions
-        id: audit_exclusions
-        run: |
-          GHSA_IDS=""
-          CVE_IDS=""
-          for config_file in audit.ignore.config.json audit.ignore.local.json; do
-            if [ -f "$config_file" ]; then
-              FILE_IDS=$(jq -r '.exclusions[].id' "$config_file" 2>/dev/null)
-              if [ -n "$FILE_IDS" ]; then
-                GHSA_IDS="$GHSA_IDS $FILE_IDS"
-              fi
-              FILE_CVES=$(jq -r '.exclusions[] | select(.cve != null) | .cve' "$config_file" 2>/dev/null)
-              if [ -n "$FILE_CVES" ]; then
-                CVE_IDS="$CVE_IDS $FILE_CVES"
-              fi
-            fi
-          done
-          GHSA_IDS=$(echo "$GHSA_IDS" | tr ' ' '\n' | sort -u | grep -v '^$' | tr '\n' ' ')
-          CVE_IDS=$(echo "$CVE_IDS" | tr ' ' '\n' | sort -u | grep -v '^$' | tr '\n' ' ')
-          echo "ghsa_ids=$GHSA_IDS" >> $GITHUB_OUTPUT
-          echo "cve_ids=$CVE_IDS" >> $GITHUB_OUTPUT
-          echo "Loaded GHSA exclusions: $GHSA_IDS"
-          echo "Loaded CVE exclusions: $CVE_IDS"
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔒 Run security audit
-        run: |
-          GHSA_IDS="${{ steps.audit_exclusions.outputs.ghsa_ids }}"
-          CVE_IDS="${{ steps.audit_exclusions.outputs.cve_ids }}"
-
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            # Build jq exclusion filter for npm audit GHSA IDs
-            NPM_EXCLUDE_FILTER=""
-            for _id in $GHSA_IDS; do
-              if [ -n "$NPM_EXCLUDE_FILTER" ]; then
-                NPM_EXCLUDE_FILTER="$NPM_EXCLUDE_FILTER or . == \"$_id\""
-              else
-                NPM_EXCLUDE_FILTER=". == \"$_id\""
-              fi
-            done
-
-            AUDIT_JSON=$(npm audit --production --json 2>/dev/null || true)
-            if [ -n "$NPM_EXCLUDE_FILTER" ]; then
-              UNFIXED_HIGH=$(echo "$AUDIT_JSON" | jq "[.vulnerabilities | to_entries[] | select(.value.severity == \"high\" or .value.severity == \"critical\") | .value.via[] | select(type == \"object\") | .url | ltrimstr(\"https://github.com/advisories/\")] | unique | map(select($NPM_EXCLUDE_FILTER | not)) | length")
-            else
-              UNFIXED_HIGH=$(echo "$AUDIT_JSON" | jq '[.vulnerabilities | to_entries[] | select(.value.severity == "high" or .value.severity == "critical") | .value.via[] | select(type == "object") | .url | ltrimstr("https://github.com/advisories/")] | unique | length')
-            fi
-            if [ "$UNFIXED_HIGH" -gt 0 ]; then
-              echo "::warning::Found high or critical vulnerabilities (after excluding known false positives)"
-              npm audit --production --audit-level=high || true
-              exit 1
-            fi
-            echo "::notice::No high or critical vulnerabilities found (excluding known false positives)"
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            # Build jq filter for GHSA IDs
-            GHSA_FILTER=""
-            for _id in $GHSA_IDS; do
-              if [ -n "$GHSA_FILTER" ]; then
-                GHSA_FILTER="$GHSA_FILTER or .data.advisory.github_advisory_id == \"$_id\""
-              else
-                GHSA_FILTER=".data.advisory.github_advisory_id == \"$_id\""
-              fi
-            done
-
-            # Build jq filter for CVE IDs
-            CVE_FILTER=""
-            for _cve in $CVE_IDS; do
-              if [ -n "$CVE_FILTER" ]; then
-                CVE_FILTER="$CVE_FILTER or . == \"$_cve\""
-              else
-                CVE_FILTER=". == \"$_cve\""
-              fi
-            done
-
-            # Combine GHSA and CVE filters
-            COMBINED_FILTER=""
-            if [ -n "$GHSA_FILTER" ] && [ -n "$CVE_FILTER" ]; then
-              COMBINED_FILTER="($GHSA_FILTER or (.data.advisory.cves | any($CVE_FILTER)))"
-            elif [ -n "$GHSA_FILTER" ]; then
-              COMBINED_FILTER="($GHSA_FILTER)"
-            elif [ -n "$CVE_FILTER" ]; then
-              COMBINED_FILTER="((.data.advisory.cves | any($CVE_FILTER)))"
-            fi
-
-            if [ -n "$COMBINED_FILTER" ]; then
-              yarn audit --groups dependencies --json | jq -r "select(.type == \"auditAdvisory\") | select(.data.advisory.severity == \"high\" or .data.advisory.severity == \"critical\") | select(($COMBINED_FILTER) | not) | .data.advisory" > high_vulns.json
-            else
-              yarn audit --groups dependencies --json | jq -r 'select(.type == "auditAdvisory") | select(.data.advisory.severity == "high" or .data.advisory.severity == "critical") | .data.advisory' > high_vulns.json
-            fi
-
-            if [ -s high_vulns.json ]; then
-              echo "::error::Found high or critical vulnerabilities:"
-              cat high_vulns.json
-              exit 1
-            else
-              echo "::notice::No high or critical vulnerabilities found (excluding known false positives)"
-            fi
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            # Build --ignore flags dynamically from exclusion list
-            BUN_IGNORE_FLAGS=""
-            for _id in $GHSA_IDS; do
-              BUN_IGNORE_FLAGS="$BUN_IGNORE_FLAGS --ignore $_id"
-            done
-
-            if ! bun audit --audit-level=high $BUN_IGNORE_FLAGS; then
-              echo "::warning::Found high or critical vulnerabilities"
-              exit 1
-            fi
-            echo "::notice::No high or critical vulnerabilities found"
