@metasession.co/devaudit-cli 0.3.19 → 0.3.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.19",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.21",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/ci/check-release-approval.yml.template

@@ -58,6 +58,32 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || 'develop' }}
           fetch-depth: 0
 
+      - name: Detect declared standalone housekeeping promotion
+        id: standalone
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          echo "standalone=false" >> "$GITHUB_OUTPUT"
+          chmod +x scripts/derive-release-version.sh scripts/standalone-housekeeping-release.sh 2>/dev/null || true
+          VERSION=$(bash scripts/derive-release-version.sh)
+          if ! [[ "$VERSION" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$ ]]; then
+            exit 0
+          fi
+          DECLARATION="compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${VERSION}.json"
+          if [ ! -f "$DECLARATION" ]; then
+            exit 0
+          fi
+          if ! printf '%s\n%s\n' "$PR_TITLE" "$PR_BODY" | grep -Fq 'Standalone housekeeping promotion'; then
+            echo "::error::Standalone declaration exists, but this PR is missing the literal 'Standalone housekeeping promotion' marker."
+            exit 1
+          fi
+          bash scripts/standalone-housekeeping-release.sh validate "$VERSION" "$DECLARATION"
+          echo "standalone=true" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Declared standalone housekeeping promotion ${VERSION}; normal GitHub review and technical checks remain required, but tracked portal approval does not apply."
+
       - name: Resolve DevAudit base URL
         run: |
           # Prefer sdlc-config.json (visible in PR review) over repo Variable.
@@ -159,7 +185,7 @@ jobs:
 
       - name: Resolve current release
         id: release
-        if: env.BOOTSTRAP_MODE != 'true'
+        if: env.BOOTSTRAP_MODE != 'true' && steps.standalone.outputs.standalone != 'true'
         run: |
           # devaudit#283 — repository_dispatch('release-approved') events
           # carry the release version in client_payload. Use it directly
@@ -218,7 +244,7 @@ jobs:
           esac
 
       - name: Link PR to release
-        if: env.BOOTSTRAP_MODE != 'true' && github.event_name == 'pull_request'
+        if: env.BOOTSTRAP_MODE != 'true' && steps.standalone.outputs.standalone != 'true' && github.event_name == 'pull_request'
         run: |
           RELEASE_ID="${{ steps.release.outputs.release_id }}"
           PR_URL="${{ github.event.pull_request.html_url }}"
@@ -231,7 +257,7 @@ jobs:
           echo "Linked PR #${PR_NUMBER} to release ${RELEASE_ID}"
 
       - name: Post release link on PR
-        if: env.BOOTSTRAP_MODE != 'true' && github.event_name == 'pull_request'
+        if: env.BOOTSTRAP_MODE != 'true' && steps.standalone.outputs.standalone != 'true' && github.event_name == 'pull_request'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -247,7 +273,7 @@ jobs:
           fi
 
       - name: SHA comparison
-        if: env.BOOTSTRAP_MODE != 'true' && github.event_name == 'pull_request'
+        if: env.BOOTSTRAP_MODE != 'true' && steps.standalone.outputs.standalone != 'true' && github.event_name == 'pull_request'
         run: |
           PR_HEAD_SHA="${{ github.event.pull_request.head.sha }}"
           APPROVED_SHA="${{ steps.release.outputs.approved_sha }}"

package/sdlc/files/ci/ci.yml.template

@@ -77,7 +77,8 @@ jobs:
           fi
           [ -n "$BASE" ] || BASE="$DEVAUDIT_BASE_URL_VAR"
           [ -n "$BASE" ] || { echo "::warning::No DevAudit URL; test execution lifecycle disabled"; exit 0; }
-          echo "DEVAUDIT_BASE_URL=${BASE%/}" >> "$GITHUB_ENV"
+          export DEVAUDIT_BASE_URL="${BASE%/}"
+          echo "DEVAUDIT_BASE_URL=${DEVAUDIT_BASE_URL}" >> "$GITHUB_ENV"
           chmod +x scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
           bash scripts/report-test-execution.sh start \
             --project-slug {{PROJECT_SLUG}} \

