@metasession.co/devaudit-cli 0.3.13 → 0.3.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.13",
+  "version": "0.3.14",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.13",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.14",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/_common/scripts/generate-bundled-changes.sh

@@ -76,7 +76,7 @@ extract_ticket_title() {
     printf '%s' "$line" \
       | sed -E 's/^\*\*Requirement:\*\*[[:space:]]*//' \
       | sed -E 's/^REQ-[0-9]+[[:space:]]*[—–:-][[:space:]]*//' \
-      | sed -E 's/[[:space:]]*$//'
+      | sed -E 's/^[[:space:]]+|[[:space:]]+$//g'
     return 0
   fi
   line=$(grep -m1 '^# ' "$file" 2>/dev/null || true)
@@ -227,6 +227,7 @@ for version in "${EXPLICIT_PREDECESSORS[@]}"; do
       --arg commitTo "$commit_to" \
       --arg prNumber "$pr_number" \
       --arg prUrl "$pr_url" \
+      --arg originalTitle "${title:-Release $version}" \
       '. + [{
         version: $version,
         role: $role,
@@ -236,7 +237,14 @@ for version in "${EXPLICIT_PREDECESSORS[@]}"; do
         commitFrom: (if $commitFrom == "" then null else $commitFrom end),
         commitTo: (if $commitTo == "" then null else $commitTo end),
         prNumber: (if $prNumber == "" then null else ($prNumber | tonumber) end),
-        prUrl: (if $prUrl == "" then null else $prUrl end)
+        prUrl: (if $prUrl == "" then null else $prUrl end),
+        originalTitle: $originalTitle,
+        evidenceInheritancePolicy: {
+          mode: "all_eligible",
+          includeCycles: true,
+          scopes: ["release", "stage", "cycle"],
+          reason: $reason
+        }
       }]' <<<"$MEMBERS"
   )"
   PREDECESSOR_LINES+=("- \`${version}\` (${role}/${relationship}) — ${title:-Untitled release ticket}")
@@ -267,6 +275,7 @@ fi
 GENERATOR_VERSION="$(jq -r '.version' cli/package.json 2>/dev/null || echo '0.0.0')"
 REPOSITORY_SLUG="$(git config --get remote.origin.url 2>/dev/null | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##' || true)"
 GENERATED_AT="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+[ -n "$REPOSITORY_SLUG" ] || REPOSITORY_SLUG="${GITHUB_REPOSITORY:-local/unknown}"
 
 MANIFEST_BASE="$(
   jq -c -n \
@@ -277,7 +286,7 @@ MANIFEST_BASE="$(
     --arg repository "$REPOSITORY_SLUG" \
     --arg generatedAt "$GENERATED_AT" \
     '{
-      schemaVersion: 1,
+      schemaVersion: 2,
       approvalRelease: { version: $version },
       coreRelease: { version: $version },
       members: ($members | fromjson),
@@ -291,7 +300,7 @@ MANIFEST_BASE="$(
     }'
 )"
 
-HASH_INPUT="$(jq -S 'del(.generator.generatedAt)' <<<"$MANIFEST_BASE")"
+HASH_INPUT="$(jq -cS 'del(.generator.generatedAt)' <<<"$MANIFEST_BASE")"
 MANIFEST_HASH="sha256:$(printf '%s' "$HASH_INPUT" | sha256sum | awk '{print $1}')"
 MANIFEST_JSON="$(jq --arg manifestHash "$MANIFEST_HASH" '. + { manifestHash: $manifestHash }' <<<"$MANIFEST_BASE")"
 

package/sdlc/files/_common/scripts/generate-bundled-changes.test.sh

@@ -150,6 +150,11 @@ assert_eq "member version recorded" "REQ-041" "$(jq -r '.members[0].version' "$J
 assert_eq "member role recorded" "predecessor" "$(jq -r '.members[0].role' "$JSON_OUT")"
 assert_eq "member relationship recorded" "superseded" "$(jq -r '.members[0].relationship' "$JSON_OUT")"
 assert_eq "manifest hash present" "true" "$(jq -r 'has("manifestHash")' "$JSON_OUT")"
+assert_eq "manifest schema v2" "2" "$(jq -r '.schemaVersion' "$JSON_OUT")"
+assert_eq "original title recorded" "Prior tracked release" "$(jq -r '.members[0].originalTitle' "$JSON_OUT")"
+assert_eq "inheritance policy explicit" "all_eligible" "$(jq -r '.members[0].evidenceInheritancePolicy.mode' "$JSON_OUT")"
+EXPECTED_HASH="sha256:$(jq -cS 'del(.manifestHash, .generator.generatedAt)' "$JSON_OUT" | tr -d '\n' | sha256sum | awk '{print $1}')"
+assert_eq "canonical manifest hash verifies" "$EXPECTED_HASH" "$(jq -r '.manifestHash' "$JSON_OUT")"
 echo
 
