@metasession.co/devaudit-cli 0.3.20 → 0.3.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.20",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.21",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/ci/check-release-approval.yml.template

@@ -58,6 +58,32 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || 'develop' }}
           fetch-depth: 0
 
+      - name: Detect declared standalone housekeeping promotion
+        id: standalone
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          echo "standalone=false" >> "$GITHUB_OUTPUT"
+          chmod +x scripts/derive-release-version.sh scripts/standalone-housekeeping-release.sh 2>/dev/null || true
+          VERSION=$(bash scripts/derive-release-version.sh)
+          if ! [[ "$VERSION" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$ ]]; then
+            exit 0
+          fi
+          DECLARATION="compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${VERSION}.json"
+          if [ ! -f "$DECLARATION" ]; then
+            exit 0
+          fi
+          if ! printf '%s\n%s\n' "$PR_TITLE" "$PR_BODY" | grep -Fq 'Standalone housekeeping promotion'; then
+            echo "::error::Standalone declaration exists, but this PR is missing the literal 'Standalone housekeeping promotion' marker."
+            exit 1
+          fi
+          bash scripts/standalone-housekeeping-release.sh validate "$VERSION" "$DECLARATION"
+          echo "standalone=true" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Declared standalone housekeeping promotion ${VERSION}; normal GitHub review and technical checks remain required, but tracked portal approval does not apply."
+
       - name: Resolve DevAudit base URL
         run: |
           # Prefer sdlc-config.json (visible in PR review) over repo Variable.
@@ -159,7 +185,7 @@ jobs:
 
       - name: Resolve current release
         id: release
-        if: env.BOOTSTRAP_MODE != 'true'
+        if: env.BOOTSTRAP_MODE != 'true' && steps.standalone.outputs.standalone != 'true'
         run: |
           # devaudit#283 — repository_dispatch('release-approved') events
           # carry the release version in client_payload. Use it directly
@@ -218,7 +244,7 @@ jobs:
           esac
 
       - name: Link PR to release
-        if: env.BOOTSTRAP_MODE != 'true' && github.event_name == 'pull_request'
+        if: env.BOOTSTRAP_MODE != 'true' && steps.standalone.outputs.standalone != 'true' && github.event_name == 'pull_request'
         run: |
           RELEASE_ID="${{ steps.release.outputs.release_id }}"
           PR_URL="${{ github.event.pull_request.html_url }}"
@@ -231,7 +257,7 @@ jobs:
           echo "Linked PR #${PR_NUMBER} to release ${RELEASE_ID}"
 
       - name: Post release link on PR
-        if: env.BOOTSTRAP_MODE != 'true' && github.event_name == 'pull_request'
+        if: env.BOOTSTRAP_MODE != 'true' && steps.standalone.outputs.standalone != 'true' && github.event_name == 'pull_request'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -247,7 +273,7 @@ jobs:
           fi
 
       - name: SHA comparison
-        if: env.BOOTSTRAP_MODE != 'true' && github.event_name == 'pull_request'
+        if: env.BOOTSTRAP_MODE != 'true' && steps.standalone.outputs.standalone != 'true' && github.event_name == 'pull_request'
         run: |
           PR_HEAD_SHA="${{ github.event.pull_request.head.sha }}"
           APPROVED_SHA="${{ steps.release.outputs.approved_sha }}"

package/sdlc/files/ci/ci.yml.template

@@ -77,7 +77,8 @@ jobs:
           fi
           [ -n "$BASE" ] || BASE="$DEVAUDIT_BASE_URL_VAR"
           [ -n "$BASE" ] || { echo "::warning::No DevAudit URL; test execution lifecycle disabled"; exit 0; }
-          echo "DEVAUDIT_BASE_URL=${BASE%/}" >> "$GITHUB_ENV"
+          export DEVAUDIT_BASE_URL="${BASE%/}"
+          echo "DEVAUDIT_BASE_URL=${DEVAUDIT_BASE_URL}" >> "$GITHUB_ENV"
           chmod +x scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
           bash scripts/report-test-execution.sh start \
             --project-slug {{PROJECT_SLUG}} \