package/sdlc/files/ci/close-out-completion.yml.template

@@ -0,0 +1,56 @@
+name: Report Release Close-out Completion
+
+on:
+  pull_request:
+    branches: [develop]
+    types: [closed]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  report-completion:
+    if: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'chore/close-out-')
+    runs-on: {{RUNNER}}
+    env:
+      DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
+      PROJECT_SLUG: {{PROJECT_SLUG}}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+
+      - name: Report tracked close-out completion
+        run: |
+          set -euo pipefail
+          REQ="$(printf '%s' '${{ github.event.pull_request.head.ref }}' | sed -n 's#^chore/close-out-\(REQ-[0-9][0-9][0-9]*\)$#\1#p')"
+          if [ -z "$REQ" ]; then
+            echo "Standalone and integration housekeeping have no tracked close-out callback."
+            exit 0
+          fi
+          BASE="$(jq -r '.devaudit.base_url // empty' sdlc-config.json)"
+          if [ -z "$BASE" ] || [ -z "$DEVAUDIT_API_KEY" ]; then
+            echo "::error::DevAudit base URL and project API key are required for tracked close-out completion."
+            exit 1
+          fi
+          RELEASE="$(curl --fail-with-body -sS -G "${BASE%/}/api/ci/releases/resolve" \
+            -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+            --data-urlencode "projectSlug=${PROJECT_SLUG}" \
+            --data-urlencode "versionPrefix=${REQ}")"
+          RELEASE_ID="$(jq -r '.latest.id // empty' <<<"$RELEASE")"
+          RELEASE_VERSION="$(jq -r '.latest.version // empty' <<<"$RELEASE")"
+          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_VERSION" != "$REQ" ]; then
+            echo "::error::Unable to resolve the tracked release ${REQ}; refusing callback."
+            exit 1
+          fi
+          curl --fail-with-body -sS -X POST "${BASE%/}/api/ci/releases/${RELEASE_ID}/close-out" \
+            -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+            -H 'Content-Type: application/json' \
+            --data "$(jq -nc \
+              --arg workflowRunId '${{ github.run_id }}' \
+              --arg workflowUrl '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}' \
+              --arg pullRequestUrl '${{ github.event.pull_request.html_url }}' \
+              --arg mergeSha '${{ github.event.pull_request.merge_commit_sha }}' \
+              --argjson pullRequestNumber '${{ github.event.pull_request.number }}' \
+              '{status:"completed",workflowRunId:$workflowRunId,workflowUrl:$workflowUrl,pullRequestNumber:$pullRequestNumber,pullRequestUrl:$pullRequestUrl,mergeSha:$mergeSha}')"

package/sdlc/files/ci/close-out-release.yml.template

@@ -54,8 +54,8 @@ jobs:
           REQ="${{ github.event.inputs.release }}${{ github.event.client_payload.release }}"
           PR="${{ github.event.inputs.release_pr }}${{ github.event.client_payload.release_pr }}"
           if ! printf '%s' "$REQ" | grep -qE '^REQ-[0-9]{3,}$'; then
-            echo "::error::No valid REQ-XXX supplied (inputs.release / client_payload.release)."
-            exit 1
+            echo "Standalone and integration housekeeping have no ticket/RTM close-out. No-op."
+            exit 0
           fi
           echo "req=${REQ}" >> "$GITHUB_OUTPUT"
           echo "pr=${PR}" >> "$GITHUB_OUTPUT"