 # Test 3: ambiguous predecessor ownership fails.

package/sdlc/files/_common/scripts/report-release-check.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Records authoritative required-check state independently of evidence upload.
+set -euo pipefail
+
+PROJECT_SLUG="" RELEASE_VERSION="" CHECK_KEY="" LABEL="" PROVIDER="github_actions"
+STATUS="" REQUIRED="true" EXTERNAL_RUN_ID="" EXTERNAL_URL="" COMMIT_SHA="" BRANCH=""
+STARTED_AT="" COMPLETED_AT="" DETAILS_JSON='{}'
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --project-slug) PROJECT_SLUG="$2"; shift 2 ;;
+    --release) RELEASE_VERSION="$2"; shift 2 ;;
+    --check-key) CHECK_KEY="$2"; shift 2 ;;
+    --label) LABEL="$2"; shift 2 ;;
+    --provider) PROVIDER="$2"; shift 2 ;;
+    --status) STATUS="$2"; shift 2 ;;
+    --required) REQUIRED="$2"; shift 2 ;;
+    --external-run-id) EXTERNAL_RUN_ID="$2"; shift 2 ;;
+    --external-url) EXTERNAL_URL="$2"; shift 2 ;;
+    --commit-sha) COMMIT_SHA="$2"; shift 2 ;;
+    --branch) BRANCH="$2"; shift 2 ;;
+    --started-at) STARTED_AT="$2"; shift 2 ;;
+    --completed-at) COMPLETED_AT="$2"; shift 2 ;;
+    --details-json) DETAILS_JSON="$2"; shift 2 ;;
+    *) echo "Unknown option: $1" >&2; exit 1 ;;
+  esac
+done
+
+for value in PROJECT_SLUG RELEASE_VERSION CHECK_KEY LABEL STATUS; do
+  if [ -z "${!value}" ]; then echo "Error: ${value} is required" >&2; exit 1; fi
+done
+case "$STATUS" in
+  queued|running|successful|failed|cancelled|timed_out|skipped|action_required|unknown) ;;
+  *) echo "Error: invalid check status '$STATUS'" >&2; exit 1 ;;
+esac
+jq -e 'type == "object"' >/dev/null <<<"$DETAILS_JSON" || {
+  echo "Error: --details-json must be a JSON object" >&2; exit 1;
+}
+
+BASE="${DEVAUDIT_BASE_URL%/}"
+if [ -z "$BASE" ] || [ -z "${DEVAUDIT_API_KEY:-}" ]; then
+  echo "::warning::Release check reporting skipped: DevAudit URL/API key missing" >&2
+  exit 0
+fi
+ENCODED_SLUG=$(jq -rn --arg v "$PROJECT_SLUG" '$v|@uri')
+ENCODED_VERSION=$(jq -rn --arg v "$RELEASE_VERSION" '$v|@uri')
+RESOLVE=$(curl -fsS \
+  -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+  "${BASE}/api/ci/releases/resolve?projectSlug=${ENCODED_SLUG}&versionPrefix=${ENCODED_VERSION}" || true)
+RELEASE_ID=$(jq -r --arg version "$RELEASE_VERSION" \
+  'if .latest.version == $version then .latest.id // empty else empty end' <<<"$RESOLVE" 2>/dev/null || true)
+if [ -z "$RELEASE_ID" ]; then
+  echo "::warning::Release check reporting skipped: exact release ${RELEASE_VERSION} not found" >&2
+  exit 0
+fi
+
+PAYLOAD=$(jq -n \
+  --arg checkKey "$CHECK_KEY" --arg displayLabel "$LABEL" --arg provider "$PROVIDER" \
+  --arg status "$STATUS" --argjson required "$REQUIRED" \
+  --arg externalRunId "$EXTERNAL_RUN_ID" --arg externalUrl "$EXTERNAL_URL" \
+  --arg commitSha "$COMMIT_SHA" --arg branch "$BRANCH" \
+  --arg startedAt "$STARTED_AT" --arg completedAt "$COMPLETED_AT" \
+  --argjson details "$DETAILS_JSON" \
+  '{checkKey:$checkKey,label:$displayLabel,provider:$provider,status:$status,required:$required,
+    externalRunId:(if $externalRunId=="" then null else $externalRunId end),
+    externalUrl:(if $externalUrl=="" then null else $externalUrl end),
+    commitSha:(if $commitSha=="" then null else $commitSha end),
+    branch:(if $branch=="" then null else $branch end),
+    startedAt:(if $startedAt=="" then null else $startedAt end),
+    completedAt:(if $completedAt=="" then null else $completedAt end),details:$details}')
+
+RESPONSE_FILE=$(mktemp)
+trap 'rm -f "$RESPONSE_FILE"' EXIT
+HTTP_CODE=$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' \
+  -X POST "${BASE}/api/ci/releases/${RELEASE_ID}/checks" \
+  -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" -H 'Content-Type: application/json' \
+  -d "$PAYLOAD")
+if [ "$HTTP_CODE" = "404" ]; then
+  echo "::warning::Portal does not support first-class release checks yet" >&2
+  exit 0
+fi
+if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+  cat "$RESPONSE_FILE" >&2 || true
+  echo "Error: release check API returned HTTP ${HTTP_CODE}" >&2
+  exit 1
+fi

