@metasession.co/devaudit-cli 0.3.11 → 0.3.13

package/sdlc/files/ci/ci.yml.template

@@ -6,8 +6,9 @@
 # Single consolidated job — on a self-hosted runner, parallel jobs run
 # sequentially anyway. One checkout + one cached npm ci = fast.
 #
-# PRs to develop run Quality Gates before integration. PRs to main are verified
-# by quality-gates-provenance.yml (same-SHA provenance check, not heavy CI rerun).
+# PRs to {{INTEGRATION_BRANCH}} run Quality Gates before integration. PRs to
+# {{RELEASE_BRANCH}} are handled by quality-gates-provenance.yml: provenance-only
+# for release PRs, full CI rerouted for hotfix/* PRs.
 # Compliance validation runs separately on PRs (compliance-validation.yml).
 
 name: CI Pipeline
@@ -15,9 +16,9 @@ name: CI Pipeline
 on:
   workflow_dispatch:
   pull_request:
-    branches: [develop]
+    branches: [{{INTEGRATION_BRANCH}}]
   push:
-    branches: [develop]
+    branches: [{{INTEGRATION_BRANCH}}]
     paths-ignore:
 {{PATHS_IGNORE}}      - 'sdlc-config.json'
 
@@ -31,6 +32,7 @@ jobs:
   # ──────────────────────────────────────────────
   quality-gates:
     name: Quality Gates
+    if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'chore/close-out-') }}
     runs-on: {{RUNNER}}
 
     services:
@@ -238,7 +240,7 @@ jobs:
     # PRs to develop should report Quality Gates without mutating DevAudit
     # releases or evidence. Release registration remains a develop-push /
     # manual-dispatch side effect.
-    if: ${{ github.event_name != 'pull_request' }}
+    if: ${{ github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' }}
     outputs:
       version: ${{ steps.version.outputs.version }}
     env:
@@ -295,18 +297,16 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Release version: ${VERSION}"
 
-      - name: Check release exists (no creation — deferred to upload-evidence)
+      - name: Ensure release exists for gate-cycle lineage
         if: env.DEVAUDIT_BASE_URL != '' && steps.version.outputs.version != 'skip'
         run: |
-          # Release creation is deferred to the upload-evidence job (which
-          # runs after gates pass) so the portal never shows a release from
-          # a push where gates weren't verified (devaudit-installer#226).
-          # This step only checks whether the release already exists (e.g.
-          # created earlier by sdlc-implementer Phase 1 step 3).
+          # First-class cycle APIs need an exact release row before the
+          # stage-2 cycle can start. This keeps failed gate runs visible even
+          # when later evidence generation fails.
           chmod +x scripts/upload-evidence.sh 2>/dev/null || true
           bash scripts/upload-evidence.sh \
             {{PROJECT_SLUG}} _compliance-docs release_registration README.md \
-            --release ${{ steps.version.outputs.version }} \
+            --release ${{ steps.version.outputs.version }} --create-release-if-missing \
             --environment uat --category planning \
             --git-sha ${{ github.sha }} --branch ${{ github.ref_name }} || true
 
@@ -338,8 +338,19 @@ jobs:
           fi
           echo "Scanning bundled changes since ${SINCE_REF} for ${VERSION}"
           BUNDLED_FILE="compliance/pending-releases/BUNDLED-CHANGES-${VERSION}.md"
+          BUNDLED_MANIFEST="compliance/pending-releases/BUNDLED-CHANGES-${VERSION}.json"
           mkdir -p compliance/pending-releases
-          bash scripts/generate-bundled-changes.sh "$SINCE_REF" "$VERSION" > "$BUNDLED_FILE"
+          chmod +x scripts/submit-bundle-manifest.sh 2>/dev/null || true
+          bash scripts/generate-bundled-changes.sh \
+            "$SINCE_REF" "$VERSION" --json-out "$BUNDLED_MANIFEST" > "$BUNDLED_FILE"
+          MEMBER_COUNT=$(jq -r '(.members // []) | length' "$BUNDLED_MANIFEST" 2>/dev/null || echo 0)
+          WORK_ITEM_COUNT=$(jq -r '(.nonReleaseWorkItems // []) | length' "$BUNDLED_MANIFEST" 2>/dev/null || echo 0)
+          if [ "$MEMBER_COUNT" = "0" ] && [ "$WORK_ITEM_COUNT" = "0" ]; then
+            echo "No bundled predecessor releases or non-release work detected for ${VERSION}."
+            rm -f "$BUNDLED_FILE" "$BUNDLED_MANIFEST"
+            exit 0
+          fi
+          bash scripts/submit-bundle-manifest.sh {{PROJECT_SLUG}} "$VERSION" "$BUNDLED_MANIFEST"
           # Upload as bundled_changes evidence against the REQ release.
           bash scripts/upload-evidence.sh \
             {{PROJECT_SLUG}} _compliance-docs bundled_changes "$BUNDLED_FILE" \
@@ -407,7 +418,7 @@ jobs:
     # evidence — `status=failed` is itself the audit trail. `!cancelled()`
     # still guards against partial state on operator-cancel.
     # DevAudit-Installer#96.
-    if: ${{ always() && !cancelled() && needs.register-release.result == 'success' }}
+    if: ${{ always() && !cancelled() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
@@ -444,17 +455,33 @@ jobs:
       - name: Generate and upload gate evidence
         if: env.DEVAUDIT_BASE_URL != ''
         run: |
-          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
-          # --create-release-if-missing is intentionally here (post-gate) rather
-          # than in register-release. This ensures the portal release record only
-          # appears after gates have run — even if gates failed, the release
-          # record is created here so failure evidence attaches to it.
-          # (devaudit-installer#226)
+          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --release ${{ needs.register-release.outputs.version }} --create-release-if-missing"
           FLAGS="${FLAGS} --environment uat"
           FLAGS="${FLAGS} --sdlc-stage 2"
-          FLAGS="${FLAGS} --test-cycle ${{ github.run_id }}"
+          PRIMARY_LINEAGE_FLAGS=(--test-cycle "${{ github.run_id }}")
+          CYCLE_OUT="$(mktemp)"
+          bash scripts/report-test-cycle.sh start \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 \
+            --environment uat \
+            --cycle-kind quality_gate \
+            --provider github_actions \
+            --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" \
+            --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --output-file "$CYCLE_OUT"
+          . "$CYCLE_OUT"
+          rm -f "$CYCLE_OUT"
+          if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
+            PRIMARY_LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+          fi
 
