@metasession.co/devaudit-cli 0.1.70 → 0.1.72

package/sdlc/files/ci/ci.yml.template

@@ -288,14 +288,47 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Release version: ${VERSION}"
 
-      - name: Ensure release exists
+      - name: Check release exists (no creation — deferred to upload-evidence)
         if: env.DEVAUDIT_BASE_URL != ''
         run: |
+          # Release creation is deferred to the upload-evidence job (which
+          # runs after gates pass) so the portal never shows a release from
+          # a push where gates weren't verified (devaudit-installer#226).
+          # This step only checks whether the release already exists (e.g.
+          # created earlier by sdlc-implementer Phase 1 step 3).
           chmod +x scripts/upload-evidence.sh 2>/dev/null || true
-          # Create the release in DevAudit (no evidence yet — just registration)
           bash scripts/upload-evidence.sh \
             {{PROJECT_SLUG}} _compliance-docs release_registration README.md \
-            --release ${{ steps.version.outputs.version }} --create-release-if-missing \
+            --release ${{ steps.version.outputs.version }} \
+            --environment uat --category planning \
+            --git-sha ${{ github.sha }} --branch ${{ github.ref_name }} || true
+
+      - name: Generate and upload bundled changes (REQ releases only)
+        if: env.DEVAUDIT_BASE_URL != ''
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          # Only generate bundled changes for REQ-tagged releases —
+          # housekeeping (bare-date) releases don't bundle other housekeeping.
+          if [[ "$VERSION" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
+            echo "Version ${VERSION} is housekeeping — skipping bundled changes."
+            exit 0
+          fi
+          chmod +x scripts/generate-bundled-changes.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
+          # Find the previous release tag to scan from. Fall back to last 50
+          # commits if no prior tag exists.
+          SINCE_REF=$(git tag --sort=-creatordate | head -1 || true)
+          if [ -z "$SINCE_REF" ]; then
+            SINCE_REF="HEAD~50"
+          fi
+          echo "Scanning bundled changes since ${SINCE_REF} for ${VERSION}"
+          BUNDLED_FILE="compliance/pending-releases/BUNDLED-CHANGES-${VERSION}.md"
+          mkdir -p compliance/pending-releases
+          bash scripts/generate-bundled-changes.sh "$SINCE_REF" "$VERSION" > "$BUNDLED_FILE"
+          # Upload as bundled_changes evidence against the REQ release.
+          bash scripts/upload-evidence.sh \
+            {{PROJECT_SLUG}} _compliance-docs bundled_changes "$BUNDLED_FILE" \
+            --release "$VERSION" \
             --environment uat --category planning \
             --git-sha ${{ github.sha }} --branch ${{ github.ref_name }} || true
 
@@ -409,6 +442,11 @@ jobs:
         if: env.DEVAUDIT_BASE_URL != ''
         run: |
           chmod +x scripts/upload-evidence.sh 2>/dev/null || true
+          # --create-release-if-missing is intentionally here (post-gate) rather
+          # than in register-release. This ensures the portal release record only
+          # appears after gates have run — even if gates failed, the release
+          # record is created here so failure evidence attaches to it.
+          # (devaudit-installer#226)
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --release ${{ needs.register-release.outputs.version }} --create-release-if-missing"
           FLAGS="${FLAGS} --environment uat"

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -909,35 +909,43 @@ jobs:
 
               echo "  [INCIDENT] $TEST_NAME — filing with incident label"
 
-              ISSUE_BODY="## E2E Regression Failure — ${CLASSIFICATION}
+              # DevAudit-Installer#228 — heredoc to keep markdown content
+              # inside the YAML literal block scalar (0-indent continuation
+              # lines were terminating the block and ** was parsed as YAML
+              # alias references).
+              ISSUE_BODY=$(cat <<EOF
+              ## E2E Regression Failure — ${CLASSIFICATION}
 
