@codyswann/lisa 2.121.0 → 2.122.0

package/plugins/lisa-expo-copilot/skills/ops-verify-health/SKILL.md

@@ -0,0 +1,101 @@
+---
+name: ops-verify-health
+description: Health check all services across environments. Checks frontend URLs, backend GraphQL endpoints, and reports response times.
+allowed-tools:
+  - Bash
+  - Read
+---
+
+# Ops: Verify Health
+
+Health check all services across environments.
+
+**Argument**: `$ARGUMENTS` — environment(s) to check (default: `all`). Options: `local`, `dev`, `staging`, `production`, `all`
+
+## Discovery
+
+Read these files to build the environment URL table:
+
+1. `e2e/constants.ts` — frontend URLs per environment
+2. `.env.localhost`, `.env.development`, `.env.staging`, `.env.production` — `EXPO_PUBLIC_GRAPHQL_BASE_URL` for backend GraphQL URLs
+
+## Health Checks
+
+For each environment, run these checks:
+
+### Frontend Check
+
+```bash
+curl -sf -o /dev/null -w "HTTP %{http_code} in %{time_total}s" {frontend_url}
+```
+
+Verify the response contains Expo/React markers:
+```bash
+curl -sf {frontend_url} | head -20
+```
+
+### Backend GraphQL Check
+
+```bash
+curl -sf {graphql_url} -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{ __typename }"}' \
+  -w "\nHTTP %{http_code} in %{time_total}s\n"
+```
+
+### GraphQL Introspection (detailed check)
+
+```bash
+curl -sf {graphql_url} -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"query":"{ __schema { queryType { name } } }"}' \
+  -w "\nHTTP %{http_code} in %{time_total}s\n"
+```
+
+## Full Health Check Script
+
+Run all checks for the specified environment(s):
+
+```bash
+check_env() {
+  local ENV=$1
+  local FE_URL=$2
+  local BE_URL=$3
+
+  echo "=== $ENV ==="
+
+  # Frontend
+  FE_STATUS=$(curl -sf -o /dev/null -w "%{http_code}" --max-time 10 "$FE_URL" 2>/dev/null || echo "000")
+  FE_TIME=$(curl -sf -o /dev/null -w "%{time_total}" --max-time 10 "$FE_URL" 2>/dev/null || echo "timeout")
+  echo "Frontend: HTTP $FE_STATUS ($FE_TIME s)"
+
+  # Backend
+  BE_RESULT=$(curl -sf --max-time 10 "$BE_URL" -X POST \
+    -H "Content-Type: application/json" \
+    -d '{"query":"{ __typename }"}' \
+    -w "\n%{http_code} %{time_total}" 2>/dev/null || echo -e "\n000 timeout")
+  BE_STATUS=$(echo "$BE_RESULT" | tail -1 | awk '{print $1}')
+  BE_TIME=$(echo "$BE_RESULT" | tail -1 | awk '{print $2}')
+  echo "Backend:  HTTP $BE_STATUS ($BE_TIME s)"
+  echo ""
+}
+```
+
+## EAS Update Status
+
+Check the latest OTA updates deployed to each branch:
+
+```bash
+eas update:list --branch {env} --limit 3
+```
+
+## Output Format
+
+Report results as a table:
+
+| Service | Environment | Status | Response Time | Details |
+|---------|-------------|--------|---------------|---------|
+| Frontend | dev | UP (200) | 0.45s | HTML contains React root |
+| Backend | dev | UP (200) | 0.32s | GraphQL responds `__typename` |
+
+Flag any service with status != 200 or response time > 5s as a concern.

