@metasession.co/devaudit-cli 0.1.5 → 0.1.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.1.5",
+    "@metasession.co/devaudit-plugin-sdk": "^0.1.7",
     "commander": "^12.1.0",
     "consola": "^3.2.3",
     "env-paths": "^3.0.0",

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -33,6 +33,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # full history so the merged commits' REQ tags are readable
 
       - name: Resolve DevAudit base URL and post-deploy terminal status
         run: |
@@ -76,12 +78,29 @@ jobs:
       - name: Resolve current release
         id: release
         run: |
-          DATE_PREFIX="v$(date +%Y.%m.%d)"
+          # Resolve the release being PROMOTED — the same REQ the dev/UAT
+          # pipeline versioned (ci.yml / compliance-evidence.yml use
+          # derive-release-version.sh → REQ-XXX). The merge commit itself
+          # carries no REQ tag, so derive it from the commits merged into
+          # this push ([REQ-XXX] subject tags / Ref: lines), and only fall
+          # back to a bare date when the consumer uses date-versioned
+          # releases. Without this, a REQ-versioned release never converges:
+          # production evidence + the prod-review advance land on a phantom
+          # date release while the real REQ release stays uat_approved.
+          REQ=$(git log "${{ github.event.before }}..${{ github.sha }}" --format='%s%n%b' 2>/dev/null \
+                | grep -oiE '\[REQ-[0-9]+\]|Ref:[[:space:]]*REQ-[0-9]+' \
+                | grep -oiE 'REQ-[0-9]+' | head -1 | tr '[:lower:]' '[:upper:]' || true)
+          if [ -n "$REQ" ]; then
+            PREFIX="$REQ"
+          else
+            PREFIX="v$(date +%Y.%m.%d)"
+          fi
+          echo "Resolving release for version prefix: ${PREFIX}"
           RESP=$(curl -s -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
-            "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${DATE_PREFIX}")
+            "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
           VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
           if [ -z "$VERSION" ]; then
-            VERSION="${DATE_PREFIX}"
+            VERSION="${PREFIX}"
           fi
           RELEASE_ID=$(echo "$RESP" | jq -r '.latest.id // empty')
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
@@ -135,6 +154,32 @@ jobs:
               ${FLAGS} || echo "Warning: Failed to upload smoke results"
           fi
 
+      - name: Upload release ticket to production
+        run: |
+          # Submit-for-production-review requires a release ticket (release_artifact)
+          # in the PRODUCTION environment — the dev/UAT pipeline only uploads it to
+          # uat. Carry the promoted release's ticket forward to production so the
+          # production release is self-contained and the prod-review gate passes.
+          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
+          VERSION="${{ steps.release.outputs.version }}"
+          FLAGS="--release ${VERSION} --create-release-if-missing --environment production --category release_artifact"
+          FLAGS="${FLAGS} --git-sha ${GIT_SHA} --ci-run-id ${CI_RUN} --branch main"
+          TICKET=""
+          for DIR in compliance/pending-releases compliance/approved-releases; do
+            if [ -f "${DIR}/RELEASE-TICKET-${VERSION}.md" ]; then
+              TICKET="${DIR}/RELEASE-TICKET-${VERSION}.md"
+              break
+            fi
+          done
+          if [ -n "$TICKET" ]; then
+            echo "Uploading release ticket to production: $TICKET"
+            bash scripts/upload-evidence.sh \
+              "${PROJECT_SLUG}" "_compliance-docs" compliance_document "$TICKET" \
+              ${FLAGS} || echo "Warning: Failed to upload release ticket to production"
+          else
+            echo "No RELEASE-TICKET-${VERSION}.md in pending-/approved-releases — skipping (date-versioned release or ticket archived)."
+          fi
+
       - name: Advance release status (post-deploy)
         run: |
           RELEASE_ID="${{ steps.release.outputs.release_id }}"