-          else
-            echo "Unsupported package manager: ${{ inputs.package_manager }}"
-            exit 1
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-  sonarcloud:
-    name: 🔍 SonarCloud SAST
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: ${{ !contains(inputs.skip_jobs, 'sonarcloud') }}
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # Full depth for proper analysis
-
-      - name: 🔍 Check for SonarCloud token
-        id: check_sonar
-        run: |
-          # Debug: Show if env var is set (will show *** if present)
-          echo "SONAR_TOKEN env var: '${SONAR_TOKEN:+SET}'"
-          echo "SONAR_TOKEN length: ${#SONAR_TOKEN}"
-
-          # More robust check - empty, unset, or just whitespace
-          if [[ -z "${SONAR_TOKEN// }" ]]; then
-            echo "has_token=false" >> $GITHUB_OUTPUT
-            echo "⚠️ SONAR_TOKEN is not configured"
-          else
-            echo "has_token=true" >> $GITHUB_OUTPUT
-            echo "✅ SONAR_TOKEN is available"
-          fi
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-      - name: 📊 SonarCloud Scan
-        if: steps.check_sonar.outputs.has_token == 'true'
-        id: sonar_scan
-        uses: SonarSource/sonarqube-scan-action@v6.0.0
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        with:
-          args: -Dsonar.qualitygate.wait=true
-        continue-on-error: true
-
-      - name: 🔍 Validate SonarCloud results
-        if: steps.check_sonar.outputs.has_token == 'true'
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: |
-          OUTCOME="${{ steps.sonar_scan.outcome }}"
-
-          if [ "$OUTCOME" = "success" ]; then
-            echo "✅ SonarCloud scan and quality gate passed"
-            exit 0
-          fi
-
-          if [ "$OUTCOME" = "failure" ]; then
-            REPORT_FILE=".scannerwork/report-task.txt"
-
-            if [ ! -f "$REPORT_FILE" ]; then
-              echo "::error::SonarCloud scan failed and report-task.txt is missing; failing build."
-              exit 1
-            fi
-
-            # Extract serverUrl and ceTaskId from report-task.txt (key=value format)
-            SERVER_URL=$(grep -E '^serverUrl=' "$REPORT_FILE" | cut -d= -f2-)
-            CE_TASK_ID=$(grep -E '^ceTaskId=' "$REPORT_FILE" | cut -d= -f2-)
-
-            if [ -z "$SERVER_URL" ] || [ -z "$CE_TASK_ID" ]; then
-              echo "::error::Could not extract serverUrl or ceTaskId from report-task.txt; failing build."
-              exit 1
-            fi
-
-            # Query SonarCloud CE task API to get the actual error message
-            TASK_JSON=$(curl -s -u "$SONAR_TOKEN:" "$SERVER_URL/api/ce/task?id=$CE_TASK_ID")
-            ERROR_MSG=$(echo "$TASK_JSON" | jq -r '.task.errorMessage // ""')
-
-            # Only allow line-limit quota errors to pass
-            if echo "$ERROR_MSG" | grep -qi "maximum allowed lines limit"; then
-              echo "::warning::SonarCloud scan failed due to organization line-limit quota; not blocking build."
-              echo "ℹ️ Contact your SonarCloud organization admin to increase or manage line limits."
-              exit 0
-            fi
-
-            echo "::error::SonarCloud scan failed: $ERROR_MSG"
-            exit 1
-          fi
-
-      - name: 📊 SonarCloud Scan Skipped
-        if: steps.check_sonar.outputs.has_token != 'true'
-        run: |
-          echo "::warning::SonarCloud analysis skipped - SONAR_TOKEN not configured"
-          echo "To enable SonarCloud analysis, add SONAR_TOKEN to your repository secrets"
-
-  snyk:
-    name: 🛡️ Snyk Dependency Scan
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: ${{ !contains(inputs.skip_jobs, 'snyk') }}
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔍 Check for Snyk token
-        id: check_snyk
-        run: |
-          if [[ -z "${SNYK_TOKEN// }" ]]; then
-            echo "has_token=false" >> $GITHUB_OUTPUT
-            echo "⚠️ SNYK_TOKEN is not configured"
-          else
-            echo "has_token=true" >> $GITHUB_OUTPUT
-            echo "✅ SNYK_TOKEN is available"
-          fi
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-
-      - name: 🔧 Setup Node.js
-        if: steps.check_snyk.outputs.has_token == 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        if: steps.check_snyk.outputs.has_token == 'true'
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🛡️ Run Snyk to check for vulnerabilities
-        if: steps.check_snyk.outputs.has_token == 'true'
-        uses: snyk/actions/node@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          args: --severity-threshold=high --all-projects
-
-      - name: 📤 Upload Snyk results
-        if: steps.check_snyk.outputs.has_token == 'true' && always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: snyk-results
-          path: snyk-results.json
-          retention-days: 14
-
-      - name: 🛡️ Snyk Scan Skipped
-        if: steps.check_snyk.outputs.has_token != 'true'
-        run: |
-          echo "::warning::Snyk dependency scan skipped - SNYK_TOKEN not configured"
-          echo "To enable Snyk vulnerability scanning, add SNYK_TOKEN to your repository secrets"
-
-  secret_scanning:
-    name: 🔐 GitGuardian Secret Detection
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: ${{ !contains(inputs.skip_jobs, 'secret_scanning') }}