-**Test name:** ${TEST_NAME}
-**Error message:**
-\`\`\`
-${ERROR_MSG}
-\`\`\`
+              **Test name:** ${TEST_NAME}
+              **Error message:**
+              \`\`\`
+              ${ERROR_MSG}
+              \`\`\`
 
-**Classification:** ${CLASSIFICATION}
-**Classification rationale:** ${RATIONALE}
+              **Classification:** ${CLASSIFICATION}
+              **Classification rationale:** ${RATIONALE}
 
-**testCycleId:** ${CI_RUN_ID}
-**Workflow run:** ${WORKFLOW_URL}
-**Git SHA:** ${GIT_SHA}
+              **testCycleId:** ${CI_RUN_ID}
+              **Workflow run:** ${WORKFLOW_URL}
+              **Git SHA:** ${GIT_SHA}
 
-This regression was detected and classified by the autonomous E2E Regression CI run. A human should confirm the classification, adjust severity if needed, and close once fixed. The \`incident\` label ensures an \`incident_report\` will be generated on close.
+              This regression was detected and classified by the autonomous E2E Regression CI run. A human should confirm the classification, adjust severity if needed, and close once fixed. The \`incident\` label ensures an \`incident_report\` will be generated on close.
 
-### Framework attribution
+              ### Framework attribution
 
-This defect, once closed with the \`incident\` label, will be auto-exported as \`incident_report\` evidence and attribute to:
+              This defect, once closed with the \`incident\` label, will be auto-exported as \`incident_report\` evidence and attribute to:
 
-- [x] \`ISO29119.3.5.4\` (baseline — every incident_report)
-- [x] \`SOC2.CC7.2\` — ops impact: a regression in production-adjacent code is an ops concern
-- [ ] \`GDPR.Art-33\` — personal data scope: <REPLACE — yes/no>
-- [ ] \`GDPR.Art-34\` — data-subject notification required: <REPLACE — yes/no>
-- [ ] \`EUAIA.Art-9 / Art-14 / Art-15\` — AI failure: <REPLACE — yes/no, which article(s)>
+              - [x] \`ISO29119.3.5.4\` (baseline — every incident_report)
+              - [x] \`SOC2.CC7.2\` — ops impact: a regression in production-adjacent code is an ops concern
+              - [ ] \`GDPR.Art-33\` — personal data scope: <REPLACE — yes/no>
+              - [ ] \`GDPR.Art-34\` — data-subject notification required: <REPLACE — yes/no>
+              - [ ] \`EUAIA.Art-9 / Art-14 / Art-15\` — AI failure: <REPLACE — yes/no, which article(s)>
 
-Once closed, the \`incident-export.yml\` workflow exports this issue's body to \`compliance/governance/incident-report-<N>.md\`.
-"
+              Once closed, the \`incident-export.yml\` workflow exports this issue's body to \`compliance/governance/incident-report-<N>.md\`.
+              EOF
+              )
+              # Strip the 14-space heredoc indentation so the issue body is clean.
+              ISSUE_BODY=$(echo "$ISSUE_BODY" | sed 's/^              //')
 
               gh issue create \
                 --title "[REGRESSION] ${TEST_NAME}" \
@@ -947,23 +955,27 @@ Once closed, the \`incident-export.yml\` workflow exports this issue's body to \
             elif [ "$FILE_LABEL" = "test-bug" ]; then
               echo "  [TEST-BUG] $TEST_NAME — filing with test-bug label (no incident label)"
 
-              ISSUE_BODY="## E2E Regression Failure — ${CLASSIFICATION}
+              # DevAudit-Installer#228 — heredoc (see comment above).
+              ISSUE_BODY=$(cat <<EOF
+              ## E2E Regression Failure — ${CLASSIFICATION}
 
-**Test name:** ${TEST_NAME}
-**Error message:**
-\`\`\`
-${ERROR_MSG}
-\`\`\`
+              **Test name:** ${TEST_NAME}
+              **Error message:**
+              \`\`\`
+              ${ERROR_MSG}
+              \`\`\`
 
