@metasession.co/devaudit-cli 0.3.26 → 0.3.28

package/dist/index.js

@@ -56,7 +56,7 @@ function emitJsonResult(payload) {
 
 // package.json
 var package_default = {
-  version: "0.3.26"};
+  version: "0.3.28"};
 
 // src/lib/version.ts
 var CLI_VERSION = package_default.version;
@@ -2515,6 +2515,10 @@ function buildDbUriStep(dbService, dbPort) {
     '          echo "Database on port: ${DB_PORT}"'
   ].join("\n");
 }
+function resolveRunner(cfg) {
+  if (cfg.runner !== "self-hosted") return cfg.runner;
+  return "${{ inputs.runner_label || vars.CI_RUNNER_LABEL || 'self-hosted' }}";
+}
 async function syncCiTemplates(ctx) {
   const configPath = join(ctx.projectPath, "sdlc-config.json");
   const workflowsDir = join(ctx.projectPath, ".github", "workflows");
@@ -2541,7 +2545,7 @@ async function syncCiTemplates(ctx) {
     PYTHON_VERSION: String(cfg.python_version ?? ""),
     WORKING_DIRECTORY: workingDirectory || ".",
     WORKING_DIR_PREFIX: workingDirPrefix,
-    RUNNER: cfg.runner,
+    RUNNER: resolveRunner(cfg),
     SOURCE_DIRS: cfg.source_dirs,
     SAST_BASELINE: String(cfg.sast_baseline),
     ACCEPTED_DEP_RISKS: cfg.accepted_dep_risks,
@@ -2750,6 +2754,112 @@ async function runValidation(projectPath) {
   }
   return warnings;
 }
+var PATCH_DIRECTORY = ".devaudit-patches";
+async function gitApplyCheck(projectPath, patchPath, reverse = false) {
+  const args = ["apply", "--check", "--whitespace=nowarn"];
+  if (reverse) args.push("--reverse");
+  args.push(patchPath);
+  const result = await execa("git", args, { cwd: projectPath, reject: false });
+  return result.exitCode === 0;
+}
+async function applyConsumerPatches(ctx) {
+  const patchRoot = join(ctx.projectPath, PATCH_DIRECTORY);
+  let entries;
+  try {
+    entries = await readdir(patchRoot, { withFileTypes: true });
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return {
+        name: "consumer patches",
+        filesSynced: 0,
+        skipped: true,
+        message: `${PATCH_DIRECTORY}/ not present`
+      };
+    }
+    throw error;
+  }
+  const patchPaths = entries.filter((entry) => entry.isFile() && entry.name.endsWith(".patch")).map((entry) => join(patchRoot, entry.name)).sort((left, right) => left.localeCompare(right));
+  if (patchPaths.length === 0) {
+    return {
+      name: "consumer patches",
+      filesSynced: 0,
+      skipped: true,
+      message: `no *.patch files in ${PATCH_DIRECTORY}/`
+    };
+  }
+  const applicable = [];
+  const obsolete = [];
+  const conflicts = [];
+  for (const patchPath of patchPaths) {
+    if (await gitApplyCheck(ctx.projectPath, patchPath)) {
+      applicable.push(patchPath);
+    } else if (await gitApplyCheck(ctx.projectPath, patchPath, true)) {
+      obsolete.push(patchPath);
+    } else {
+      conflicts.push(patchPath);
+    }
+  }
+  if (conflicts.length > 0) {
+    const names = conflicts.map((path) => relative(patchRoot, path)).join(", ");
+    throw new Error(
+      `consumer patch conflict: ${names}. Upstream templates changed; re-roll or remove the patch before updating.`
+    );
+  }
+  if (applicable.length > 0) {
+    const check = await execa(
+      "git",
+      ["apply", "--check", "--whitespace=nowarn", ...applicable],
+      { cwd: ctx.projectPath, reject: false }
+    );
+    if (check.exitCode !== 0) {
+      throw new Error(
+        `consumer patches conflict when combined: ${check.stderr || check.stdout || "git apply --check failed"}`
+      );
+    }
+    const applied = [];
+    for (const patchPath of applicable) {
+      const apply = await execa(
+        "git",
+        ["apply", "--whitespace=nowarn", patchPath],
+        {
+          cwd: ctx.projectPath,
+          reject: false
+        }
+      );
+      if (apply.exitCode === 0) {
+        applied.push(patchPath);
+        continue;
+      }
+      const rollbackErrors = [];
+      for (const appliedPath of applied.reverse()) {
+        const rollback = await execa(
+          "git",
+          ["apply", "--reverse", "--whitespace=nowarn", appliedPath],
+          { cwd: ctx.projectPath, reject: false }
+        );
+        if (rollback.exitCode !== 0) {
+          rollbackErrors.push(relative(patchRoot, appliedPath));
+        }
+      }
+      const rollbackMessage = rollbackErrors.length > 0 ? ` Rollback failed for: ${rollbackErrors.join(", ")}; restore these files before retrying.` : "";
+      throw new Error(
+        `consumer patches conflict when combined: ${apply.stderr || apply.stdout || "git apply failed"}.${rollbackMessage}`
+      );
+    }
+  }
+  const appliedNames = applicable.map((path) => relative(patchRoot, path));
+  const obsoleteNames = obsolete.map((path) => relative(patchRoot, path));
+  const details = [
+    appliedNames.length > 0 ? `applied: ${appliedNames.join(", ")}` : "",
+    obsoleteNames.length > 0 ? `obsolete/already upstream: ${obsoleteNames.join(", ")} (remove after review)` : ""
+  ].filter(Boolean);
+  return {
+    name: "consumer patches",
+    filesSynced: applicable.length,
+    message: details.join("; "),
+    ...obsoleteNames.length > 0 ? { warning: `${obsoleteNames.length} obsolete consumer patch(es)` } : {}
+  };
+}
 