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -910,6 +910,10 @@ jobs:
           fi
 
           if [ "${#REQS[@]}" -eq 0 ]; then
+            if echo "$DERIVED_RELEASE" | grep -qE '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$'; then
+              echo "No tracked REQ was executed for standalone/integration housekeeping ${DERIVED_RELEASE}; preserving this as GitHub historical CI without portal approval evidence."
+              exit 0
+            fi
             REQS=(_compliance-docs)
           fi
           # A bounded Playwright process exits the workflow with `failure`

package/sdlc/files/ci/feature-e2e.yml.template

@@ -167,11 +167,47 @@ jobs:
           if [ -d playwright-report ]; then
             zip -qr playwright-report.zip playwright-report/ 2>/dev/null || true
           fi
+          LINEAGE_FLAGS=(--test-execution "${{ github.run_id }}")
+          if [ "${{ steps.exec.outputs.execution_supported }}" = "true" ] && [ -n "${{ steps.exec.outputs.execution_record_id }}" ]; then
+            LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${{ steps.exec.outputs.execution_record_id }}")
+          fi
+          UPLOAD_FAILURES=0
+
+          if [ ! -f e2e-results.json ]; then
+            echo "::error::Feature E2E produced no e2e-results.json"
+            exit 1
+          fi
+          bash scripts/upload-evidence.sh \
+            {{PROJECT_SLUG}} "$REQ_ID" e2e_result e2e-results.json \
+            --category e2e_result --release "$REQ_ID" --create-release-if-missing \
+            --environment uat --sdlc-stage 2 \
+            --git-sha "${{ github.event.pull_request.head.sha }}" \
+            --ci-run-id "${{ github.run_id }}" --branch "${{ github.head_ref }}" \
+            "${LINEAGE_FLAGS[@]}" \
+            --meta-key "origin=feature" \
+            || UPLOAD_FAILURES=$((UPLOAD_FAILURES + 1))
+
+          SHOT_DIR="compliance/evidence/${REQ_ID}/screenshots"
+          shopt -s nullglob
+          SHOTS=("${SHOT_DIR}"/*.png)
+          shopt -u nullglob
+          if [ "${#SHOTS[@]}" -eq 0 ]; then
+            echo "::error::No evidenceShot screenshots were captured for ${REQ_ID}."
+            exit 1
+          fi
+          for shot in "${SHOTS[@]}"; do
+            bash scripts/upload-evidence.sh \
+              {{PROJECT_SLUG}} "$REQ_ID" screenshot "$shot" \
+              --category screenshot --release "$REQ_ID" --create-release-if-missing \
+              --environment uat --sdlc-stage 2 \
+              --git-sha "${{ github.event.pull_request.head.sha }}" \
+              --ci-run-id "${{ github.run_id }}" --branch "${{ github.head_ref }}" \
+              "${LINEAGE_FLAGS[@]}" \
+              --meta-key "origin=feature" \
+              || UPLOAD_FAILURES=$((UPLOAD_FAILURES + 1))
+          done
+
           if [ -f playwright-report.zip ]; then
-            LINEAGE_FLAGS=(--test-execution "${{ github.run_id }}")
-            if [ "${{ steps.exec.outputs.execution_supported }}" = "true" ] && [ -n "${{ steps.exec.outputs.execution_record_id }}" ]; then
-              LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${{ steps.exec.outputs.execution_record_id }}")
-            fi
             bash scripts/upload-evidence.sh \
               {{PROJECT_SLUG}} "$REQ_ID" feature_e2e_report playwright-report.zip \
               --category e2e_report --release "$REQ_ID" --create-release-if-missing \
@@ -182,6 +218,10 @@ jobs:
               --meta-key "origin=feature" \
               || echo "::warning::feature E2E report upload failed"
           fi
+          if [ "$UPLOAD_FAILURES" -gt 0 ]; then
+            echo "::error::${UPLOAD_FAILURES} feature E2E evidence upload(s) failed"
+            exit 1
+          fi
 
       - name: Complete feature E2E execution
         if: always()

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.19",
+  "version": "0.3.21",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"