@metasession.co/devaudit-cli 0.1.4 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.1.4",
+    "@metasession.co/devaudit-plugin-sdk": "^0.1.6",
     "commander": "^12.1.0",
     "consola": "^3.2.3",
     "env-paths": "^3.0.0",

package/sdlc/files/_common/scripts/derive-release-version.sh

@@ -10,7 +10,9 @@
 #   2. Ref in commit body:        "Ref: REQ-037"                 -> REQ-037
 #   3. Fallback:                  bare date                      -> v2026.05.17
 #
-# Multi-REQ commits: first match wins; subject takes priority over body.
+# The id is taken from the bracketed subject tag or the `Ref:` line only —
+# NOT from arbitrary REQ mentions in prose (e.g. a body line "target close:
+# REQ-002" must not win over "Ref: REQ-001"). Subject takes priority over body.
 # Output: single line on stdout. Exit 0 in all normal cases.
 #
 # This ties a release record (project_id, version) to the feature the
@@ -24,15 +26,17 @@ set -euo pipefail
 SUBJECT=$(git log -1 --format='%s' 2>/dev/null || echo '')
 BODY=$(git log -1 --format='%b' 2>/dev/null || echo '')
 
-# 1. Subject: [REQ-XXX]
+# 1. Subject: [REQ-XXX] — the bracketed tag only, not other REQ mentions.
 if echo "$SUBJECT" | grep -qE '\[REQ-[0-9]+\]'; then
-  echo "$SUBJECT" | grep -oE 'REQ-[0-9]+' | head -1
+  echo "$SUBJECT" | grep -oE '\[REQ-[0-9]+\]' | head -1 | grep -oE 'REQ-[0-9]+'
   exit 0
 fi
 
-# 2. Body: Ref: REQ-XXX (case-insensitive on "Ref" and "REQ")
+# 2. Body: the id on the `Ref:` line only (case-insensitive on "Ref"/"REQ").
+# Scoping to the Ref: line prevents a prose mention earlier in the body
+# (e.g. "target close: REQ-002") from being picked over the real ref.
 if echo "$BODY" | grep -qiE 'Ref:[[:space:]]*REQ-[0-9]+'; then
-  echo "$BODY" | grep -ioE 'REQ-[0-9]+' | head -1 | tr '[:lower:]' '[:upper:]'
+  echo "$BODY" | grep -ioE 'Ref:[[:space:]]*REQ-[0-9]+' | head -1 | grep -oiE 'REQ-[0-9]+' | tr '[:lower:]' '[:upper:]'
   exit 0
 fi
 

package/sdlc/files/_common/scripts/derive-release-version.test.sh

@@ -90,6 +90,17 @@ assert_eq "subject overrides body conflict -> REQ-037" "REQ-037" "$(run_helper)"
 make_fixture "$WORK/c6" "chore: bump deps"
 assert_eq "no tag -> bare date $TODAY" "$TODAY" "$(run_helper)"
 
+# Case 7: a prose REQ mention earlier in the body must NOT beat the Ref:
+# line. Regression for the META-JOBS misattribution where "target close:
+# REQ-002" caused gate evidence to land on a REQ-002 release instead of
+# the real Ref: REQ-001.
+make_fixture "$WORK/c7" "chore(sdlc): accept dep advisories
+
+Dependency advisories accepted under R-001; target close: REQ-002.
+
+Ref: REQ-001"
+assert_eq "prose REQ-002 before Ref: REQ-001 -> REQ-001" "REQ-001" "$(run_helper)"
+
 echo ""
 echo "=== Summary: $PASS pass / $FAIL fail ==="
 

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -33,6 +33,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # full history so the merged commits' REQ tags are readable
 
       - name: Resolve DevAudit base URL and post-deploy terminal status
         run: |
@@ -76,12 +78,29 @@ jobs:
       - name: Resolve current release
         id: release
         run: |
-          DATE_PREFIX="v$(date +%Y.%m.%d)"
+          # Resolve the release being PROMOTED — the same REQ the dev/UAT
+          # pipeline versioned (ci.yml / compliance-evidence.yml use
+          # derive-release-version.sh → REQ-XXX). The merge commit itself
+          # carries no REQ tag, so derive it from the commits merged into
+          # this push ([REQ-XXX] subject tags / Ref: lines), and only fall
+          # back to a bare date when the consumer uses date-versioned
+          # releases. Without this, a REQ-versioned release never converges:
+          # production evidence + the prod-review advance land on a phantom
+          # date release while the real REQ release stays uat_approved.
+          REQ=$(git log "${{ github.event.before }}..${{ github.sha }}" --format='%s%n%b' 2>/dev/null \
+                | grep -oiE '\[REQ-[0-9]+\]|Ref:[[:space:]]*REQ-[0-9]+' \
+                | grep -oiE 'REQ-[0-9]+' | head -1 | tr '[:lower:]' '[:upper:]' || true)
+          if [ -n "$REQ" ]; then
+            PREFIX="$REQ"
+          else
+            PREFIX="v$(date +%Y.%m.%d)"
+          fi
+          echo "Resolving release for version prefix: ${PREFIX}"
           RESP=$(curl -s -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
-            "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${DATE_PREFIX}")
+            "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
           VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
           if [ -z "$VERSION" ]; then
-            VERSION="${DATE_PREFIX}"
+            VERSION="${PREFIX}"
           fi
           RELEASE_ID=$(echo "$RESP" | jq -r '.latest.id // empty')
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"