 // src/update/index.ts
 var SECTION_RUNNERS = [
@@ -2765,7 +2875,8 @@ var SECTION_RUNNERS = [
   { key: "2g", run: syncGitignore },
   { key: "2h", run: syncSdlcEngine },
   { key: "2i", run: syncWorkflows },
-  { key: "2j", run: verifyBranchProtection }
+  { key: "2j", run: applyConsumerPatches },
+  { key: "2k", run: verifyBranchProtection }
 ];
 async function syncProject(projectPath) {
   const absPath = resolve(projectPath);
@@ -2776,36 +2887,64 @@ async function syncProject(projectPath) {
   const log = logger();
   const projectName = basename(absPath);
   log.info(`--- Syncing to: ${projectName} (${absPath}) ---`);
-  const { stack, host, deprecatedDefaults } = await resolveAdapters(absPath, installerRoot);
+  const { stack, host, deprecatedDefaults } = await resolveAdapters(
+    absPath,
+    installerRoot
+  );
   log.info(`  Stack: ${stack} | Host: ${host}`);
   if (deprecatedDefaults) {
-    log.warn(`  DEPRECATED: stack/host keys missing from sdlc-config.json \u2014 defaulted to ${stack}+${host}.`);
+    log.warn(
+      `  DEPRECATED: stack/host keys missing from sdlc-config.json \u2014 defaulted to ${stack}+${host}.`
+    );
   }
-  const ctx = { installerRoot, projectPath: absPath, projectName, stack, host };
+  const ctx = {
+    installerRoot,
+    projectPath: absPath,
+    projectName,
+    stack,
+    host
+  };
   const sections = [];
+  const sectionWarnings = [];
   let total = 0;
   for (const { key, run } of SECTION_RUNNERS) {
     const result = await run(ctx);
     sections.push(result);
     total += result.filesSynced;
     if (result.skipped) {
-      log.log(`  [${key}] ${result.name}: SKIPPED${result.message ? ` (${result.message})` : ""}`);
+      log.log(
+        `  [${key}] ${result.name}: SKIPPED${result.message ? ` (${result.message})` : ""}`
+      );
     } else {
-      log.log(`  [${key}] ${result.name}: ${result.filesSynced} file(s)${result.message ? ` \u2014 ${result.message}` : ""}`);
+      log.log(
+        `  [${key}] ${result.name}: ${result.filesSynced} file(s)${result.message ? ` \u2014 ${result.message}` : ""}`
+      );
+    }
+    if (result.warning) {
+      sectionWarnings.push(result.warning);
+      log.warn(`  [${key}] ${result.warning}`);
     }
   }
   log.log("");
   log.info(`  Total: ${total} files synced`);
   log.log("");
   log.log("  --- Validation ---");
-  const warnings = await runValidation(absPath);
+  const validationWarnings = await runValidation(absPath);
+  const warnings = [...sectionWarnings, ...validationWarnings];
   if (warnings.length === 0) {
     log.success("  All validation checks passed");
   } else {
     for (const w of warnings) log.warn(`  ${w}`);
   }
   log.log("");
-  return { project: projectName, stack, host, sections, totalFilesSynced: total, warnings };
+  return {
+    project: projectName,
+    stack,
+    host,
+    sections,
+    totalFilesSynced: total,
+    warnings
+  };
 }
 async function syncAll(projectPaths) {
   const reports = [];
@@ -2814,7 +2953,9 @@ async function syncAll(projectPaths) {
       reports.push(await syncProject(p));
     } catch (err) {
       const log = logger();
-      log.error(`ERROR syncing ${p}: ${err instanceof Error ? err.message : String(err)}`);
+      log.error(
+        `ERROR syncing ${p}: ${err instanceof Error ? err.message : String(err)}`
+      );
       throw err;
     }
   }