@guilz-dev/sdlc-gh 0.1.0

package/.github/workflows/nightly-harness-review.md

@@ -0,0 +1,87 @@
+---
+description: Nightly harness review — classify failures and propose harness revisions.
+name: Nightly harness review
+on:
+  schedule:
+    - cron: "0 2 * * *"
+permissions:
+  contents: read
+  issues: read
+safe-outputs:
+  create-pull-request:
+    max: 1
+  create-issue:
+    max: 3
+---
+
+# Nightly harness review (gh-aw source)
+
+> **Operational baseline:** [nightly-harness-review.yml](./nightly-harness-review.yml) runs on standard GitHub Actions without gh-aw. Use this Markdown source only when promoting to gh-aw per [docs/gh-aw-dogfood.md](../../docs/gh-aw-dogfood.md).
+
+## Required inputs
+
+| Input | Source | Required |
+|-------|--------|----------|
+| Telemetry JSON artifacts | Inner-loop workflows (`harness-ci`, `eval-ci`, retry, PR context) | yes |
+| Aggregation window | Default 24h; match GHA `WINDOW_HOURS` | yes |
+| Failure taxonomy | [docs/failure-taxonomy.md](../../docs/failure-taxonomy.md) | yes |
+| Harness review summary | `harness-review/harness-review-summary.json` from GHA aggregator | yes when chaining |
+
+## Forbidden operations
+
+- Do **not** auto-merge pull requests
+- Do **not** modify product application code outside harness paths
+- Do **not** disable CI walls or bypass `safe-output` limits
+- Do **not** replace the GHA nightly job without dogfood criteria green
+
+## Expected outputs
+
+| Output | Format | Limit |
+|--------|--------|-------|
+| Harness revision proposal | Pull request (`autonomy:L0`) | `create-pull-request.max: 1` |
+| Routed work items | GitHub issues with dedupe markers | `create-issue.max: 3` |
+| Human summary | Markdown tables in step summary / artifact | reviewable text only |
+
+Issue routing rules (GHA implementation): [docs/nightly-harness-review.md](../../docs/nightly-harness-review.md#issue-routing).
+
+## Classification contract
+
+Classify each task group into one of:
+
+- **FF不足** — repeated convention / lint / issue-spec gaps → harness revision
+- **壁不足** — CI green but review rejects → add walls (tests, lint, contracts)
+- **モデル限界** — retry exhaustion or repeated execution failures → escalate / split task
+
+Use `rollup.repeated_failure_signatures` and per-task `classifications[]` from the summary JSON schema (`scripts/lib/harness-review.mjs`).
+
+## Escalation
+
+Escalate to humans (issue comment or `create-issue`) when:
+
+- `classification` is `モデル限界` with security `wall_failure_type`
+- the same `harness-routing-key` fires three nightly windows in a row without resolution
+- gh-aw compile or safe-output validation fails on this source
+
+## Fallback when gh-aw regresses
+
+1. Keep **GHA** [nightly-harness-review.yml](./nightly-harness-review.yml) as the operational outer loop
+2. Revert `.md` / `.lock.yml` pair per [docs/revert-playbook.md](../../docs/revert-playbook.md)
+3. Record incident in dogfood report artifact (`docs/gh-aw-dogfood.md`)
+
+## Promotion criteria (gh-aw vs GHA)
+
+Promote gh-aw execution only when **all** hold:
+
+- Dogfood CI green for ≥3 consecutive runs on unchanged `.md` sources
+- GHA nightly review and gh-aw classification outputs agree on fixture summaries
+- `create-pull-request.max` remains `1` and no forbidden safe-outputs appear
+
+Until then, treat this file as the **specification** and GHA as the **runtime**.
+
+## Agent instructions
+
+Analyze failure traces per [docs/failure-taxonomy.md](../../docs/failure-taxonomy.md).
+
+When repeated **FF不足** or **壁不足** patterns appear in the summary JSON, ensure routed issues exist (GHA runs `scripts/route-harness-review.mjs`) or propose a harness revision PR with eval / instruction diffs only.
+
+Do not auto-merge. Prefer proposal-only PRs at `autonomy:L0`.

