@metasession.co/devaudit-cli 0.3.26 → 0.3.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.26",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.28",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/_common/scripts/close-out-release.sh

@@ -34,6 +34,10 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=markdown-table.sh
+source "$SCRIPT_DIR/markdown-table.sh"
+
 REQ_ID="${1:-}"
 RELEASE_PR=""
 shift || true
@@ -89,21 +93,14 @@ find_release_ticket_file() {
 update_rtm_status() {
   local req_id="$1"
   local target_status="$2"
-  local tmp_file
+  local tmp_file status_col
   tmp_file="$(mktemp)"
-  if [ -f "$RTM" ] && grep -qE "^\| ${req_id} " "$RTM"; then
-    awk -v req="$req_id" -v target_status="$target_status" '
-      BEGIN { FS="|"; OFS="|"; statuscol=0 }
+  status_col="$(markdown_table_column_index_for_row \
+    "$RTM" "$req_id" Status REQ-ID/ID Status 2>/dev/null || true)"
+  if [ -n "$status_col" ]; then
+    awk -v req="$req_id" -v target_status="$target_status" -v statuscol="$status_col" '
+      BEGIN { FS="|"; OFS="|" }
       /\\\|/ { gsub(/\\\|/, "\001", $0) }
-      {
-        cand=0; idseen=0
-        for (i=1; i<=NF; i++) {
-          c=$i; gsub(/^[[:space:]]+|[[:space:]]+$/, "", c)
-          if (c=="Status") cand=i
-          if (c=="ID" || c=="REQ-ID" || c=="REQ ID" || c ~ /^Requirement/) idseen=1
-        }
-        if (cand>0 && idseen) statuscol=cand
-      }
       $0 ~ ("^\\| " req " ") && statuscol>0 {
         cell=$statuscol
         note=""

package/sdlc/files/_common/scripts/evaluate-npm-audit.sh

@@ -39,6 +39,7 @@ done
 python3 - "$AUDIT_PATH" "$LOCK_PATH" "$EXCEPTIONS_PATH" "$OUTPUT_PATH" <<'PY'
 import json
 import os
+import re
 import sys
 from datetime import date
 
@@ -144,8 +145,11 @@ for index, item in enumerate(exceptions, start=1):
         fail(f"exception {index} approvedAt cannot be in the future")
     if expires_at <= today:
         fail(f"exception {index} is expired on {item['expiresAt']}")
-    if not item["remediationIssue"].startswith("https://github.com/"):
-        fail(f"exception {index} remediationIssue must be a GitHub issue URL")
+    if re.fullmatch(r"https://github\.com/[^/]+/[^/]+/issues/[1-9][0-9]*", item["remediationIssue"]) is None:
+        fail(f"exception {index} remediationIssue must be an exact GitHub issue URL")
+    controls = item.get("compensatingControls")
+    if controls is not None and (not isinstance(controls, str) or not controls.strip()):
+        fail(f"exception {index} compensatingControls must be a non-empty string when present")
     key = (item["advisoryId"], item["dependencyPath"])
     if key in seen_exception_keys:
         fail(f"duplicate exception for {item['advisoryId']} at {item['dependencyPath']}")
@@ -217,10 +221,13 @@ for finding_name, finding in audit["vulnerabilities"].items():
                     file=sys.stderr,
                 )
             else:
-                accepted.append({**context, "acceptance": {
+                acceptance = {
                     field: match[field]
                     for field in ("approvedAt", "expiresAt", "approvedBy", "reason", "remediationIssue")
-                }})
+                }
+                if "compensatingControls" in match:
+                    acceptance["compensatingControls"] = match["compensatingControls"]
+                accepted.append({**context, "acceptance": acceptance})
                 print(
                     f"Accepted temporary risk: {identifier} ({package}@{version}) "
                     f"until {match['expiresAt']} by {match['approvedBy']}; "

package/sdlc/files/_common/scripts/evaluate-npm-audit.test.sh

@@ -7,6 +7,9 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 HELPER="$SCRIPT_DIR/evaluate-npm-audit.sh"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
+APPROVED_AT="$(date -u -d 'yesterday' +%Y-%m-%d)"
+EXPIRES_AT="$(date -u -d '+30 days' +%Y-%m-%d)"
+EXPIRED_AT="$(date -u -d 'yesterday' +%Y-%m-%d)"
 
 mkdir -p "$WORK/compliance/security"
 