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0 # Full depth for scanning history
-
-      - name: 🔍 Check for GitGuardian API key
-        id: check_gitguardian
-        run: |
-          if [[ -z "${GITGUARDIAN_API_KEY// }" ]]; then
-            echo "has_token=false" >> $GITHUB_OUTPUT
-            echo "⚠️ GITGUARDIAN_API_KEY is not configured"
-          else
-            echo "has_token=true" >> $GITHUB_OUTPUT
-            echo "✅ GITGUARDIAN_API_KEY is available"
-          fi
-        env:
-          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
-
-      - name: 🔐 GitGuardian scan
-        if: steps.check_gitguardian.outputs.has_token == 'true'
-        uses: GitGuardian/ggshield-action@master
-        env:
-          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
-        with:
-          args: --show-secrets --all-policies
-
-      - name: 🔐 GitGuardian Scan Skipped
-        if: steps.check_gitguardian.outputs.has_token != 'true'
-        run: |
-          echo "::warning::GitGuardian secret detection skipped - GITGUARDIAN_API_KEY not configured"
-          echo "To enable secret detection, add GITGUARDIAN_API_KEY to your repository secrets"
-
-  license_compliance:
-    name: 📜 FOSSA License Check
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: ${{ !contains(inputs.skip_jobs, 'license_compliance') }}
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔍 Check for FOSSA API key
-        id: check_fossa
-        run: |
-          if [[ -z "${FOSSA_API_KEY// }" ]]; then
-            echo "has_token=false" >> $GITHUB_OUTPUT
-            echo "⚠️ FOSSA_API_KEY is not configured"
-          else
-            echo "has_token=true" >> $GITHUB_OUTPUT
-            echo "✅ FOSSA_API_KEY is available"
-          fi
-        env:
-          FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
-
-      - name: 📜 Run FOSSA license scan
-        if: steps.check_fossa.outputs.has_token == 'true'
-        uses: fossas/fossa-action@main
-        with:
-          api-key: ${{ secrets.FOSSA_API_KEY }}
-          # Optional: specify the team
-          # team: 'your-team-name'
-
-      - name: 📜 FOSSA Scan Skipped
-        if: steps.check_fossa.outputs.has_token != 'true'
-        run: |
-          echo "::warning::FOSSA license compliance check skipped - FOSSA_API_KEY not configured"
-          echo "To enable license compliance checking, add FOSSA_API_KEY to your repository secrets"
-
-  zap_baseline:
-    name: 🕷️ OWASP ZAP Baseline
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    if: ${{ !contains(inputs.skip_jobs, 'zap_baseline') && inputs.zap_target_url != '' }}
-    steps:
-      - name: 📥 Checkout repository
-        uses: actions/checkout@v4
-
-      - name: 🔧 Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: ${{ inputs.node_version }}
-          cache: ${{ inputs.package_manager != 'bun' && inputs.package_manager || '' }}
-
-      - name: 🍞 Setup Bun
-        if: inputs.package_manager == 'bun'
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: '1.3.8'
-
-      - name: 📦 Install dependencies
-        run: |
-          if [ "${{ inputs.package_manager }}" = "npm" ]; then
-            npm ci
-          elif [ "${{ inputs.package_manager }}" = "yarn" ]; then
-            yarn install --frozen-lockfile
-          elif [ "${{ inputs.package_manager }}" = "bun" ]; then
-            bun install --frozen-lockfile
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🔍 Check for ZAP rules file
-        id: check_rules
-        run: |
-          if [ -f "${{ inputs.zap_rules_file }}" ]; then
-            echo "has_rules=true" >> $GITHUB_OUTPUT
-          else
-            echo "has_rules=false" >> $GITHUB_OUTPUT
-          fi
-        working-directory: ${{ inputs.working_directory || '.' }}
-
-      - name: 🕷️ Run ZAP baseline scan
-        uses: zaproxy/action-baseline@v0.14.0
-        with:
-          target: ${{ inputs.zap_target_url }}
-          rules_file_name: ${{ steps.check_rules.outputs.has_rules == 'true' && inputs.zap_rules_file || '' }}
-          fail_action: true
-          allow_issue_writing: false
-          artifact_name: 'zap-report'
-
-      - name: 📤 Upload ZAP report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: zap-baseline-report-${{ github.run_id }}
-          path: |
-            zap-report.html
-            zap-report.json
-            zap-report.md
-          retention-days: 14
-
-  # Enterprise security tools summary
-  security_tools_summary:
-    name: 🔒 Security Tools Summary
-    runs-on: ubuntu-latest
-    if: always() && (needs.sonarcloud.result != 'skipped' || needs.snyk.result != 'skipped' || needs.secret_scanning.result != 'skipped' || needs.license_compliance.result != 'skipped' || needs.zap_baseline.result != 'skipped')
-    needs: [sonarcloud, snyk, secret_scanning, license_compliance, zap_baseline]
-    steps:
-      - name: 📝 Generate security tools summary
-        run: |
-          echo "# 🔒 Enterprise Security Tools Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # SonarCloud SAST status
-          if [ "${{ needs.sonarcloud.result }}" == "skipped" ]; then
-            echo "- 🔍 **SonarCloud SAST**: ⏭️ Skipped (no token)" >> $GITHUB_STEP_SUMMARY
-          elif [ "${{ needs.sonarcloud.result }}" == "success" ]; then
-            echo "- 🔍 **SonarCloud SAST**: ✅ Passed" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "- 🔍 **SonarCloud SAST**: ❌ Failed" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # Snyk Dependency Scan status
