@engineeros/connector 1.36.8 → 1.37.0

package/README.md

@@ -385,4 +385,43 @@ Manifests are strict internal JSON configuration with these required fields:
 | `evidence` | `metadata-only`. |
 | `evaluation` | `status` (`experimental` or `standard`) and a real evidence `reference`. Standard status requires completed comparative evaluation. |
 
-At most 16 providers may be registered per workspace even though the read-only catalog is larger. Local files must be regular files (resolve symlinks before registration). Inspection compares installed package metadata and entrypoint bytes; it does not verify the entire dependency tree. Local version/hash mismatches and unavailable files report preparation actions. Registered HTTPS providers may use connector-managed OAuth: open **Tools and plugins**, choose **Sign in**, and complete consent in the browser opened on the connected machine. The connector follows MCP authorization discovery, uses PKCE with a loopback callback, and advertises only status, scopes and expiry. Windows protects the credential payload with current-user DPAPI outside the repository; unsupported platform keychains fail closed. Sign out deletes the local credential but does not remove the provider registration. MCP protocol, runtime and index health remain unchecked until a provider pilot implements them. Every entry remains execution-disabled, even if authentication succeeds. Launch paths, endpoints, tokens, authorization codes and raw file errors are excluded from advertised inventory. Do not put secrets in labels, URLs, descriptions or evidence references.
+At most 16 providers may be registered per workspace even though the read-only catalog is larger. Local files must be regular files (resolve symlinks before registration). Inspection compares installed package metadata and entrypoint bytes; it does not verify the entire dependency tree. Local version/hash mismatches and unavailable files report preparation actions. Registered HTTPS providers may use connector-managed OAuth: open **Tools and plugins**, choose **Sign in**, and complete consent in the browser opened on the connected machine. The connector follows MCP authorization discovery, uses PKCE with a loopback callback, and advertises only status, scopes and expiry. Windows protects the credential payload with current-user DPAPI outside the repository; unsupported platform keychains fail closed. Sign out deletes the local credential but does not remove the provider registration. MCP protocol, runtime and index health remain unchecked until a provider pilot implements them. Every entry remains execution-disabled, even if authentication succeeds. Launch paths, endpoints, tokens, authorization codes and raw file errors are excluded from advertised inventory. Do not put secrets in labels, URLs, descriptions or evidence references.
+
+## Record CI test results
+
+Your CI can record each test suite's results in EngineerOS, where they sit beside manual and scheduled results on the project's Quality page, link to the test inventory, and open or resolve defects. No pairing is needed. Have your test runner write JUnit XML (pytest `--junitxml`, Vitest `--reporter=junit`, `jest-junit`, Playwright's `junit` reporter, `node --test --test-reporter=junit`, Maven Surefire, `go-junit-report`, `dotnet test --logger junit`), then run this after the tests, also when they failed:
+
+```sh
+npx --yes @engineeros/connector@latest results upload --label backend --junit "reports/**/*.xml" --coverage coverage.xml
+```
+
+Set three variables in the CI system: `ENGINEEROS_URL` (your EngineerOS address), `ENGINEEROS_API_TOKEN` (an organization API token with write access, from **Organization admin → API tokens**; keep it secret) and `ENGINEEROS_PROJECT_ID` (shown on the Quality page under **CI and schedules**). `--url`, `--token` and `--project-id` override them. The branch, commit and run link are read from GitHub Actions, GitLab CI, Azure Pipelines, Jenkins, CircleCI and Bitbucket Pipelines; `--branch`, `--commit` and `--run-url` override them.
+
+`--junit` and `--coverage` take paths or globs (`*`, `?`, `[abc]`, `**`) and can be repeated; quote globs so the command expands them the same way on every platform. Coverage is a Cobertura XML or lcov report. One upload takes at most 50 JUnit and 20 coverage reports of up to 20 MB each.
+
+Recording results never fails your build: without the variables (a fork's pull request has no secrets) the command says so and exits 0, and a missing report or a failed upload is printed as a warning (a GitHub Actions or Azure Pipelines annotation where available) with exit code 0. Pass `--strict` to exit non-zero instead. The token is never printed.
+
+### GitHub Action
+
+The `github-action` folder of this package is a composite action that runs the same command. It is published from a public repository rather than with the npm package:
+
+```yaml
+- name: Record test results in EngineerOS
+  if: ${{ !cancelled() }}
+  uses: engineeros/connector/github-action@v1
+  with:
+    label: backend
+    junit: |
+      reports/junit.xml
+      reports/e2e/*.xml
+    coverage: coverage.xml
+    url: ${{ vars.ENGINEEROS_URL }}
+    token: ${{ secrets.ENGINEEROS_API_TOKEN }}
+    project-id: ${{ vars.ENGINEEROS_PROJECT_ID }}
+```
+
+Inputs: `label` and `junit` (required; one path or glob per line), `coverage`, `url`, `token`, `project-id` (each defaults to its `ENGINEEROS_*` variable), `strict` (`"true"` fails the step when the results cannot be recorded) and `connector-version` (defaults to the connector release the action belongs to). The action sets up Node.js 22 only when the runner does not already have it.
+
+## Scheduled regression runs
+
+A project can schedule a test command on the Quality page (**CI and schedules**): a plain command line, the folder it runs in, a cron expression and its time zone, and optionally a test environment. When a run is due, EngineerOS sends it to an online connector of the person who last saved the schedule. The connector runs it exactly like a Goal's command Proof - without a shell, stopped after 15 minutes unless `ENGINEEROS_TEST_COMMAND_TIMEOUT_MS` says otherwise, with the output redacted - collects the JUnit and coverage reports the command wrote, and reports what it measured, together with the checked-out branch and commit. Scheduled runs on one connector run one at a time. When no connector is online the run is recorded as skipped, with the reason, and is not queued.