@metasession.co/devaudit-cli 0.3.21 → 0.3.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.21",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.23",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/ci/ci.yml.template

@@ -161,18 +161,38 @@ jobs:
         run: |
           # stderr → /dev/null so warnings can't corrupt the JSON (DevAudit #48)
           npm audit --json > dependency-audit.json 2>/dev/null || true
-          ACCEPTED="{{ACCEPTED_DEP_RISKS}}"
-          UNACCEPTED=$(python3 -c "
-          import json
+          # Optional, repository-owned exceptions must be advisory- and
+          # range-specific, approved, and unexpired. Missing means none.
+          UNACCEPTED=$(python3 - <<'PY' 2>/dev/null || echo "unknown"
+          import json, os
+          from datetime import date
           with open('dependency-audit.json') as f:
-            data = json.load(f)
-          accepted = set('${ACCEPTED}'.split()) if '${ACCEPTED}' else set()
-          vulns = data.get('vulnerabilities', {})
-          issues = [name for name, v in vulns.items()
-                    if v.get('severity') in ('high', 'critical')
-                    and name not in accepted]
-          print(len(issues))
-          " 2>/dev/null || echo "unknown")
+              audit = json.load(f)
+          path = 'compliance/security/accepted-vulnerabilities.json'
+          exceptions = []
+          if os.path.exists(path):
+              with open(path) as f:
+                  exceptions = json.load(f).get('exceptions', [])
+          def accepted(package, finding):
+              advisory_ids = {
+                  item.get('url', '').rsplit('/', 1)[-1]
+                  for item in finding.get('via', []) if isinstance(item, dict)
+              }
+              for item in exceptions:
+                  required = ('advisoryId', 'package', 'vulnerableRange', 'expiresAt', 'approvedBy', 'reason', 'remediationIssue')
+                  if not all(item.get(key) for key in required):
+                      continue
+                  if item['expiresAt'] < date.today().isoformat():
+                      continue
+                  if item['package'] == package and item['vulnerableRange'] == finding.get('range') and item['advisoryId'] in advisory_ids:
+                      print(f"Accepted temporary risk: {item['advisoryId']} ({package}) until {item['expiresAt']}")
+                      return True
+              return False
+          findings = audit.get('vulnerabilities', {})
+          unresolved = [name for name, finding in findings.items()
+                        if finding.get('severity') in ('high', 'critical') and not accepted(name, finding)]
+          print(len(unresolved))
+          PY
           echo "Unaccepted high/critical: $UNACCEPTED"
           if [ "$UNACCEPTED" != "0" ] && [ "$UNACCEPTED" != "unknown" ]; then
             echo "::error::$UNACCEPTED unaccepted high/critical vulnerability(ies)."
@@ -472,11 +492,11 @@ jobs:
     name: Upload Evidence
     runs-on: {{RUNNER}}
     needs: [quality-gates, register-release]
-    # `always()` instead of `!failure()` so failed gates still upload their
-    # evidence — `status=failed` is itself the audit trail. `!cancelled()`
-    # still guards against partial state on operator-cancel.
-    # DevAudit-Installer#96.
-    if: ${{ always() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
+    # `!cancelled()` preserves failed-gate evidence on eligible integration
+    # pushes, while a pull request remains an intentionally inapplicable,
+    # cleanly skipped job. `always()` caused GitHub to mark this job cancelled
+    # when Register Release was correctly skipped on a no-REQ PR (#500).
+    if: ${{ !cancelled() && github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}

package/sdlc/files/ci/close-out-release.yml.template

@@ -96,6 +96,29 @@ jobs:
             echo "Nothing to close out (idempotent no-op) — no PR opened."
           fi
 
+      - name: Report verified manual close-out catch-up
+        if: github.event_name == 'workflow_dispatch' && steps.closeout.outputs.changed != 'true' && steps.merge.outputs.merged != 'true'
+        run: |
+          set -euo pipefail
+          REQ="${{ steps.in.outputs.req }}"
+          PR_REF="${{ steps.in.outputs.pr }}"
+          [ -n "$REQ" ] && [ -n "$PR_REF" ] || { echo "::error::Manual no-op reporting requires release and release_pr."; exit 1; }
+          PR_JSON="$(gh pr view "$PR_REF" --repo "$GITHUB_REPOSITORY" --json mergedAt,baseRefName,headRefName,mergeCommit,number,url)"
+          HEAD="$(jq -r '.headRefName // empty' <<<"$PR_JSON")"
+          BASE="$(jq -r '.baseRefName // empty' <<<"$PR_JSON")"
+          MERGED="$(jq -r '.mergedAt // empty' <<<"$PR_JSON")"
+          SHA="$(jq -r '.mergeCommit.oid // empty' <<<"$PR_JSON")"
+          NUMBER="$(jq -r '.number' <<<"$PR_JSON")"
+          URL="$(jq -r '.url' <<<"$PR_JSON")"
+          [ -n "$MERGED" ] && [ "$BASE" = develop ] && [ "$HEAD" = "chore/close-out-$REQ" ] && [ -n "$SHA" ] || { echo "::error::release_pr must be a merged develop close-out PR for $REQ."; exit 1; }
+          BASE_URL="${DEVAUDIT_BASE_URL:-}"
+          [ -n "$BASE_URL" ] && [ -n "$DEVAUDIT_API_KEY" ] || { echo "::error::DevAudit base URL and project API key are required."; exit 1; }
+          RELEASE="$(curl --fail-with-body -sS -G "${BASE_URL%/}/api/ci/releases/resolve" -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" --data-urlencode "projectSlug={{PROJECT_SLUG}}" --data-urlencode "versionPrefix=${REQ}")"
+          RELEASE_ID="$(jq -r '.latest.id // empty' <<<"$RELEASE")"
+          RELEASE_VERSION="$(jq -r '.latest.version // empty' <<<"$RELEASE")"
+          [ "$RELEASE_VERSION" = "$REQ" ] && [ -n "$RELEASE_ID" ] || { echo "::error::Unable to resolve $REQ."; exit 1; }
+          curl --fail-with-body -sS -X POST "${BASE_URL%/}/api/ci/releases/${RELEASE_ID}/close-out" -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" -H 'Content-Type: application/json' --data "$(jq -nc --arg workflowRunId '${{ github.run_id }}' --arg workflowUrl '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}' --arg pullRequestUrl "$URL" --arg mergeSha "$SHA" --argjson pullRequestNumber "$NUMBER" '{status:"completed",workflowRunId:$workflowRunId,workflowUrl:$workflowUrl,pullRequestNumber:$pullRequestNumber,pullRequestUrl:$pullRequestUrl,mergeSha:$mergeSha}')"
+
       - name: Close existing sync PRs for same REQ
         if: steps.closeout.outputs.changed == 'true' || steps.merge.outputs.merged == 'true'
         run: |

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"