package/.github/workflows/nightly-harness-review.yml

@@ -0,0 +1,63 @@
+name: Nightly harness review
+
+on:
+  schedule:
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+    inputs:
+      window_hours:
+        description: Hours of telemetry to aggregate
+        required: false
+        default: "24"
+      apply_routing:
+        description: Apply issue routing instead of dry-run preview
+        required: false
+        default: false
+        type: boolean
+
+permissions:
+  actions: read
+  contents: read
+  issues: write
+
+jobs:
+  review:
+    name: aggregate-and-classify
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Fetch telemetry artifacts
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          WINDOW_HOURS: ${{ github.event_name == 'workflow_dispatch' && inputs.window_hours || 24 }}
+          TELEMETRY_COLLECT_DIR: telemetry-collected
+        run: node scripts/fetch-telemetry-artifacts.mjs
+
+      - name: Aggregate and classify failures
+        env:
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          WINDOW_HOURS: ${{ github.event_name == 'workflow_dispatch' && inputs.window_hours || 24 }}
+          TELEMETRY_COLLECT_DIR: telemetry-collected
+          HARNESS_REVIEW_OUT_DIR: harness-review
+        run: node scripts/aggregate-harness-review.mjs
+
+      - name: Route repeated failures to issues
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          HARNESS_REVIEW_OUT_DIR: harness-review
+          HARNESS_ROUTING_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.apply_routing != true && '1' || '0' }}
+        run: node scripts/route-harness-review.mjs
+
+      - name: Upload harness review summary
+        uses: actions/upload-artifact@v4
+        with:
+          name: nightly-harness-review-${{ github.run_id }}
+          path: harness-review/
+          if-no-files-found: error

package/.github/workflows/npm-publish.yml

@@ -0,0 +1,49 @@
+name: npm publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          registry-url: https://registry.npmjs.org
+
+      - name: Verify package version matches release tag
+        if: github.event_name == 'release'
+        run: |
+          TAG="${{ github.event.release.tag_name }}"
+          TAG="${TAG#v}"
+          PKG="$(node --input-type=module -e "import p from './package.json' with { type: 'json' }; console.log(p.version)")"
+          if [ "$TAG" != "$PKG" ]; then
+            echo "Release tag ($TAG) must match package.json version ($PKG)" >&2
+            exit 1
+          fi
+
+      - name: Validate package contents
+        run: |
+          npm run validate
+          npm run test-sdlc-gh-cli
+          npm run test-setup-wizard
+          npm pack --dry-run
+
+      - name: Publish to npm (dry run)
+        if: github.event_name == 'workflow_dispatch'
+        run: npm publish --dry-run --provenance --access public
+
+      - name: Publish to npm
+        if: github.event_name == 'release'
+        run: npm publish --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/pr-context-comment.yml