@@ -66,11 +69,16 @@ write_exception() {
       "expiresAt": "2026-12-31",
       "approvedBy": "reviewer@example.test",
       "reason": "Fixture acceptance while the introducing dependency awaits an upstream repair.",
-      "remediationIssue": "https://github.com/example/repo/issues/1"
+      "remediationIssue": "https://github.com/example/repo/issues/1",
+      "compensatingControls": "Monitor upstream releases and retain the unaffected root package."
     }
   ]
 }
 JSON
+  jq --arg approved "$APPROVED_AT" --arg expires "$EXPIRES_AT" \
+    '.exceptions[0].approvedAt = $approved | .exceptions[0].expiresAt = $expires' \
+    "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+  mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
 }
 
 run_helper() {
@@ -107,7 +115,7 @@ jq -e '.summary.accepted == 0 and .summary.unresolved == 0' "$WORK/dependency-ri
 write_audit
 write_exception
 expect_success
-jq -e '.summary.accepted == 1 and .summary.unresolved == 0 and .accepted[0].acceptance.remediationIssue == "https://github.com/example/repo/issues/1"' \
+jq -e '.summary.accepted == 1 and .summary.unresolved == 0 and .accepted[0].acceptance.remediationIssue == "https://github.com/example/repo/issues/1" and (.accepted[0].acceptance.compensatingControls | length > 0)' \
   "$WORK/dependency-risk-evaluation.json" >/dev/null
 
 jq '.exceptions[0].advisoryId = "GHSA-wrong"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
@@ -140,7 +148,7 @@ expect_failure
 
 write_exception
 write_audit
-jq '.exceptions[0].expiresAt = "2026-01-01"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+jq --arg expired "$EXPIRED_AT" '.exceptions[0].expiresAt = $expired' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
 mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
 expect_failure
 
@@ -150,6 +158,18 @@ jq '.exceptions[0].expiresAt = "not-a-date"' "$WORK/compliance/security/accepted
 mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
 expect_failure
 
+write_exception
+write_audit
+jq '.exceptions[0].remediationIssue = "https://github.com/example/repo"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq '.exceptions[0].compensatingControls = []' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
 write_exception
 write_audit
 jq 'del(.exceptions[0].approvedAt)' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"