package/sdlc/files/_common/scripts/report-release-check.test.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# Focused regression tests for authoritative release-check reporting.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/report-release-check.sh"
+PASS=0
+FAIL=0
+
+ok() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+no() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+make_fixture() {
+  local dir="$1"
+  mkdir -p "$dir/bin"
+  cat > "$dir/bin/curl" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+URL=""
+OUT=""
+BODY=""
+ARGS=("$@")
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  case "${ARGS[$i]}" in
+    -o) OUT="${ARGS[$((i+1))]}" ;;
+    -d) BODY="${ARGS[$((i+1))]}" ;;
+    http://*|https://*) URL="${ARGS[$i]}" ;;
+  esac
+done
+printf 'URL:%s\nBODY:%s\n' "$URL" "$BODY" >> "${CHECK_TEST_LOG:?}"
+if [[ "$URL" == *'/api/ci/releases/resolve'* ]]; then
+  printf '%s' "${RESOLVE_BODY:-{}}"
+  exit 0
+fi
+if [ -n "$OUT" ]; then printf '%s' "${CHECK_BODY:-{}}" > "$OUT"; fi
+printf '%s' "${CHECK_STATUS:-200}"
+EOF
+  chmod +x "$dir/bin/curl"
+}
+
+run_helper() {
+  PATH="$1/bin:$PATH" \
+  CHECK_TEST_LOG="$1/curl.log" \
+  DEVAUDIT_BASE_URL="https://devaudit.example.test" \
+  DEVAUDIT_API_KEY="mc_test_dummy" \
+  "$HELPER" "${@:2}"
+}
+
+base_args=(
+  --project-slug fixture-app
+  --release REQ-100
+  --check-key quality-gates
+  --label "Quality Gates"
+  --status failed
+  --external-run-id 123
+  --commit-sha abc123
+  --details-json '{"artifactUpload":"successful"}'
+)
+
+echo "=== report-release-check.sh tests ==="
+
+dir=$(mktemp -d)
+make_fixture "$dir"
+RESOLVE_BODY='{"latest":{"id":"release-1","version":"REQ-100"}}' \
+  CHECK_STATUS=201 run_helper "$dir" "${base_args[@]}"
+if grep -q '/api/ci/releases/release-1/checks' "$dir/curl.log"; then ok "posts to exact release"; else no "missing check endpoint"; fi
+if grep -q 'status.*failed' "$dir/curl.log" && grep -q 'artifactUpload.*successful' "$dir/curl.log"; then
+  ok "keeps execution outcome separate from upload detail"
+else
+  no "incorrect check payload"
+fi
+rm -rf "$dir"
+
+dir=$(mktemp -d)
+make_fixture "$dir"
+RESOLVE_BODY='{"latest":{"id":"release-1","version":"REQ-100"}}' \
+  CHECK_STATUS=404 run_helper "$dir" "${base_args[@]}" >/dev/null 2>&1 && ok "tolerates older portal" || no "404 should be tolerant"
+rm -rf "$dir"
+
+dir=$(mktemp -d)
+make_fixture "$dir"
+if RESOLVE_BODY='{"latest":{"id":"release-1","version":"REQ-100"}}' \
+  CHECK_STATUS=500 CHECK_BODY='{"error":"failed"}' run_helper "$dir" "${base_args[@]}" >/dev/null 2>&1; then
+  no "500 should fail"
+else
+  ok "fails on portal error"
+fi
+rm -rf "$dir"
+
+if "$HELPER" "${base_args[@]/failed/not-a-status}" >/dev/null 2>&1; then
+  no "invalid status should fail"
+else
+  ok "rejects invalid status"
+fi
+
+echo "=== report-release-check.sh: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/sdlc/files/ci/ci.yml.template