-          if [ "${{ needs.snyk.result }}" == "skipped" ]; then
-            echo "- 🛡️ **Snyk Dependency Scan**: ⏭️ Skipped (no token)" >> $GITHUB_STEP_SUMMARY
-          elif [ "${{ needs.snyk.result }}" == "success" ]; then
-            echo "- 🛡️ **Snyk Dependency Scan**: ✅ Passed" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "- 🛡️ **Snyk Dependency Scan**: ❌ Failed" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # GitGuardian Secret Detection status
-          if [ "${{ needs.secret_scanning.result }}" == "skipped" ]; then
-            echo "- 🔐 **GitGuardian Secret Detection**: ⏭️ Skipped (no token)" >> $GITHUB_STEP_SUMMARY
-          elif [ "${{ needs.secret_scanning.result }}" == "success" ]; then
-            echo "- 🔐 **GitGuardian Secret Detection**: ✅ Passed" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "- 🔐 **GitGuardian Secret Detection**: ❌ Failed" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # FOSSA License Compliance status
-          if [ "${{ needs.license_compliance.result }}" == "skipped" ]; then
-            echo "- 📜 **FOSSA License Compliance**: ⏭️ Skipped (no token)" >> $GITHUB_STEP_SUMMARY
-          elif [ "${{ needs.license_compliance.result }}" == "success" ]; then
-            echo "- 📜 **FOSSA License Compliance**: ✅ Passed" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "- 📜 **FOSSA License Compliance**: ❌ Failed" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # OWASP ZAP Baseline status
-          if [ "${{ needs.zap_baseline.result }}" == "skipped" ]; then
-            echo "- 🕷️ **OWASP ZAP Baseline**: ⏭️ Skipped (no target URL)" >> $GITHUB_STEP_SUMMARY
-          elif [ "${{ needs.zap_baseline.result }}" == "success" ]; then
-            echo "- 🕷️ **OWASP ZAP Baseline**: ✅ Passed" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "- 🕷️ **OWASP ZAP Baseline**: ❌ Failed" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## 📊 Security Posture" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # Count active tools
-          ACTIVE_TOOLS=0
-          PASSED_TOOLS=0
-
-          if [ "${{ needs.sonarcloud.result }}" != "skipped" ]; then
-            ACTIVE_TOOLS=$((ACTIVE_TOOLS + 1))
-            if [ "${{ needs.sonarcloud.result }}" == "success" ]; then
-              PASSED_TOOLS=$((PASSED_TOOLS + 1))
-            fi
-          fi
-
-          if [ "${{ needs.snyk.result }}" != "skipped" ]; then
-            ACTIVE_TOOLS=$((ACTIVE_TOOLS + 1))
-            if [ "${{ needs.snyk.result }}" == "success" ]; then
-              PASSED_TOOLS=$((PASSED_TOOLS + 1))
-            fi
-          fi
-
-          if [ "${{ needs.secret_scanning.result }}" != "skipped" ]; then
-            ACTIVE_TOOLS=$((ACTIVE_TOOLS + 1))
-            if [ "${{ needs.secret_scanning.result }}" == "success" ]; then
-              PASSED_TOOLS=$((PASSED_TOOLS + 1))
-            fi
-          fi
-
-          if [ "${{ needs.license_compliance.result }}" != "skipped" ]; then
-            ACTIVE_TOOLS=$((ACTIVE_TOOLS + 1))
-            if [ "${{ needs.license_compliance.result }}" == "success" ]; then
-              PASSED_TOOLS=$((PASSED_TOOLS + 1))
-            fi
-          fi
-
-          if [ "${{ needs.zap_baseline.result }}" != "skipped" ]; then
-            ACTIVE_TOOLS=$((ACTIVE_TOOLS + 1))
-            if [ "${{ needs.zap_baseline.result }}" == "success" ]; then
-              PASSED_TOOLS=$((PASSED_TOOLS + 1))
-            fi
-          fi
-
-          echo "- **Active Security Tools**: $ACTIVE_TOOLS / 5" >> $GITHUB_STEP_SUMMARY
-          echo "- **Passed Checks**: $PASSED_TOOLS / $ACTIVE_TOOLS" >> $GITHUB_STEP_SUMMARY
-
-          if [ $ACTIVE_TOOLS -gt 0 ]; then
-            SCORE=$((PASSED_TOOLS * 100 / ACTIVE_TOOLS))
-            echo "- **Security Score**: $SCORE%" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## 🔧 Configuration" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "To enable additional security tools, add the following secrets to your repository:" >> $GITHUB_STEP_SUMMARY
-          echo "- \`SONAR_TOKEN\` - [Get from SonarCloud](https://sonarcloud.io/)" >> $GITHUB_STEP_SUMMARY
-          echo "- \`SNYK_TOKEN\` - [Get from Snyk](https://app.snyk.io/)" >> $GITHUB_STEP_SUMMARY
-          echo "- \`GITGUARDIAN_API_KEY\` - [Get from GitGuardian](https://dashboard.gitguardian.com/)" >> $GITHUB_STEP_SUMMARY
-          echo "- \`FOSSA_API_KEY\` - [Get from FOSSA](https://app.fossa.com/)" >> $GITHUB_STEP_SUMMARY
-
-          # Overall status
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## 🎯 Overall Status" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          if [ $ACTIVE_TOOLS -eq 0 ]; then
-            echo "⚠️ **No security tools are active.** Configure tokens to enable security scanning." >> $GITHUB_STEP_SUMMARY
-          elif [ $PASSED_TOOLS -eq $ACTIVE_TOOLS ]; then
-            echo "✅ **All active security tools passed!**" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **Some security tools failed.** Review the results above and address any issues." >> $GITHUB_STEP_SUMMARY
-          fi
-
-  # Compliance validation job
-  compliance_validation:
-    name: ✅ Compliance Validation
-    runs-on: ubuntu-latest
-    if: ${{ inputs.compliance_framework != 'none' }}
-    needs:
-      [
-        lint,
-        typecheck,
-        test,
-        test_unit,