@@ -0,0 +1,138 @@
+name: PR context comment
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  pull-requests: write
+  checks: read
+
+jobs:
+  context:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build context
+        id: ctx
+        shell: bash
+        env:
+          LANGFUSE_HOST: ${{ vars.LANGFUSE_HOST }}
+          BASE_REF: ${{ github.base_ref }}
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ', ') }}
+        run: |
+          BASE="origin/${BASE_REF}"
+          LOC=$(git diff --numstat "$BASE"...HEAD | awk '{a+=$1;d+=$2} END {print a+d+0}')
+          FILES=$(git diff --name-only "$BASE"...HEAD | wc -l | tr -d ' ')
+          LABELS="${PR_LABELS}"
+          RETRY=$(echo "$LABELS" | tr ',' '\n' | grep -o 'retry:[0-9]*' | head -1 || true)
+          INS_SHA=$(git log -1 --format=%H -- .github/copilot-instructions.md AGENTS.md 2>/dev/null || echo "n/a")
+          SKILLS_SHA=$(git log -1 --format=%H -- .github/skills 2>/dev/null || echo "n/a")
+          if [[ -f evals/.score-baseline.json ]]; then
+            EVAL_SCORE=$(node -e "const b=require('./evals/.score-baseline.json'); console.log(b.eval_pass_rate+'%')")
+          else
+            EVAL_SCORE="n/a"
+          fi
+          if [[ -n "$LANGFUSE_HOST" ]]; then
+            TRACE="${LANGFUSE_HOST%/} (search: repo=${{ github.repository }}, pr_number=${{ github.event.pull_request.number }})"
+          else
+            TRACE="_configure LANGFUSE_HOST; then search by repo=${{ github.repository }}, pr_number=${{ github.event.pull_request.number }}_"
+          fi
+          THREAT_STATUS="n/a"
+          {
+            echo "loc=$LOC"
+            echo "files=$FILES"
+            echo "labels=$LABELS"
+            echo "retry=$RETRY"
+            echo "ins_sha=$INS_SHA"
+            echo "skills_sha=$SKILLS_SHA"
+            echo "eval_score=$EVAL_SCORE"
+            echo "trace=$TRACE"
+            echo "threat_status=$THREAT_STATUS"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Post comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { data: checks } = await github.rest.checks.listForRef({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              ref: context.payload.pull_request.head.sha,
+            });
+            const failed = checks.check_runs.filter((c) => c.conclusion === 'failure').map((c) => c.name);
+            const ciSummary = failed.length ? `❌ ${failed.join(', ')}` : '✅ no failures (or pending)';
+            const body = `## Harness context (auto)
+
+            | Field | Value |
+            |-------|-------|
+            | Diff LOC | ${{ steps.ctx.outputs.loc }} |
+            | Changed files | ${{ steps.ctx.outputs.files }} |
+            | Labels | ${{ steps.ctx.outputs.labels }} |
+            | Retry | ${{ steps.ctx.outputs.retry }} |
+            | Instructions SHA | \`${{ steps.ctx.outputs.ins_sha }}\` |
+            | Skills SHA | \`${{ steps.ctx.outputs.skills_sha }}\` |
+            | Eval score (baseline) | ${{ steps.ctx.outputs.eval_score }} |
+            | AI credits | _set max-ai-credits in org settings_ |
+            | Trace link | ${{ steps.ctx.outputs.trace }} |
+            | Threat detection | ${{ steps.ctx.outputs.threat_status }} |
+            | CI | ${ciSummary} |
+
+            <!-- harness-pr-context -->
+            `;
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            const existing = comments.find((c) => c.body?.includes('harness-pr-context'));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body,
+              });
+            }
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Emit PR context telemetry artifact
+        continue-on-error: true
+        env:
+          TELEMETRY_SOURCE: pr-context
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_RUN_ID: ${{ github.run_id }}
+          GITHUB_RUN_ATTEMPT: ${{ github.run_attempt }}
+          GITHUB_WORKFLOW: ${{ github.workflow }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          PR_LABELS: ${{ join(github.event.pull_request.labels.*.name, ',') }}
+          BASE_SHA: origin/${{ github.base_ref }}
+          CHANGED_FILES: ${{ steps.ctx.outputs.files }}
+          DIFF_LOC: ${{ steps.ctx.outputs.loc }}
+          AGENT_TYPE: implementer
+          EXECUTION_MODE: coding_agent
+          FINAL_OUTCOME: in_progress
+        run: node scripts/emit-telemetry-artifact.mjs
+
+      - name: Upload PR context telemetry artifact
+        continue-on-error: true
+        uses: actions/upload-artifact@v4
+        with:
+          name: pr-context-telemetry-${{ github.run_id }}
+          path: telemetry-artifacts/
+          if-no-files-found: ignore

package/.github/workflows/product-ci-go.yml

@@ -0,0 +1,33 @@
+name: Product CI (Go)
+
+on:
+  workflow_call:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve project directory
+        id: root
+        shell: bash
+        run: |
+          if [[ -f sample/go/go.mod ]]; then
+            echo "dir=sample/go" >> "$GITHUB_OUTPUT"
+          elif [[ -f go.mod ]]; then
+            echo "dir=." >> "$GITHUB_OUTPUT"
+          else
+            echo "No Go project found" >&2
+            exit 1
+          fi
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Vet and test
+        working-directory: ${{ steps.root.outputs.dir }}
+        run: |
+          go vet ./...
+          go test ./...