package/plugins/lisa-expo-copilot/skills/owasp-zap/SKILL.md

@@ -0,0 +1,56 @@
+# OWASP ZAP Baseline Scanning
+
+OWASP ZAP (Zed Attack Proxy) performs DAST (Dynamic Application Security Testing) by scanning a running application for common security vulnerabilities from the OWASP Top 10.
+
+## When to Use
+
+- After making changes to HTTP headers, authentication, or security middleware
+- Before deploying to staging or production
+- When reviewing security scan results from CI
+- When triaging ZAP findings from pull request checks
+
+## Running Locally
+
+```bash
+# Requires Docker to be installed and running
+bash scripts/zap-baseline.sh
+```
+
+The scan builds the Expo web export, serves it locally, and runs ZAP against it. Reports are saved to `zap-report.html`, `zap-report.json`, and `zap-report.md`.
+
+## Interpreting Results
+
+ZAP findings are categorized by risk level:
+
+| Risk | Action |
+|------|--------|
+| **High** | Fix immediately — indicates exploitable vulnerability |
+| **Medium** | Fix before deployment — security best practice violation |
+| **Low** | Fix when convenient — minor security improvement |
+| **Informational** | Review — may be false positive or acceptable risk |
+
+## Common Findings and Fixes
+
+### Infrastructure-Level (fix at CDN/hosting, not in code)
+
+- **CSP Header Not Set**: Configure Content-Security-Policy at CDN or hosting platform. Expo web exports need `script-src 'self' 'unsafe-inline'` for hydration.
+- **HSTS Not Set**: Configure Strict-Transport-Security at CDN/load balancer.
+- **X-Frame-Options**: Use `frame-ancestors` in CSP at CDN level.
+
+### Application-Level (fix in code)
+
+- **Cookie flags missing**: Ensure all cookies set `HttpOnly`, `Secure`, and `SameSite` attributes.
+- **Debug error messages**: Ensure error boundaries don't leak stack traces in production.
+- **Server version disclosure**: Remove or mask the `Server` response header.
+
+## Configuration
+
+ZAP scan rules are configured in `.zap/baseline.conf`. Each line controls how ZAP treats a specific rule:
+
+- `IGNORE`: Skip the rule entirely
+- `WARN`: Report finding but don't fail the build
+- `FAIL`: Fail the build if this finding is detected
+
+## CI Integration
+
+ZAP runs automatically in CI via the `zap-baseline.yml` workflow. Results are uploaded as artifacts and the build fails on medium+ severity findings.