package/sdlc/files/_common/scripts/markdown-table.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# Context-aware helpers for simple GitHub-flavoured Markdown tables.
+
+markdown_table_cell() {
+  local file="$1"
+  local key_value="$2"
+  local target_header="$3"
+  shift 3
+  local required_headers=("$@")
+
+  [ -f "$file" ] || return 1
+  awk \
+    -v key_value="$key_value" \
+    -v target_header="$target_header" \
+    -v required_headers="$(IFS=,; printf '%s' "${required_headers[*]}")" '
+      function clean(value) {
+        gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+        gsub(/\001/, "\\|", value)
+        return value
+      }
+      function split_row(line, cells,    protected) {
+        protected=line
+        gsub(/\\\|/, "\001", protected)
+        return split(protected, cells, "|")
+      }
+      function header_matches(name, required,    options, count, i) {
+        count=split(required, options, "/")
+        for (i=1; i<=count; i++) {
+          if (tolower(name) == tolower(options[i])) return 1
+        }
+        return 0
+      }
+      BEGIN {
+        required_count=split(required_headers, required, ",")
+        active=0
+      }
+      /^\|/ {
+        count=split_row($0, cells)
+        candidate_target=0
+        candidate_key=0
+        matched=0
+        for (i=2; i<count; i++) {
+          name=clean(cells[i])
+          if (tolower(name) == tolower(target_header)) candidate_target=i
+          for (r=1; r<=required_count; r++) {
+            if (header_matches(name, required[r])) matched++
+          }
+          if (header_matches(name, required[1])) candidate_key=i
+        }
+        if (candidate_target && candidate_key && matched >= required_count) {
+          active=1
+          target_index=candidate_target
+          key_index=candidate_key
+          next
+        }
+        if (active && key_index && target_index && clean(cells[key_index]) == key_value) {
+          print clean(cells[target_index])
+          found=1
+          exit 0
+        }
+        next
+      }
+      { active=0; key_index=0; target_index=0 }
+      END { if (!found) exit 1 }
+    ' "$file"
+}
+
+markdown_table_column_index_for_row() {
+  local file="$1"
+  local key_value="$2"
+  local target_header="$3"
+  shift 3
+  local required_headers=("$@")
+
+  [ -f "$file" ] || return 1
+  awk \
+    -v key_value="$key_value" \
+    -v target_header="$target_header" \
+    -v required_headers="$(IFS=,; printf '%s' "${required_headers[*]}")" '
+      function clean(value) {
+        gsub(/^[[:space:]]+|[[:space:]]+$/, "", value)
+        return value
+      }
+      function split_row(line, cells,    protected) {
+        protected=line
+        gsub(/\\\|/, "\001", protected)
+        return split(protected, cells, "|")
+      }
+      function header_matches(name, required,    options, count, i) {
+        count=split(required, options, "/")
+        for (i=1; i<=count; i++) {
+          if (tolower(name) == tolower(options[i])) return 1
+        }
+        return 0
+      }
+      BEGIN { required_count=split(required_headers, required, ","); active=0 }
+      /^\|/ {
+        count=split_row($0, cells)
+        candidate_target=0
+        candidate_key=0
+        matched=0
+        for (i=2; i<count; i++) {
+          name=clean(cells[i])
+          if (tolower(name) == tolower(target_header)) candidate_target=i
+          for (r=1; r<=required_count; r++) {
+            if (header_matches(name, required[r])) matched++
+          }
+          if (header_matches(name, required[1])) candidate_key=i
+        }
+        if (candidate_target && candidate_key && matched >= required_count) {
+          active=1
+          target_index=candidate_target
+          key_index=candidate_key
+          next
+        }
+        if (active && clean(cells[key_index]) == key_value) {
+          print target_index
+          found=1
+          exit 0
+        }
+        next
+      }
+      { active=0 }
+      END { if (!found) exit 1 }
+    ' "$file"
+}

package/sdlc/files/_common/scripts/markdown-table.test.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=markdown-table.sh
+source "$SCRIPT_DIR/markdown-table.sh"
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+cat > "$WORK/RTM.md" <<'MARKDOWN'
+| Status | Description |
+| --- | --- |
+| Draft | This is not the requirements table |
+
+| REQ-ID | Issue | Risk | Evidence | Status |
+| --- | --- | --- | --- | --- |
+| REQ-100 | #100 | HIGH | report.md | TESTED - PENDING SIGN-OFF (note \| retained) |
+MARKDOWN
+
+[ "$(markdown_table_cell "$WORK/RTM.md" REQ-100 Status REQ-ID/ID Status)" = \
+  'TESTED - PENDING SIGN-OFF (note \| retained)' ]
+[ "$(markdown_table_cell "$WORK/RTM.md" REQ-100 Risk REQ-ID/ID Risk)" = "HIGH" ]
+[ "$(markdown_table_column_index_for_row "$WORK/RTM.md" REQ-100 Status REQ-ID/ID Status)" = "5" ]
+
+if markdown_table_cell "$WORK/RTM.md" REQ-404 Status REQ-ID/ID Status >/dev/null; then
+  echo "missing row unexpectedly matched" >&2
+  exit 1
+fi
+
+if markdown_table_cell "$WORK/RTM.md" Draft Status REQ-ID/ID Status >/dev/null; then
+  echo "legend row unexpectedly matched" >&2
+  exit 1
+fi
+
+echo "markdown table tests passed"

package/sdlc/files/_common/scripts/validate-compliance-artifacts.sh

@@ -12,6 +12,10 @@
 
 set -euo pipefail
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=markdown-table.sh
+source "$SCRIPT_DIR/markdown-table.sh"
+
 BASE_BRANCH="${1:-origin/main}"
 EXIT_CODE=0
 