@@ -32,7 +32,8 @@ jobs:
   # ──────────────────────────────────────────────
   quality-gates:
     name: Quality Gates
-    if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'chore/close-out-') }}
+    needs: [register-release]
+    if: ${{ always() && (github.event_name != 'pull_request' || !startsWith(github.head_ref, 'chore/close-out-')) && (github.event_name == 'pull_request' || needs.register-release.result == 'success') }}
     runs-on: {{RUNNER}}
 
     services:
@@ -44,6 +45,8 @@ jobs:
     env:
 {{DATABASE_ENV}}
 {{APP_ENV}}
+      DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
+      DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
 
     steps:
       - uses: actions/checkout@v6
@@ -54,6 +57,29 @@ jobs:
           # tag each captured screenshot as feature vs regression.
           fetch-depth: 0
 
+      - name: Start authoritative quality-gate cycle
+        if: github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.outputs.version != 'skip'
+        run: |
+          BASE=""
+          if [ -f sdlc-config.json ]; then
+            BASE=$(jq -r '.devaudit.base_url // empty' sdlc-config.json 2>/dev/null || true)
+          fi
+          [ -n "$BASE" ] || BASE="$DEVAUDIT_BASE_URL_VAR"
+          [ -n "$BASE" ] || { echo "::warning::No DevAudit URL; cycle lifecycle disabled"; exit 0; }
+          echo "DEVAUDIT_BASE_URL=${BASE%/}" >> "$GITHUB_ENV"
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          bash scripts/report-test-cycle.sh start \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 --environment ci --cycle-kind quality_gate \
+            --provider github_actions --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
       # ── Cached installs (skip if already present on self-hosted runner) ──
 
       - uses: actions/setup-node@v6
@@ -418,7 +444,7 @@ jobs:
     # evidence — `status=failed` is itself the audit trail. `!cancelled()`
     # still guards against partial state on operator-cancel.
     # DevAudit-Installer#96.
-    if: ${{ always() && !cancelled() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
+    if: ${{ always() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
@@ -465,15 +491,12 @@ jobs:
           bash scripts/report-test-cycle.sh start \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
-            --sdlc-stage 2 \
-            --environment uat \
-            --cycle-kind quality_gate \
-            --provider github_actions \
-            --external-run-id "${{ github.run_id }}" \
+            --sdlc-stage 2 --environment ci --cycle-kind quality_gate \
+            --provider github_actions --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
             --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
-            --commit-sha "${{ github.sha }}" \
-            --branch "${{ github.ref_name }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
             --workflow-name "Quality Gates" \
             --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             --output-file "$CYCLE_OUT"
@@ -882,27 +905,41 @@ jobs:
       - name: Complete primary quality-gate cycle
         if: always() && env.DEVAUDIT_BASE_URL != ''
         run: |
-          case "${{ job.status }}" in
+          case "${{ needs.quality-gates.result }}" in
             success)   OUTCOME=passed ;;
             cancelled) OUTCOME=cancelled ;;
             *)         OUTCOME=failed ;;
           esac
-          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
           bash scripts/report-test-cycle.sh complete \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
             --sdlc-stage 2 \
-            --environment uat \
+            --environment ci \
             --cycle-kind quality_gate \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
             --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
             --commit-sha "${{ github.sha }}" \
             --branch "${{ github.ref_name }}" \
             --workflow-name "Quality Gates" \
             --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             --outcome "$OUTCOME"
+          case "$OUTCOME" in
+            passed) CHECK_STATUS=successful ;;
+            *) CHECK_STATUS="$OUTCOME" ;;
+          esac
+          bash scripts/report-release-check.sh \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --check-key "quality-gates:${{ github.run_id }}:${{ github.run_attempt }}" \
+            --label "Quality Gates" --provider github_actions --status "$CHECK_STATUS" \
+            --external-run-id "${{ github.run_id }}" \
+            --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
+            --details-json '{"executionSource":"needs.quality-gates.result","evidenceUploadJob":"${{ job.status }}"}'
 