-**Classification:** ${CLASSIFICATION}
-**Classification rationale:** ${RATIONALE}
+              **Classification:** ${CLASSIFICATION}
+              **Classification rationale:** ${RATIONALE}
 
-**testCycleId:** ${CI_RUN_ID}
-**Workflow run:** ${WORKFLOW_URL}
-**Git SHA:** ${GIT_SHA}
+              **testCycleId:** ${CI_RUN_ID}
+              **Workflow run:** ${WORKFLOW_URL}
+              **Git SHA:** ${GIT_SHA}
 
-This failure appears to be a ${CLASSIFICATION} (not an application defect). A human should confirm and fix the ${CLASSIFICATION}, not the application. Filed with the \`test-bug\` label — this does NOT produce \`incident_report\` evidence.
-"
+              This failure appears to be a ${CLASSIFICATION} (not an application defect). A human should confirm and fix the ${CLASSIFICATION}, not the application. Filed with the \`test-bug\` label — this does NOT produce \`incident_report\` evidence.
+              EOF
+              )
+              ISSUE_BODY=$(echo "$ISSUE_BODY" | sed 's/^              //')
 
               gh issue create \
                 --title "[TEST-BUG] ${TEST_NAME}" \
@@ -974,13 +986,19 @@ This failure appears to be a ${CLASSIFICATION} (not an application defect). A hu
           done <<< "$FAILING_TESTS"
 
           # --- Post summary comment on the workflow run ---
-          SUMMARY="E2E Regression triage summary:
-- Flakes (not filed): ${FLAKE_COUNT}
-- Test bugs (filed without incident label): ${TEST_BUG_COUNT}
-- Seed-data gaps (filed without incident label): ${SEED_GAP_COUNT}
-- Visual diffs intended (not filed): ${VISUAL_INTENDED_COUNT}
-- Visual diffs unintended (filed as incident): ${VISUAL_UNINTENDED_COUNT}
-- Application defects (filed as incident): ${APP_DEFECT_COUNT}"
+          # DevAudit-Installer#228 — heredoc to keep continuation lines
+          # inside the YAML literal block scalar.
+          SUMMARY=$(cat <<EOF
+          E2E Regression triage summary:
+          - Flakes (not filed): ${FLAKE_COUNT}
+          - Test bugs (filed without incident label): ${TEST_BUG_COUNT}
+          - Seed-data gaps (filed without incident label): ${SEED_GAP_COUNT}
+          - Visual diffs intended (not filed): ${VISUAL_INTENDED_COUNT}
+          - Visual diffs unintended (filed as incident): ${VISUAL_UNINTENDED_COUNT}
+          - Application defects (filed as incident): ${APP_DEFECT_COUNT}
+          EOF
+          )
+          SUMMARY=$(echo "$SUMMARY" | sed 's/^          //')
 
           echo "$SUMMARY"
           # Post summary as a workflow run comment (using gh api).