           # Track failures across all uploads so we can fail the job at the
           # end with the full picture. Previously each upload used
@@ -494,7 +521,7 @@ jobs:
             STATUS_BUILD=$(gate_status "$(jq -r '.build // "skipped"' ci-evidence/gate-outcomes.json)")
             upload gate-outcomes.json \
               {{PROJECT_SLUG}} _compliance-docs gate_outcome ci-evidence/gate-outcomes.json \
-              --category ci_pipeline ${FLAGS}
+              --category ci_pipeline ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Re-generate gate evidence as fallback if artifact download failed
@@ -519,7 +546,7 @@ jobs:
           if [ -f ci-evidence/sast-results.json ]; then
             upload sast-results.json \
               {{PROJECT_SLUG}} _compliance-docs sast_report ci-evidence/sast-results.json \
-              --category security_scan --gate-status "$STATUS_SAST" ${FLAGS}
+              --category security_scan --gate-status "$STATUS_SAST" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Upload dependency audit — precise evidence_type=dependency_audit
@@ -527,14 +554,14 @@ jobs:
           if [ -f ci-evidence/dependency-audit.json ]; then
             upload dependency-audit.json \
               {{PROJECT_SLUG}} _compliance-docs dependency_audit ci-evidence/dependency-audit.json \
-              --category security_scan --gate-status "$STATUS_DEPAUDIT" ${FLAGS}
+              --category security_scan --gate-status "$STATUS_DEPAUDIT" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Upload E2E test results (e2e_result category)
           if [ -f ci-evidence/e2e-results.json ]; then
             upload e2e-results.json \
               {{PROJECT_SLUG}} _compliance-docs e2e_result ci-evidence/e2e-results.json \
-              --category e2e_result ${FLAGS}
+              --category e2e_result ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Upload Playwright HTML report (e2e_report — run context, NOT
@@ -546,7 +573,7 @@ jobs:
             if [ -f ci-evidence/playwright-report.zip ]; then
               upload playwright-report.zip \
                 {{PROJECT_SLUG}} _compliance-docs e2e_report ci-evidence/playwright-report.zip \
-                --category e2e_report ${FLAGS}
+                --category e2e_report ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
             fi
           fi
 
@@ -557,7 +584,7 @@ jobs:
           if [ -f ci-evidence/coverage/coverage-summary.json ]; then
             upload coverage-summary.json \
               {{PROJECT_SLUG}} _compliance-docs coverage_report ci-evidence/coverage/coverage-summary.json \
-              --category coverage_report ${FLAGS}
+              --category coverage_report ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Upload project-level Test Summary Report as a baseline
@@ -571,7 +598,9 @@ jobs:
           if [ -f "compliance/test-summary-report.md" ]; then
             upload test-summary-report.md \
               {{PROJECT_SLUG}} _compliance-docs compliance_document compliance/test-summary-report.md \
-              --category planning ${FLAGS}
+              --category planning --git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }} \
+              --release ${{ needs.register-release.outputs.version }} --create-release-if-missing \
+              --environment uat --sdlc-stage 2
           fi
 