-        test_integration,
-        test_e2e,
-        maestro_e2e,
-        playwright_e2e,
-        format,
-        build,
-        dead_code,
-        sg_scan,
-        npm_security_scan,
-        sonarcloud,
-        snyk,
-        secret_scanning,
-        license_compliance,
-        zap_baseline,
-      ]
-    steps:
-      - name: 📋 Validate compliance framework
-        id: validate_framework
-        run: |
-          echo "🏢 Validating compliance for framework: ${{ inputs.compliance_framework }}"
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "# 🏢 Compliance Validation Report" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Framework**: ${{ inputs.compliance_framework }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Date**: $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_STEP_SUMMARY
-          echo "**Run ID**: ${{ github.run_id }}" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-      - name: 🔍 SOC 2 Control Validation
-        if: contains(inputs.compliance_framework, 'soc2')
-        run: |
-          echo "## SOC 2 Type II Controls" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # CC6.1 - Logical and Physical Access Controls
-          if [ "${{ needs.secret_scanning.result }}" == "success" ] || [ "${{ needs.secret_scanning.result }}" == "skipped" ]; then
-            echo "✅ **CC6.1**: No hardcoded credentials detected" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **CC6.1**: Secret scanning failed - potential credential exposure" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # CC7.1 - System Operations
-          if [ "${{ needs.npm_security_scan.result }}" == "success" ] && [ "${{ needs.snyk.result }}" == "success" ]; then
-            echo "✅ **CC7.1**: Vulnerability management controls validated" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "⚠️ **CC7.1**: Security scanning incomplete - manual review required" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # CC7.2 - System Monitoring
-          echo "✅ **CC7.2**: Audit logging enabled (retention: ${{ inputs.audit_retention_days }} days)" >> $GITHUB_STEP_SUMMARY
-
-          # CC8.1 - Change Management
-          if [ "${{ github.event_name }}" == "pull_request" ]; then
-            echo "✅ **CC8.1**: Change management process followed (PR #${{ github.event.pull_request.number }})" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "⚠️ **CC8.1**: Direct push to branch - review change management policy" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-      - name: 🔍 ISO 27001 Control Validation
-        if: contains(inputs.compliance_framework, 'iso27001')
-        run: |
-          echo "## ISO 27001:2022 Controls" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # A.8.1 - Asset Management
-          if [ "${{ needs.license_compliance.result }}" == "success" ]; then
-            echo "✅ **A.8.1**: Software asset inventory validated" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "⚠️ **A.8.1**: License compliance check skipped" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # A.12.1 - Operational Security
-          if [ "${{ needs.sonarcloud.result }}" == "success" ]; then
-            echo "✅ **A.12.1**: Code quality and security controls validated" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "⚠️ **A.12.1**: Static analysis skipped" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # A.14.2 - Security in Development
-          SECURITY_TESTS=0
-          [ "${{ needs.npm_security_scan.result }}" == "success" ] && SECURITY_TESTS=$((SECURITY_TESTS + 1))
-          [ "${{ needs.snyk.result }}" == "success" ] && SECURITY_TESTS=$((SECURITY_TESTS + 1))
-          [ "${{ needs.secret_scanning.result }}" == "success" ] && SECURITY_TESTS=$((SECURITY_TESTS + 1))
-
-          if [ $SECURITY_TESTS -ge 2 ]; then
-            echo "✅ **A.14.2**: Security testing in SDLC validated ($SECURITY_TESTS/3 tools)" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **A.14.2**: Insufficient security testing ($SECURITY_TESTS/3 tools)" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-      - name: 🔍 HIPAA Control Validation
-        if: contains(inputs.compliance_framework, 'hipaa')
-        run: |
-          echo "## HIPAA Security Rule Controls" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # Access Control - 164.312(a)(1)
-          echo "✅ **164.312(a)(1)**: Access controls implemented via GitHub permissions" >> $GITHUB_STEP_SUMMARY
-
-          # Audit Controls - 164.312(b)
-          echo "✅ **164.312(b)**: Audit logging enabled with ${{ inputs.audit_retention_days }}-day retention" >> $GITHUB_STEP_SUMMARY
-
-          # Integrity - 164.312(c)(1)
-          if [ "${{ needs.test.result }}" == "success" ]; then
-            echo "✅ **164.312(c)(1)**: Data integrity validated through testing" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **164.312(c)(1)**: Testing failed or skipped" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # Transmission Security - 164.312(e)(1)
-          echo "✅ **164.312(e)(1)**: All transmissions use HTTPS/TLS" >> $GITHUB_STEP_SUMMARY
-
-          # PHI Detection Warning
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "⚠️ **Note**: Automated PHI detection not implemented. Manual review required for PHI handling." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-      - name: 🔍 PCI-DSS Control Validation
-        if: contains(inputs.compliance_framework, 'pci-dss')