package/sdlc/files/ci/incident-export.yml.template

@@ -198,15 +198,25 @@ jobs:
             MERGE_SHA=$(echo "$CLOSING_PRS" | jq -r '.mergeCommit.oid // .mergeCommit // "unknown"' 2>/dev/null | head -1)
             PR_TITLE=$(echo "$CLOSING_PRS" | jq -r '.title' 2>/dev/null | head -1)
             PR_NUM=$(echo "$CLOSING_PRS" | jq -r '.number' 2>/dev/null | head -1)
-            CONTAINMENT="- **Containment actions:** auto-derived from PR #${PR_NUM}: ${PR_TITLE}
-- **Mitigation deployed:** [PR #${PR_NUM}](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/pull/${PR_NUM}) (${MERGE_SHA})
-- **Recovery actions:** REPLACE — if additional recovery steps were taken
-- **Verification that the incident is resolved:** REPLACE — how was the fix verified (re-run E2E, manual check, etc.)"
+            # DevAudit-Installer#228 — heredoc to keep markdown content
+            # inside the YAML literal block scalar.
+            CONTAINMENT=$(cat <<EOF
+            - **Containment actions:** auto-derived from PR #${PR_NUM}: ${PR_TITLE}
+            - **Mitigation deployed:** [PR #${PR_NUM}](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/pull/${PR_NUM}) (${MERGE_SHA})
+            - **Recovery actions:** REPLACE — if additional recovery steps were taken
+            - **Verification that the incident is resolved:** REPLACE — how was the fix verified (re-run E2E, manual check, etc.)
+            EOF
+            )
+            CONTAINMENT=$(echo "$CONTAINMENT" | sed 's/^            //')
           else
-            CONTAINMENT="- **Containment actions:** REPLACE — no linked PR found
-- **Mitigation deployed:** REPLACE
-- **Recovery actions:** REPLACE
-- **Verification that the incident is resolved:** REPLACE"
+            CONTAINMENT=$(cat <<EOF
+            - **Containment actions:** REPLACE — no linked PR found
+            - **Mitigation deployed:** REPLACE
+            - **Recovery actions:** REPLACE
+            - **Verification that the incident is resolved:** REPLACE
+            EOF
+            )
+            CONTAINMENT=$(echo "$CONTAINMENT" | sed 's/^            //')
           fi
 
           # §4g — Lessons learned: scan comments for follow-up issue references.

package/sdlc/files/stacks/node/hooks/pre-push

@@ -1,9 +1,21 @@
 #!/usr/bin/env bash
-# Husky pre-push hook — runs TypeScript check as a fast gate before push.
-# The full test suite (E2E, SAST, dependency audit) runs in CI.
+# Husky pre-push hook — fast gates + E2E evidence + skill-invocation sentinel + compliance validator.
+#
+# Runs four checks before allowing a push:
+# 1. TypeScript check (fast gate)
+# 2. E2E evidence check — if UI-facing files changed, verify Playwright ran
+# 3. Skill-invocation sentinel — if feat/fix/refactor/perf commits present,
+#    verify sdlc-implementer was invoked
+# 4. Compliance artifact validation — if feat/fix/refactor/perf commits present,
+#    run validate-compliance-artifacts.sh to catch missing evidence files
+#
+# Bypass with --no-verify (last resort, not a habit).
 #
 # Install: cp this file to .husky/pre-push && chmod +x .husky/pre-push
 