@@ -53,6 +57,7 @@ find_first_match() {
   local match=""
   match=$(compgen -G "$pattern" | head -1 || true)
   [ -n "$match" ] && printf '%s' "$match"
+  return 0
 }
 
 require_bundled_fields() {
@@ -81,7 +86,9 @@ for REQ in $REQUIREMENTS; do
   # The `| $REQ ` pattern (leading pipe + trailing space) matches the
   # markdown table row used in RTM, so a substring elsewhere doesn't
   # accidentally satisfy it.
-  if ! grep -q "| $REQ " compliance/RTM.md 2>/dev/null; then
+  RTM_STATUS="$(markdown_table_cell \
+    compliance/RTM.md "$REQ" Status REQ-ID/ID Status 2>/dev/null || true)"
+  if [ -z "$RTM_STATUS" ]; then
     echo "  INFO: $REQ is referenced in commits but has no RTM row — skipping (forward-reference, not a tracked requirement for this release)"
     continue
   fi
@@ -187,12 +194,12 @@ for REQ in $REQUIREMENTS; do
   # by a successor (e.g. REQ-030 superseded by REQ-031). Without this
   # branch every PR with a commit referencing a SUPERSEDED REQ blocks
   # CI (#232).
-  if grep -q "$REQ" compliance/RTM.md 2>/dev/null; then
-    if grep "$REQ" compliance/RTM.md | grep -q "TESTED - PENDING SIGN-OFF"; then
+  if [ -n "$RTM_STATUS" ]; then
+    if printf '%s' "$RTM_STATUS" | grep -q "TESTED - PENDING SIGN-OFF"; then
       echo "  OK: RTM status is TESTED - PENDING SIGN-OFF"
-    elif grep "$REQ" compliance/RTM.md | grep -q "APPROVED"; then
+    elif printf '%s' "$RTM_STATUS" | grep -q "APPROVED"; then
       echo "  OK: RTM status is APPROVED"
-    elif grep "$REQ" compliance/RTM.md | grep -q "SUPERSEDED"; then
+    elif printf '%s' "$RTM_STATUS" | grep -q "SUPERSEDED"; then
       echo "  OK: RTM status is SUPERSEDED"
     else
       echo "  WARNING: RTM entry exists but status is not TESTED - PENDING SIGN-OFF"
@@ -371,7 +378,9 @@ for REQ in $REQUIREMENTS; do
   fi
 
   # Check implementation-plan.md for MEDIUM/HIGH risk (check RTM for risk level)
-  if grep "$REQ" compliance/RTM.md 2>/dev/null | grep -qiE 'MEDIUM|HIGH'; then
+  RTM_RISK="$(markdown_table_cell \
+    compliance/RTM.md "$REQ" Risk REQ-ID/ID Risk 2>/dev/null || true)"
+  if printf '%s' "$RTM_RISK" | grep -qiE 'MEDIUM|HIGH'; then
     if [ ! -f "compliance/evidence/$REQ/implementation-plan.md" ]; then
       echo "  ERROR: Implementation plan missing for MEDIUM/HIGH risk: compliance/evidence/$REQ/implementation-plan.md"
       EXIT_CODE=1

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -341,7 +341,7 @@ Reached from Phase 0 for non-tracked change-types. The skill drives this end-to-
    - **Post-merge-only CI (older generated workflows — `push: branches: [<integration>]` with no `pull_request:` trigger)** — say so explicitly in the LAST/NEXT sticky: _"no PR-time checks will fire; review + merge is the gate; CI runs post-merge on `$INTEGRATION_BRANCH`."_ Don't poll the PR for checks that won't arrive. The post-merge run (CI Pipeline + Compliance Evidence Upload on the integration branch) is the actual gate; address it via fix-forward if it fails.
 