-        run: |
-          echo "## PCI-DSS v4.0 Requirements" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # Requirement 2 - Default Passwords
-          if [ "${{ needs.secret_scanning.result }}" == "success" ]; then
-            echo "✅ **Req 2.2**: No hardcoded passwords detected" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **Req 2.2**: Secret scanning incomplete" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # Requirement 6 - Secure Development
-          if [ "${{ needs.sonarcloud.result }}" == "success" ]; then
-            echo "✅ **Req 6.3**: Secure coding practices validated" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "⚠️ **Req 6.3**: Static analysis skipped" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # Requirement 6.4 - Change Control
-          if [ "${{ github.event_name }}" == "pull_request" ]; then
-            echo "✅ **Req 6.4**: Change control process followed" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "⚠️ **Req 6.4**: Direct push detected" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          # Requirement 11 - Security Testing
-          if [ "${{ needs.npm_security_scan.result }}" == "success" ] && [ "${{ needs.snyk.result }}" == "success" ]; then
-            echo "✅ **Req 11.3**: Vulnerability scanning completed" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **Req 11.3**: Vulnerability scanning incomplete" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "⚠️ **Note**: This validates security controls only. PCI compliance requires additional network and infrastructure controls." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-      - name: 📊 Generate compliance score
-        run: |
-          echo "## Compliance Score" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          TOTAL_CONTROLS=0
-          PASSED_CONTROLS=0
-
-          # Count quality checks
-          [ "${{ needs.lint.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-          [ "${{ needs.typecheck.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-          [ "${{ needs.test.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-          [ "${{ needs.build.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-          TOTAL_CONTROLS=$((TOTAL_CONTROLS + 4))
-
-          # Count security checks
-          [ "${{ needs.npm_security_scan.result }}" != "skipped" ] && TOTAL_CONTROLS=$((TOTAL_CONTROLS + 1))
-          [ "${{ needs.npm_security_scan.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-
-          [ "${{ needs.sonarcloud.result }}" != "skipped" ] && TOTAL_CONTROLS=$((TOTAL_CONTROLS + 1))
-          [ "${{ needs.sonarcloud.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-
-          [ "${{ needs.snyk.result }}" != "skipped" ] && TOTAL_CONTROLS=$((TOTAL_CONTROLS + 1))
-          [ "${{ needs.snyk.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-
-          [ "${{ needs.secret_scanning.result }}" != "skipped" ] && TOTAL_CONTROLS=$((TOTAL_CONTROLS + 1))
-          [ "${{ needs.secret_scanning.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-
-          [ "${{ needs.license_compliance.result }}" != "skipped" ] && TOTAL_CONTROLS=$((TOTAL_CONTROLS + 1))
-          [ "${{ needs.license_compliance.result }}" == "success" ] && PASSED_CONTROLS=$((PASSED_CONTROLS + 1))
-
-          if [ $TOTAL_CONTROLS -gt 0 ]; then
-            SCORE=$((PASSED_CONTROLS * 100 / TOTAL_CONTROLS))
-            echo "**Overall Compliance Score**: $SCORE% ($PASSED_CONTROLS/$TOTAL_CONTROLS controls passed)" >> $GITHUB_STEP_SUMMARY
-
-            if [ $SCORE -ge 90 ]; then
-              echo "🟢 **Status**: Excellent compliance posture" >> $GITHUB_STEP_SUMMARY
-            elif [ $SCORE -ge 70 ]; then
-              echo "🟡 **Status**: Good compliance posture with minor gaps" >> $GITHUB_STEP_SUMMARY
-            else
-              echo "🔴 **Status**: Significant compliance gaps detected" >> $GITHUB_STEP_SUMMARY
-            fi
-          fi
-
-  # Audit logging job
-  audit_logger:
-    name: 📊 Audit Logger
-    runs-on: ubuntu-latest
-    if: always()
-    needs:
-      [
-        install_dependencies,
-        lint,
-        typecheck,
-        test,
-        test_unit,
-        test_integration,
-        test_e2e,
-        maestro_e2e,
-        playwright_e2e,
-        format,
-        build,
-        dead_code,
-        sg_scan,
-        npm_security_scan,
-        sonarcloud,
-        snyk,
-        secret_scanning,
-        license_compliance,
-        zap_baseline,
-        compliance_validation,
-      ]
-    steps:
-      - name: 📝 Generate audit log
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const auditLog = {
-              timestamp: new Date().toISOString(),
-              workflow: {
-                name: '${{ github.workflow }}',
-                run_id: '${{ github.run_id }}',
-                run_number: '${{ github.run_number }}',
-                run_attempt: '${{ github.run_attempt }}'
-              },
-              trigger: {
-                event: '${{ github.event_name }}',
-                actor: '${{ github.actor }}',
-                ref: '${{ github.ref }}',
-                sha: '${{ github.sha }}'
-              },
-              repository: {
-                name: '${{ github.repository }}',
-                owner: '${{ github.repository_owner }}',
-                visibility: '${{ github.event.repository.visibility }}'