           # devaudit-installer#200 Fix 4 — Per-REQ gate evidence fan-out.
@@ -793,9 +822,9 @@ jobs:
 
                 # devaudit-installer#237 — check for test-execution-summary.md
                 # as a secondary signal. This is a human-authored document and
-                # weaker than machine-generated evidence, so it only converts
-                # a hard error to a warning when combined with unit test files
-                # on disk — never alone.
+                # weaker than machine-generated evidence, but it is still the
+                # designated evidence for test-maintenance REQs that update an
+                # existing tagged spec for a different requirement.
                 HAS_SUMMARY=false
                 if [ -f "compliance/evidence/${REQ}/test-execution-summary.md" ]; then
                   HAS_SUMMARY=true
@@ -804,10 +833,16 @@ jobs:
                 if [ "$SPECS_ON_DISK" -gt 0 ]; then
                   # Scenario B: E2E specs exist on disk but outside the smoke tier
                   echo "::warning::Evidence completeness gate: ${REQ} has zero tagged tests in this smoke run and zero per-AC screenshots, but ${SPECS_ON_DISK} spec file(s) on disk reference it (outside the smoke project). Evidence exists but was not executed in this CI tier. Consider running --project=critical or --grep \"${REQ}\" to capture evidence."
-                elif [ "$UNIT_TESTS_ON_DISK" -gt 0 ] && [ "$HAS_SUMMARY" = "true" ]; then
-                  # Scenario C: unit test files exist with @requirement annotations
-                  # and a test-execution-summary.md documents coverage
-                  echo "::warning::Evidence completeness gate: ${REQ} has zero E2E tagged tests and zero screenshots, but ${UNIT_TESTS_ON_DISK} unit test file(s) on disk reference it and a test-execution-summary.md exists. Unit test evidence found but execution was not verified in this run. If this is an API-only or backend-only change, this is expected."
+                elif [ "$HAS_SUMMARY" = "true" ]; then
+                  # Scenario C: a test-execution-summary.md documents coverage.
+                  # This covers both API/backend-only REQs with unit tests on disk
+                  # and test-maintenance REQs whose evidence is an existing spec
+                  # tagged to an earlier feature requirement.
+                  if [ "$UNIT_TESTS_ON_DISK" -gt 0 ]; then
+                    echo "::warning::Evidence completeness gate: ${REQ} has zero E2E tagged tests and zero screenshots, but ${UNIT_TESTS_ON_DISK} unit test file(s) on disk reference it and a test-execution-summary.md exists. Unit test evidence found but execution was not verified in this run. If this is an API-only or backend-only change, this is expected."
+                  else
+                    echo "::warning::Evidence completeness gate: ${REQ} has zero tagged tests and zero screenshots, but a test-execution-summary.md exists documenting coverage. Accepted as evidence for test-maintenance or execution-only REQs."
+                  fi
                 else
                   # Scenario A: genuinely no evidence — no E2E specs, no unit tests,
                   # no test-execution-summary. Hard error preserved (#237 Constraint 3).
@@ -844,5 +879,30 @@ jobs:
             exit 1
           fi
 
+      - name: Complete primary quality-gate cycle
+        if: always() && env.DEVAUDIT_BASE_URL != ''
+        run: |
+          case "${{ job.status }}" in
+            success)   OUTCOME=passed ;;
+            cancelled) OUTCOME=cancelled ;;
+            *)         OUTCOME=failed ;;
+          esac
+          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          bash scripts/report-test-cycle.sh complete \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 \
+            --environment uat \
+            --cycle-kind quality_gate \
+            --provider github_actions \
+            --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" \
+            --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --outcome "$OUTCOME"
+
       - name: Summary
         run: echo "Evidence uploaded for ${{ needs.register-release.outputs.version }} (UAT)"

package/sdlc/files/ci/close-out-release.yml.template

@@ -11,10 +11,11 @@
 #   - workflow_dispatch — manual catch-up for an already-released requirement.
 #
 # It merges origin/main into a branch from develop (devaudit#281), runs
-# scripts/close-out-release.sh for the requirement (flip ticket + RTM, move
-# ticket to approved-releases/), then opens one PR to develop containing both
-# the main→develop sync and the compliance-tree close-out. The script is
-# idempotent, so a no-op produces no PR.
+# scripts/close-out-release.sh for the requirement (flip the governing ticket +
+# RTM, move the governing ticket to approved-releases/, and move any absorbed
+# predecessor tickets to superseded-releases/), then opens one PR to develop
+# containing both the main→develop sync and the compliance-tree close-out. The
+# script is idempotent, so a no-op produces no PR.
 
 name: Release Close-out
 
@@ -133,6 +134,7 @@ jobs:
           - release ticket moved to approved-releases/
           - release ticket status → RELEASED
           - RTM row → RELEASED
+          - absorbed predecessor tickets → superseded-releases/ (if the bundle manifest listed any)
 
           Ref: ${REQ}"
           git push -u origin "$BRANCH" --force-with-lease
@@ -144,6 +146,7 @@ jobs:
           - **main → develop reconciliation** — merges released code back into develop
           - **release ticket** moved to \`approved-releases/\`, status \`RELEASED\`
           - **RTM row** flipped to \`RELEASED\`
+          - **absorbed predecessor tickets** moved to \`superseded-releases/\` when the release bundle lists them
 
           Review + merge to develop."
           gh pr create --base develop --head "$BRANCH" \