package/plugins/lisa-expo-copilot/skills/playwright-ci-debugging/SKILL.md

@@ -0,0 +1,140 @@
+---
+name: playwright-ci-debugging
+description: Debug Playwright E2E tests that pass locally but fail in CI (or vice versa) in Expo web projects. Covers local reproduction, network interception, CI environment discovery, commit SHA verification, and robust interaction patterns that eliminate flake. Use this skill when a Playwright test is failing in CI, a test is flaky, a PR is blocked by E2E checks, or you need to investigate CI-specific test behavior. Trigger on mentions of CI failure, failing Playwright test, flaky E2E test, or debugging E2E in CI.
+---
+
+# Debugging Playwright E2E Failures in CI
+
+The authoring-side rules (selectors, testID forwarding, naming) are in the `playwright-selectors` skill. This skill is for the other half of the job: when a test fails in CI and you need to find out why.
+
+## Debugging Order
+
+When a Playwright E2E test fails in CI, follow this exact order.
+
+### 1. Reproduce locally first — before anything else
+
+Start the project's dev server, then run the failing test in isolation:
+
+```bash
+# Start the dev server (discover the script from package.json — commonly `start`, `dev`, `start:dev`, or `web`)
+<pkg-manager> run <dev-script>
+
+# In another terminal, run the exact failing test with no retries
+BASE_URL=http://localhost:8081/ npx playwright test <file> --grep "<test name>" --retries=0
+```
+
+`--retries=0` is critical — retries mask flake. `--grep` isolates the single failing test so you're not waiting on a full suite.
+
+**Do NOT read source code, CI logs, or theorize until you can reproduce locally.** Most CI failures reproduce locally if you run the same test against the same served build. Guessing from logs is slow and usually wrong.
+
+### 2. Intercept the network request
+
+When a test involves an API call, set up a Playwright response listener and inspect the status code and response body. A 400/500 response tells you everything.
+
+```typescript
+page.on("response", async (response) => {
+  if (response.url().includes("/api/")) {
+    console.log(response.status(), response.url(), await response.text());
+  }
+});
+```
+
+UI failures are often downstream of a failed API call. The network log is cheaper evidence than the DOM.
+
+### 3. If it doesn't reproduce locally, understand the CI environment first
+
+CI runs against a different environment than your laptop. Before changing anything:
+
+- Find the CI job that runs Playwright (usually `.github/workflows/*.yml`).
+- Identify which `.env.*` file it loads — this varies by target branch (e.g., dev → `.env.development`, staging → `.env.staging`).
+- Note that CI typically builds a static web bundle (`expo export --platform web`) then serves it on `localhost:8081` via `serve dist`. It is NOT hitting your dev server. Timing, bundling, and env vars all differ.
+- Reproduce the CI setup locally: build the static bundle, serve it the same way, then run the test. If it now fails locally, you've isolated an env/build difference.
+
+### 4. Verify commit SHA before trusting CI results
+
+After pushing, confirm the CI run's `headSha` matches your latest commit:
+
+```bash
+gh run list --branch "$(git branch --show-current)" --limit 1 --json headSha,status,conclusion
+git rev-parse HEAD
+```
+
+Bots (review-response, auto-update, dependabot) can push commits between your push and the CI run, overwriting your changes. A green check on a stale SHA tells you nothing about your fix.
+
+## Patterns That Eliminate Flake
+
+### Never use fixed waits before interactions
+
+`waitForTimeout()` as the sole wait before a click is a silent failure waiting to happen — animations and rendering take variable time, especially on slower CI runners. Poll for the expected state, then act.
+
+```typescript
+// BAD — fixed wait; click silently fails if element not yet visible
+await clickVisibleText(page, "Translate");
+await page.waitForTimeout(1000);
+await clickVisibleText(page, "Spanish");
+
+// GOOD — poll for visibility, then click
+await clickVisibleText(page, "Translate");
+await expect
+  .poll(() => hasVisibleText(page, "Spanish"), { timeout: TIMEOUT.expect })
+  .toBe(true);
+await clickVisibleText(page, "Spanish");
+```
+
+### Never silently swallow click return values
+
+Any helper that can return `false` on a missed click (e.g., `clickVisibleText`) should either have its return value asserted or be preceded by a visibility poll. A click that silently returns `false` is a hidden test bug — the test proceeds as if the click happened and fails downstream with a confusing error.
+
+```typescript
+// BAD — return value ignored; test continues on failed click
+await clickVisibleText(page, "Submit");
+
+// GOOD — assert the click happened
+expect(await clickVisibleText(page, "Submit")).toBe(true);
+
+// GOOD — precede with visibility poll
+await expect
+  .poll(() => hasVisibleText(page, "Submit"), { timeout: TIMEOUT.expect })
+  .toBe(true);
+await clickVisibleText(page, "Submit");
+```
+
+### E2E tests must not depend on external API success
+
+Any test that calls an external service (AWS Bedrock, third-party APIs, rate-limited providers) must handle the failure case. Tests should verify UI behavior, not external service uptime. If an external call might fail, the test must accept both outcomes or skip the dependent assertion.
+
+```typescript
+// BAD — assumes translation always succeeds
+await expect
+  .poll(() => hasVisibleText(page, "Show Original"), { timeout: TIMEOUT.expect })
+  .toBe(true);
+
+// GOOD — handle both success and failure
+await expect
+  .poll(
+    async () =>
+      (await hasVisibleText(page, "Show Original")) ||
+      (await hasVisibleText(page, "Translate")),
+    { timeout: TIMEOUT.expect }
+  )
+  .toBe(true);
+
+const translated = await hasVisibleText(page, "Show Original");
+if (!translated) return; // External API failed; skip downstream assertions
+```
+
+The alternative — mocking the external call — is a valid approach when the goal is to test the UI's handling of a successful response. Pick one strategy per test and commit to it.
+
+### E2E assertions must not depend on specific test data
+
+Do not assert specific text (e.g., "No lists detected") when the test user's data state varies across environments. If a zero-row state could have different empty-state messages depending on the user's data, either check for multiple possible states or skip the assertion entirely.
+
+See the `playwright-selectors` skill's "Data independence" section for authoring patterns that avoid this class of bug in the first place.
+
+## Escalation
+
+If you've worked through steps 1–4 and still cannot explain the failure:
+
+- Do NOT disable, skip, or `.fixme` the test to unblock the PR.
+- Do NOT use `--admin` or force-merge to bypass the check.
+- Escalate to a human with: the failing test name, your local reproduction attempt, the network trace, and the commit SHA verification. A real flake that cannot be root-caused is a legitimate reason to pause; it is never a reason to merge red.