-              },
-              compliance: {
-                framework: '${{ inputs.compliance_framework }}',
-                require_approval: ${{ inputs.require_approval }},
-                audit_retention_days: ${{ inputs.audit_retention_days }}
-              },
-              jobs: {
-                dependencies: {
-                  status: '${{ needs.install_dependencies.result }}',
-                  cache_hit: '${{ needs.install_dependencies.outputs.cache-hit }}'
-                },
-                quality: {
-                  lint: '${{ needs.lint.result }}',
-                  typecheck: '${{ needs.typecheck.result }}',
-                  test: '${{ needs.test.result }}',
-                  test_unit: '${{ needs.test_unit.result }}',
-                  test_integration: '${{ needs.test_integration.result }}',
-                  test_e2e: '${{ needs.test_e2e.result }}',
-                  maestro_e2e: '${{ needs.maestro_e2e.result }}',
-                  playwright_e2e: '${{ needs.playwright_e2e.result }}',
-                  format: '${{ needs.format.result }}',
-                  build: '${{ needs.build.result }}',
-                  sg_scan: '${{ needs.sg_scan.result }}'
-                },
-                security: {
-                  npm_audit: '${{ needs.npm_security_scan.result }}',
-                  sonarcloud: '${{ needs.sonarcloud.result }}',
-                  snyk: '${{ needs.snyk.result }}',
-                  secret_scan: '${{ needs.secret_scanning.result }}',
-                  license_check: '${{ needs.license_compliance.result }}',
-                  zap_baseline: '${{ needs.zap_baseline.result }}'
-                },
-                compliance: '${{ needs.compliance_validation.result }}'
-              },
-              metadata: {
-                runner_os: '${{ runner.os }}',
-                runner_arch: '${{ runner.arch }}'
-              }
-            };
-
-            // Write to file
-            const fs = require('fs');
-            const filename = `audit-log-${auditLog.workflow.run_id}-${Date.now()}.json`;
-            fs.writeFileSync(filename, JSON.stringify(auditLog, null, 2));
-
-            console.log(`Audit log generated: ${filename}`);
-
-            // Add to job summary
-            core.summary.addHeading('📊 Audit Log Entry', 3);
-            core.summary.addCodeBlock(JSON.stringify(auditLog, null, 2), 'json');
-            await core.summary.write();
-
-            // Set output for artifact upload
-            core.setOutput('filename', filename);
-
-      - name: 📤 Upload audit log
-        uses: actions/upload-artifact@v4
-        with:
-          name: audit-log-${{ github.run_id }}
-          path: audit-log-*.json
-          retention-days: ${{ inputs.audit_retention_days }}
-
-      - name: 📊 Generate evidence package
-        if: ${{ inputs.generate_evidence_package == true }}
-        run: |
-          echo "📦 Generating compliance evidence package..."
-
-          # Create evidence directory
-          mkdir -p evidence-package
-
-          # Create evidence summary
-          cat > evidence-package/evidence-summary.md << EOF
-          # Compliance Evidence Package
-
-          **Generated**: $(date -u +%Y-%m-%dT%H:%M:%SZ)
-          **Workflow Run**: ${{ github.run_id }}
-          **Repository**: ${{ github.repository }}
-          **Compliance Framework**: ${{ inputs.compliance_framework }}
-
-          ## Evidence Contents
-
-          1. **Audit Log**: Full workflow execution audit trail
-          2. **Security Scan Results**: Results from all security tools
-          3. **Test Reports**: Unit test execution results
-          4. **Build Artifacts**: Compiled output verification
-          5. **Approval Records**: Change approval documentation
-
-          ## Control Validation Summary
-
-          - Quality Controls: Validated through automated testing
-          - Security Controls: Validated through multiple scanning tools
-          - Change Management: Validated through PR process
-          - Audit Controls: Continuous logging with ${{ inputs.audit_retention_days }}-day retention
-
-          ## Attestation
-
-          This evidence package was automatically generated from workflow run ${{ github.run_id }}.
-          All artifacts are cryptographically signed by GitHub Actions.
-          EOF
-
-          echo "✅ Evidence package created"
-
-      - name: 📤 Upload evidence package
-        if: ${{ inputs.generate_evidence_package == true }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: compliance-evidence-${{ github.run_id }}
-          path: evidence-package/
-          retention-days: ${{ inputs.audit_retention_days }}
-
-  # Approval gate for production deployments
-  approval_gate:
-    name: 🚦 Approval Gate
-    runs-on: ubuntu-latest
-    if: ${{ inputs.require_approval == true && inputs.compliance_framework != 'none' && inputs.approval_environment != '' }}
-    needs: [compliance_validation]
-    environment:
-      name: ${{ inputs.approval_environment }}
-      # NOTE: This environment must be created in your repository before using this workflow
-      # To create it:
-      # 1. Go to Settings > Environments > New environment
-      # 2. Name it to match the approval_environment input (default: "production")
-      # 3. Add protection rules (required reviewers, deployment branches, etc.)
