@metasession.co/devaudit-cli 0.1.21 → 0.1.22
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@metasession.co/devaudit-cli",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.22",
|
|
4
4
|
"description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
},
|
|
34
34
|
"dependencies": {
|
|
35
35
|
"@clack/prompts": "^0.8.2",
|
|
36
|
-
"@metasession.co/devaudit-plugin-sdk": "^0.1.
|
|
36
|
+
"@metasession.co/devaudit-plugin-sdk": "^0.1.22",
|
|
37
37
|
"commander": "^12.1.0",
|
|
38
38
|
"consola": "^3.2.3",
|
|
39
39
|
"env-paths": "^3.0.0",
|
|
@@ -70,8 +70,18 @@ jobs:
|
|
|
70
70
|
esac
|
|
71
71
|
# Bootstrap probe (#301): project may not exist in DevAudit yet —
|
|
72
72
|
# the first compliance-evidence.yml run auto-creates it. A 404 here
|
|
73
|
-
# means we're on the introducing PR; pass with a
|
|
73
|
+
# means we're on the introducing PR; pass with a warning. 401/403
|
|
74
74
|
# means the API key is invalid → fail (not bootstrap).
|
|
75
|
+
#
|
|
76
|
+
# Defense in depth (#74): if /api/ci/projects/<slug> 404s we
|
|
77
|
+
# cross-check against /api/ci/releases/resolve — a known-good
|
|
78
|
+
# read endpoint scoped to the same project. If THAT returns 2xx
|
|
79
|
+
# the project clearly exists, and the projects-endpoint 404 is a
|
|
80
|
+
# portal-side bug. Failing closed beats silently passing the
|
|
81
|
+
# four-eyes gate. The original "GET /api/ci/projects/<slug>"
|
|
82
|
+
# endpoint didn't exist on the portal before metasession-dev/
|
|
83
|
+
# devaudit#NN, so this exact false-positive was the universal
|
|
84
|
+
# state of the gate across every consumer.
|
|
75
85
|
PROJ_CODE=$(curl -s -o /dev/null -w "%{http_code}" -m 10 \
|
|
76
86
|
-H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
|
|
77
87
|
"${BASE%/}/api/ci/projects/${PROJECT_SLUG}" || echo "000")
|
|
@@ -80,9 +90,34 @@ jobs:
|
|
|
80
90
|
echo "DevAudit project '${PROJECT_SLUG}' confirmed (HTTP ${PROJ_CODE})"
|
|
81
91
|
;;
|
|
82
92
|
404)
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
93
|
+
# Cross-check: does the project actually exist? versionPrefix=v
|
|
94
|
+
# matches every release version shape (REQ-XXX, vYYYY.MM.DD,
|
|
95
|
+
# vX.Y.Z) — we don't care about the body, only whether the
|
|
96
|
+
# endpoint authorises the project. Endpoint returns 200 even
|
|
97
|
+
# when no releases match the prefix (just with latest: null).
|
|
98
|
+
CROSS_CODE=$(curl -s -o /dev/null -w "%{http_code}" -m 10 \
|
|
99
|
+
-H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
|
|
100
|
+
"${BASE%/}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=v" \
|
|
101
|
+
|| echo "000")
|
|
102
|
+
case "$CROSS_CODE" in
|
|
103
|
+
2*)
|
|
104
|
+
echo "::error::Portal /api/ci/projects/${PROJECT_SLUG} returned 404 but releases/resolve confirms the project exists (HTTP ${CROSS_CODE}). This is a portal-side issue (missing or broken endpoint), not a bootstrap. Failing closed to avoid silently bypassing the four-eyes gate. Triage at metasession-dev/devaudit (and/or DevAudit-Installer#75)."
|
|
105
|
+
exit 1
|
|
106
|
+
;;
|
|
107
|
+
404)
|
|
108
|
+
echo "::warning::DevAudit project '${PROJECT_SLUG}' does not exist yet (HTTP 404 from both /api/ci/projects and /api/ci/releases/resolve) — bootstrap mode. Gate passes. The project will be auto-created by the first compliance-evidence.yml run; enforcement kicks in on the next PR after that."
|
|
109
|
+
echo "BOOTSTRAP_MODE=true" >> "$GITHUB_ENV"
|
|
110
|
+
exit 0
|
|
111
|
+
;;
|
|
112
|
+
401|403)
|
|
113
|
+
echo "::error::DevAudit returned HTTP ${CROSS_CODE} for releases/resolve on project '${PROJECT_SLUG}' (cross-check after the projects endpoint 404'd) — API key is invalid or lacks access. Verify DEVAUDIT_API_KEY belongs to the right project."
|
|
114
|
+
exit 1
|
|
115
|
+
;;
|
|
116
|
+
*)
|
|
117
|
+
echo "::error::Cross-check endpoint /api/ci/releases/resolve returned unexpected HTTP ${CROSS_CODE} after the projects endpoint 404'd. Investigate before retrying."
|
|
118
|
+
exit 1
|
|
119
|
+
;;
|
|
120
|
+
esac
|
|
86
121
|
;;
|
|
87
122
|
401|403)
|
|
88
123
|
echo "::error::DevAudit returned HTTP ${PROJ_CODE} for project '${PROJECT_SLUG}' — API key is invalid or lacks access. Verify DEVAUDIT_API_KEY belongs to the right project."
|