package/.github/workflows/product-ci-php.yml

@@ -0,0 +1,39 @@
+name: Product CI (PHP)
+
+on:
+  workflow_call:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve project directory
+        id: root
+        shell: bash
+        run: |
+          if [[ -f sample/php/composer.json ]]; then
+            echo "dir=sample/php" >> "$GITHUB_OUTPUT"
+          elif [[ -f composer.json ]]; then
+            echo "dir=." >> "$GITHUB_OUTPUT"
+          else
+            echo "No PHP project found" >&2
+            exit 1
+          fi
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: "8.2"
+          coverage: none
+          tools: composer
+
+      - name: Install dependencies
+        working-directory: ${{ steps.root.outputs.dir }}
+        run: composer install --no-interaction --prefer-dist
+
+      - name: Lint and test
+        working-directory: ${{ steps.root.outputs.dir }}
+        run: |
+          composer lint
+          composer test

package/.github/workflows/product-ci-python.yml

@@ -0,0 +1,34 @@
+name: Product CI (Python)
+
+on:
+  workflow_call:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve project directory
+        id: root
+        shell: bash
+        run: |
+          if [[ -f sample/python/requirements-dev.txt ]]; then
+            echo "dir=sample/python" >> "$GITHUB_OUTPUT"
+          elif [[ -f requirements-dev.txt ]]; then
+            echo "dir=." >> "$GITHUB_OUTPUT"
+          else
+            echo "No Python project found" >&2
+            exit 1
+          fi
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Lint and test
+        working-directory: ${{ steps.root.outputs.dir }}
+        run: |
+          pip install -r requirements-dev.txt
+          ruff check .
+          pytest -q

package/.github/workflows/product-ci-ruby.yml

@@ -0,0 +1,35 @@
+name: Product CI (Ruby)
+
+on:
+  workflow_call:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve project directory
+        id: root
+        shell: bash
+        run: |
+          if [[ -f sample/ruby/Gemfile ]]; then
+            echo "dir=sample/ruby" >> "$GITHUB_OUTPUT"
+          elif [[ -f Gemfile ]]; then
+            echo "dir=." >> "$GITHUB_OUTPUT"
+          else
+            echo "No Ruby project found" >&2
+            exit 1
+          fi
+
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: "3.3"
+          bundler-cache: true
+          working-directory: ${{ steps.root.outputs.dir }}
+
+      - name: Lint and test
+        working-directory: ${{ steps.root.outputs.dir }}
+        run: |
+          bundle exec rubocop
+          bundle exec rspec

package/.github/workflows/product-ci-ts.yml

@@ -0,0 +1,37 @@
+name: Product CI (TypeScript)
+
+on:
+  workflow_call:
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Resolve project directory
+        id: root
+        shell: bash
+        run: |
+          if [[ -f sample/ts/package.json ]]; then
+            echo "dir=sample/ts" >> "$GITHUB_OUTPUT"
+          elif [[ -f package.json ]]; then
+            echo "dir=." >> "$GITHUB_OUTPUT"
+          else
+            echo "No TypeScript project found" >&2
+            exit 1
+          fi
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: ${{ steps.root.outputs.dir }}/package-lock.json
+
+      - name: Install, lint, typecheck, test
+        working-directory: ${{ steps.root.outputs.dir }}
+        run: |
+          npm ci
+          npm run lint
+          npm run typecheck
+          npm test

package/.github/workflows/task-issue-label-sync.yml

@@ -0,0 +1,50 @@
+name: Task issue label sync
+
+on:
+  issues:
+    types: [opened, edited, reopened]
+
+permissions:
+  issues: write
+
+jobs:
+  sync-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Sync labels from Task Issue form
+        uses: actions/github-script@v7
+        env:
+          ISSUE_BODY: ${{ github.event.issue.body }}
+          ISSUE_LABELS: ${{ join(github.event.issue.labels.*.name, '||') }}
+        with:
+          script: |
+            const { parseTaskIssueSelections, planIssueLabels } = await import(
+              `${process.env.GITHUB_WORKSPACE}/scripts/lib/issue-form-label-sync.mjs`
+            );
+            const existingLabels = (process.env.ISSUE_LABELS || "")
+              .split("||")
+              .map((label) => label.trim())
+              .filter(Boolean);
+            const parsed = parseTaskIssueSelections(process.env.ISSUE_BODY || "");
+            if (!parsed.isTaskIssue) {
+              core.info("Issue does not match the Task Issue form; skipping.");
+              return;
+            }
+            const plan = planIssueLabels(existingLabels, parsed);
+            if (!plan.changed) {
+              core.info(plan.reason);
+              return;
+            }
+            await github.rest.issues.setLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: plan.labels,
+            });
+            core.notice(`Applied labels: ${plan.labels.join(", ")}`);