-    steps:
-      - name: 📝 Log approval
-        run: |
-          echo "# 🚦 Production Deployment Approval" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Approved by**: ${{ github.actor }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Approval time**: $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_STEP_SUMMARY
-          echo "**Compliance framework**: ${{ inputs.compliance_framework }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Workflow run**: ${{ github.run_id }}" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## Approval Requirements Met" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- ✅ Compliance validation passed" >> $GITHUB_STEP_SUMMARY
-          echo "- ✅ Security scans completed" >> $GITHUB_STEP_SUMMARY
-          echo "- ✅ Required approvers notified" >> $GITHUB_STEP_SUMMARY
-          echo "- ✅ Audit trail generated" >> $GITHUB_STEP_SUMMARY
-
-      - name: 📊 Create approval record
-        run: |
-          # Create approval record for audit
-          cat > approval-record-${{ github.run_id }}.json << EOF
-          {
-            "approval_type": "production_deployment",
-            "approved_by": "${{ github.actor }}",
-            "approval_time": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-            "workflow_run_id": "${{ github.run_id }}",
-            "compliance_framework": "${{ inputs.compliance_framework }}",
-            "repository": "${{ github.repository }}",
-            "ref": "${{ github.ref }}",
-            "sha": "${{ github.sha }}"
-          }
-          EOF
-
-      - name: 📤 Upload approval record
-        uses: actions/upload-artifact@v4
-        with:
-          name: approval-record-${{ github.run_id }}
-          path: approval-record-*.json
-          retention-days: ${{ inputs.audit_retention_days }}
-
-  # Performance monitoring job
-  performance_summary:
-    name: ⚡ Performance Summary
-    runs-on: ubuntu-latest
-    if: always()
-    needs:
-      [
-        install_dependencies,
-        lint,
-        typecheck,
-        test,
-        test_unit,
-        test_integration,
-        test_e2e,
-        maestro_e2e,
-        playwright_e2e,
-        format,
-        build,
-        dead_code,
-        sg_scan,
-        npm_security_scan,
-        sonarcloud,
-        snyk,
-        secret_scanning,
-        license_compliance,
-        zap_baseline,
-      ]
-    steps:
-      - name: 📊 Generate performance report
-        run: |
-          echo "# ⚡ Workflow Performance Report" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## 🏃 Execution Summary" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          # Calculate total workflow time (approximation)
-          echo "- **Workflow Run ID**: ${{ github.run_id }}" >> $GITHUB_STEP_SUMMARY
-          echo "- **Triggered By**: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
-          echo "- **Runner**: ${{ runner.os }} (${{ runner.arch }})" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          echo "## 📦 Dependency Caching" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-
-          if [ "${{ needs.install_dependencies.outputs.cache-hit }}" == "true" ]; then
-            echo "✅ **Cache Hit!** Dependencies loaded from cache." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "❌ **Cache Miss** - Fresh dependency installation was required." >> $GITHUB_STEP_SUMMARY
-          fi
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- **Cache Key**: \`${{ needs.install_dependencies.outputs.cache-key }}\`" >> $GITHUB_STEP_SUMMARY
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## 🎯 Job Status Overview" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "| Job | Status | Type |" >> $GITHUB_STEP_SUMMARY
-          echo "|-----|--------|------|" >> $GITHUB_STEP_SUMMARY
-          echo "| Install Dependencies | ${{ needs.install_dependencies.result }} | Setup |" >> $GITHUB_STEP_SUMMARY
-          echo "| Lint | ${{ needs.lint.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| Type Check | ${{ needs.typecheck.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| Tests | ${{ needs.test.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| Unit Tests | ${{ needs.test_unit.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| Integration Tests | ${{ needs.test_integration.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| E2E Tests | ${{ needs.test_e2e.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| Maestro E2E | ${{ needs.maestro_e2e.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| Playwright E2E | ${{ needs.playwright_e2e.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| Format Check | ${{ needs.format.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| Build | ${{ needs.build.result }} | Build |" >> $GITHUB_STEP_SUMMARY
-          echo "| Dead Code | ${{ needs.dead_code.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| AST Grep | ${{ needs.sg_scan.result }} | Quality |" >> $GITHUB_STEP_SUMMARY
-          echo "| NPM Security | ${{ needs.npm_security_scan.result }} | Security |" >> $GITHUB_STEP_SUMMARY
-          echo "| SonarCloud | ${{ needs.sonarcloud.result }} | Security |" >> $GITHUB_STEP_SUMMARY
-          echo "| Snyk | ${{ needs.snyk.result }} | Security |" >> $GITHUB_STEP_SUMMARY
-          echo "| Secret Scan | ${{ needs.secret_scanning.result }} | Security |" >> $GITHUB_STEP_SUMMARY
-          echo "| License Check | ${{ needs.license_compliance.result }} | Security |" >> $GITHUB_STEP_SUMMARY
-          echo "| ZAP Baseline | ${{ needs.zap_baseline.result }} | Security |" >> $GITHUB_STEP_SUMMARY
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## 💡 Performance Tips" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- All jobs now share dependencies, reducing redundant installations" >> $GITHUB_STEP_SUMMARY
-          echo "- Quality checks (lint, typecheck, format) run in parallel" >> $GITHUB_STEP_SUMMARY
-          echo "- Security tools run in parallel where tokens are available" >> $GITHUB_STEP_SUMMARY
-          echo "- Dependency caching saves ~2-3 minutes on subsequent runs" >> $GITHUB_STEP_SUMMARY
-
-          # Count parallel jobs
-          QUALITY_JOBS=0
-          SECURITY_JOBS=0
-
-          [ "${{ needs.lint.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.typecheck.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.test.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.test_unit.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.test_integration.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.test_e2e.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.maestro_e2e.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.playwright_e2e.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.format.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.dead_code.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-          [ "${{ needs.sg_scan.result }}" != "skipped" ] && QUALITY_JOBS=$((QUALITY_JOBS + 1))
-
-          [ "${{ needs.sonarcloud.result }}" != "skipped" ] && SECURITY_JOBS=$((SECURITY_JOBS + 1))
-          [ "${{ needs.snyk.result }}" != "skipped" ] && SECURITY_JOBS=$((SECURITY_JOBS + 1))
-          [ "${{ needs.secret_scanning.result }}" != "skipped" ] && SECURITY_JOBS=$((SECURITY_JOBS + 1))
-          [ "${{ needs.license_compliance.result }}" != "skipped" ] && SECURITY_JOBS=$((SECURITY_JOBS + 1))
-          [ "${{ needs.zap_baseline.result }}" != "skipped" ] && SECURITY_JOBS=$((SECURITY_JOBS + 1))
-
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "## 🚀 Optimization Metrics" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "- **Parallel Quality Jobs**: $QUALITY_JOBS running concurrently" >> $GITHUB_STEP_SUMMARY
-          echo "- **Parallel Security Jobs**: $SECURITY_JOBS running concurrently" >> $GITHUB_STEP_SUMMARY
-          echo "- **Dependency Installation**: Single shared installation" >> $GITHUB_STEP_SUMMARY
-          echo "- **Estimated Time Saved**: ~40% vs sequential execution" >> $GITHUB_STEP_SUMMARY