+set -euo pipefail
+
+# ── 1. TypeScript check ──────────────────────────────────────────────
 echo "Pre-push: running TypeScript check..."
 npx tsc --noEmit
 if [ $? -ne 0 ]; then
@@ -13,3 +25,107 @@ if [ $? -ne 0 ]; then
   exit 1
 fi
 echo "Pre-push: TypeScript check passed."
+
+# ── 2. E2E evidence check (devaudit-installer#226) ───────────────────
+# Only fires if UI-facing files are in the push. Checks for either
+# playwright-report/ directory or .e2e-gate-passed sentinel (written by
+# e2e-test-engineer after a successful run).
+INTEGRATION_BRANCH=$(jq -r '.integration_branch // "develop"' sdlc-config.json 2>/dev/null || echo "develop")
+
+# Read stdin to get the pushed refs (husky pre-push protocol)
+while read -r local_ref local_sha remote_ref remote_sha; do
+  # Check if pushing to the integration branch
+  if [[ "$remote_ref" != *"refs/heads/$INTEGRATION_BRANCH" ]]; then
+    continue
+  fi
+
+  # Determine the commit range being pushed
+  if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
+    RANGE="$local_sha"
+  else
+    RANGE="${remote_sha}..${local_sha}"
+  fi
+
+  # Check for UI-facing files in the push
+  UI_FILES=$(git diff --name-only "$RANGE" -- 'app/**/*.tsx' 'src/**/*.tsx' 'pages/**/*.tsx' 'app/**/*.jsx' 'src/**/*.jsx' 'pages/**/*.jsx' 2>/dev/null || true)
+
+  if [ -n "$UI_FILES" ]; then
+    E2E_PASSED=false
+    if [ -f .e2e-gate-passed ]; then
+      E2E_PASSED=true
+    elif [ -d playwright-report ] && [ "$(find playwright-report -type f -newer .git/HEAD 2>/dev/null | head -1)" ]; then
+      E2E_PASSED=true
+    fi
+
+    if [ "$E2E_PASSED" = "false" ]; then
+      echo ""
+      echo "ERROR: E2E gate was not run before pushing."
+      echo "       UI-facing files changed in this push:"
+      echo "$UI_FILES" | sed 's/^/         /'
+      echo ""
+      echo "       Run 'npx playwright test' (or invoke e2e-test-engineer) before pushing."
+      echo "       Bypass with --no-verify (last resort, not a habit)."
+      exit 1
+    fi
+    echo "Pre-push: E2E evidence check passed."
+  fi
+done
+
+# ── 3. Skill-invocation sentinel (devaudit-installer#226) ────────────
+# If feat/fix/refactor/perf commits are in the push, verify the
+# sdlc-implementer skill was invoked (writes .sdlc-implementer-invoked).
+# Housekeeping types (docs/chore/ci/build/test/revert) are exempt.
+TRACKED_TYPES='^(feat|fix|refactor|perf)(\(.+\))?!?:'
+HAS_TRACKED=false
+
+while read -r local_ref local_sha remote_ref remote_sha; do
+  if [[ "$remote_ref" != *"refs/heads/$INTEGRATION_BRANCH" ]]; then
+    continue
+  fi
+  if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
+    RANGE="$local_sha"
+  else
+    RANGE="${remote_sha}..${local_sha}"
+  fi
+  COMMITS=$(git log "$RANGE" --format='%s' 2>/dev/null || true)
+  if echo "$COMMITS" | grep -qE "$TRACKED_TYPES"; then
+    HAS_TRACKED=true
+  fi
+done
+
+if [ "$HAS_TRACKED" = "true" ]; then
+  if [ ! -f .sdlc-implementer-invoked ]; then
+    echo ""
+    echo "ERROR: sdlc-implementer skill was not invoked."
+    echo "       This push contains feat/fix/refactor/perf commits which require"
+    echo "       the SDLC skill flow. Invoke sdlc-implementer to drive the process,"
+    echo "       or use --no-verify to bypass (not recommended — CI will also check"
+    echo "       RTM provenance via validate-commits.sh)."
+    exit 1
+  fi
+  echo "Pre-push: skill-invocation sentinel check passed."
+fi
+
+# ── 4. Compliance artifact validation (devaudit-installer#226) ──────
+# If feat/fix/refactor/perf commits are in the push, run
+# validate-compliance-artifacts.sh to catch missing test-scope.md,
+# test-plan.md, implementation-plan.md in compliance/evidence/.
+# Reuses HAS_TRACKED from check 3.
+if [ "$HAS_TRACKED" = "true" ]; then
+  if [ -f scripts/validate-compliance-artifacts.sh ]; then
+    echo "Pre-push: running compliance artifact validation..."
+    if ! bash scripts/validate-compliance-artifacts.sh "origin/$INTEGRATION_BRANCH"; then
+      echo ""
+      echo "ERROR: Compliance artifact validation failed."
+      echo "       Missing or incomplete artifacts in compliance/evidence/."
+      echo "       Run 'bash scripts/validate-compliance-artifacts.sh' locally to see details."
+      echo "       Bypass with --no-verify (last resort, not a habit)."
+      exit 1
+    fi
+    echo "Pre-push: compliance artifact validation passed."
+  else
+    echo "Pre-push: compliance artifact validation skipped (script not found)."
+  fi
+fi
+
+echo "Pre-push: all checks passed."