package/sdlc/files/ci/close-out-completion.yml.template

@@ -0,0 +1,56 @@
+name: Report Release Close-out Completion
+
+on:
+  pull_request:
+    branches: [develop]
+    types: [closed]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  report-completion:
+    if: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'chore/close-out-')
+    runs-on: {{RUNNER}}
+    env:
+      DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
+      PROJECT_SLUG: {{PROJECT_SLUG}}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
+
+      - name: Report tracked close-out completion
+        run: |
+          set -euo pipefail
+          REQ="$(printf '%s' '${{ github.event.pull_request.head.ref }}' | sed -n 's#^chore/close-out-\(REQ-[0-9][0-9][0-9]*\)$#\1#p')"
+          if [ -z "$REQ" ]; then
+            echo "Standalone and integration housekeeping have no tracked close-out callback."
+            exit 0
+          fi
+          BASE="$(jq -r '.devaudit.base_url // empty' sdlc-config.json)"
+          if [ -z "$BASE" ] || [ -z "$DEVAUDIT_API_KEY" ]; then
+            echo "::error::DevAudit base URL and project API key are required for tracked close-out completion."
+            exit 1
+          fi
+          RELEASE="$(curl --fail-with-body -sS -G "${BASE%/}/api/ci/releases/resolve" \
+            -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+            --data-urlencode "projectSlug=${PROJECT_SLUG}" \
+            --data-urlencode "versionPrefix=${REQ}")"
+          RELEASE_ID="$(jq -r '.latest.id // empty' <<<"$RELEASE")"
+          RELEASE_VERSION="$(jq -r '.latest.version // empty' <<<"$RELEASE")"
+          if [ -z "$RELEASE_ID" ] || [ "$RELEASE_VERSION" != "$REQ" ]; then
+            echo "::error::Unable to resolve the tracked release ${REQ}; refusing callback."
+            exit 1
+          fi
+          curl --fail-with-body -sS -X POST "${BASE%/}/api/ci/releases/${RELEASE_ID}/close-out" \
+            -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+            -H 'Content-Type: application/json' \
+            --data "$(jq -nc \
+              --arg workflowRunId '${{ github.run_id }}' \
+              --arg workflowUrl '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}' \
+              --arg pullRequestUrl '${{ github.event.pull_request.html_url }}' \
+              --arg mergeSha '${{ github.event.pull_request.merge_commit_sha }}' \
+              --argjson pullRequestNumber '${{ github.event.pull_request.number }}' \
+              '{status:"completed",workflowRunId:$workflowRunId,workflowUrl:$workflowUrl,pullRequestNumber:$pullRequestNumber,pullRequestUrl:$pullRequestUrl,mergeSha:$mergeSha}')"

package/sdlc/files/ci/close-out-release.yml.template

@@ -54,8 +54,8 @@ jobs:
           REQ="${{ github.event.inputs.release }}${{ github.event.client_payload.release }}"
           PR="${{ github.event.inputs.release_pr }}${{ github.event.client_payload.release_pr }}"
           if ! printf '%s' "$REQ" | grep -qE '^REQ-[0-9]{3,}$'; then
-            echo "::error::No valid REQ-XXX supplied (inputs.release / client_payload.release)."
-            exit 1
+            echo "Standalone and integration housekeeping have no ticket/RTM close-out. No-op."
+            exit 0
           fi
           echo "req=${REQ}" >> "$GITHUB_OUTPUT"
           echo "pr=${PR}" >> "$GITHUB_OUTPUT"

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -910,6 +910,10 @@ jobs:
           fi
 
           if [ "${#REQS[@]}" -eq 0 ]; then
+            if echo "$DERIVED_RELEASE" | grep -qE '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$'; then
+              echo "No tracked REQ was executed for standalone/integration housekeeping ${DERIVED_RELEASE}; preserving this as GitHub historical CI without portal approval evidence."
+              exit 0
+            fi
             REQS=(_compliance-docs)
           fi
           # A bounded Playwright process exits the workflow with `failure`

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.20",
+  "version": "0.3.21",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"