       - name: Summary
         run: echo "Evidence uploaded for ${{ needs.register-release.outputs.version }} (UAT)"

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -768,6 +768,7 @@ jobs:
         if: steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
         run: |
           set -euo pipefail
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
           DERIVED_RELEASE="${{ steps.version.outputs.version }}"
 
           # Tier metadata for the portal (the operator filters/groups by
@@ -873,6 +874,7 @@ jobs:
               --branch "${PRIOR_BRANCH}" \
               --workflow-name "E2E Regression" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
+              --started-at "${{ github.event.workflow_run.run_started_at }}" \
               --output-file "$CYCLE_OUT"
             . "$CYCLE_OUT"
             rm -f "$CYCLE_OUT"
@@ -927,11 +929,15 @@ jobs:
                 REQ_FAILURES=$((REQ_FAILURES + 1))
               fi
             fi
-            if [ "$REQ_FAILURES" -gt 0 ]; then
-              REQ_OUTCOME=failed
-            else
-              REQ_OUTCOME=passed
-            fi
+            case "${{ github.event.workflow_run.conclusion }}" in
+              success)         REQ_OUTCOME=passed ;;
+              failure)         REQ_OUTCOME=failed ;;
+              cancelled)       REQ_OUTCOME=cancelled ;;
+              skipped)         REQ_OUTCOME=skipped ;;
+              timed_out)       REQ_OUTCOME=timed_out ;;
+              action_required) REQ_OUTCOME=action_required ;;
+              *)               REQ_OUTCOME=unknown ;;
+            esac
             bash scripts/report-test-cycle.sh complete \
               --project-slug {{PROJECT_SLUG}} \
               --release "${DERIVED_RELEASE}" \
@@ -946,8 +952,28 @@ jobs:
               --branch "${PRIOR_BRANCH}" \
               --workflow-name "E2E Regression" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
-              --started-at "${cycle_started_at:-}" \
+              --started-at "${{ github.event.workflow_run.run_started_at }}" \
+              --completed-at "${{ github.event.workflow_run.updated_at }}" \
+              --outcome-reason "authoritative workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}" \
               --outcome "${REQ_OUTCOME}"
+            case "$REQ_OUTCOME" in
+              passed) CHECK_STATUS=successful ;;
+              *) CHECK_STATUS="$REQ_OUTCOME" ;;
+            esac
+            CHECK_DETAILS=$(jq -cn \
+              --arg conclusion "${{ github.event.workflow_run.conclusion }}" \
+              --argjson artifactUploadFailures "$REQ_FAILURES" \
+              '{executionSource:"workflow_run.conclusion",conclusion:$conclusion,artifactUploadFailures:$artifactUploadFailures}')
+            bash scripts/report-release-check.sh \
+              --project-slug {{PROJECT_SLUG}} --release "${DERIVED_RELEASE}" \
+              --check-key "e2e-regression:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${REQ}" \
+              --label "E2E Regression (${REQ})" --provider github_actions --status "$CHECK_STATUS" \
+              --external-run-id "${{ github.event.workflow_run.id }}" \
+              --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
+              --commit-sha "${{ github.event.workflow_run.head_sha }}" --branch "${PRIOR_BRANCH}" \
+              --started-at "${{ github.event.workflow_run.run_started_at }}" \
+              --completed-at "${{ github.event.workflow_run.updated_at }}" \
+              --details-json "$CHECK_DETAILS"
           done
 
           # Per-spec failure screenshots from test-results/ are NOT