    Either way, never bypass a gate (no `--no-verify`, no `--admin` merge of a red required check); the only difference is **where** you wait for the gate to fire — before merge vs. after merge.
-8. **Guide review -> merge.** A human still reviews the PR. Merge only after all required checks are terminal green on the current PR head SHA; queued, running, stale, cancelled, unexpectedly skipped, or failed checks are not green. There is no portal release approval, UAT four-eyes, Production gate, or standalone close-out on the normal lightweight path.
+8. **Guide review -> merge.** A human still reviews the PR. Merge only after all required checks are terminal green on the current PR head SHA; queued, running, stale, cancelled, unexpectedly skipped, or failed checks are not green. If GitHub leaves a stale projection, use the repository's **Recover Required Checks** workflow: dry-run first, then apply only to rerun a resolvable completed Actions run on the same SHA. When GitHub never created the required suite, push an auditable empty commit to the PR branch and verify the new SHA; never fabricate status or bypass protection. There is no portal release approval, UAT four-eyes, Production gate, or standalone close-out on the normal lightweight path.
 9. **Record the correct release meaning.** A housekeeping push produces at most a bare-date release (`vYYYY.MM.DD`) that is integration/history, not an active approval by default. It waits on `$INTEGRATION_BRANCH` until a later tracked release explicitly absorbs it through the required bundled-changes markdown/JSON manifest and portal lineage. Never infer that an unrelated hotfix or mandatory back-merge belongs to the only pending REQ. A submitted REQ bundle is frozen approval scope; changing it returns that REQ to evidence compilation and UAT resubmission. A doc-only push attaches documents to the existing `REQ-XXX` release.
 10. **Standalone exception.** Only when housekeeping cannot reasonably wait for the next tracked release may the skill prepare a standalone promotion. It must state `Standalone housekeeping promotion` and why in the release PR, add `compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-vYYYY.MM.DD.json` with `schemaVersion: 1`, the exact derived bare-date version, `releaseMode: standalone_housekeeping`, and a specific reason. It must obtain terminal-green CI and PR review. The installed release-scope check validates the declaration before merge; post-deploy uploads it as release-ticket evidence and changes the portal row to standalone housekeeping. Use portal approval only if project policy explicitly opts in. If the installed workflow cannot implement that policy, halt and keep the change on the normal integration path.
 

package/sdlc/files/ci/check-release-approval.yml.template

@@ -22,6 +22,10 @@ on:
   pull_request:
     branches: [main]
   workflow_dispatch:
+    inputs:
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   repository_dispatch:
     types: [release-approved]
 

package/sdlc/files/ci/ci.yml.template

@@ -15,6 +15,10 @@ name: CI Pipeline
 
 on:
   workflow_dispatch:
+    inputs:
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   pull_request:
     branches: [{{INTEGRATION_BRANCH}}]
   push:
@@ -178,7 +182,9 @@ jobs:
 {{E2E_DEV_SERVER_STEP}}
 
       - name: Wait for dev server
-        run: npx wait-on http://localhost:3000 --timeout 120000
+        # The inner wait-on timeout is diagnostic; the outer deadline keeps a
+        # hung child from consuming the entire quality-gates job budget.
+        run: timeout --signal=TERM --kill-after=15s 150s npx wait-on http://localhost:3000 --timeout 120000
 
       # Compute the set of e2e spec files added on this branch (relative
       # to the merge base). The evidenceShot helper in the consumer's
@@ -352,8 +358,10 @@ jobs:
           fi
           chmod +x scripts/standalone-housekeeping-release.sh scripts/upload-evidence.sh 2>/dev/null || true
           bash scripts/standalone-housekeeping-release.sh validate "$VERSION" "$DECLARATION"
+          # A bare-date version identifies the release, not a requirement. Use
+          # the portal's common evidence scope while preserving release ownership.
           bash scripts/upload-evidence.sh \
-            {{PROJECT_SLUG}} "$VERSION" release_ticket "$DECLARATION" \
+            {{PROJECT_SLUG}} _compliance-docs release_ticket "$DECLARATION" \
             --release "$VERSION" --create-release-if-missing \
             --environment uat --category release_artifact --sdlc-stage 2 \
             --git-sha ${{ github.sha }} --branch ${{ github.ref_name }}

package/sdlc/files/ci/close-out-release.yml.template

@@ -28,6 +28,9 @@ on:
       release_pr:
         description: 'Release PR number or URL to backlink (optional)'
         required: false
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   repository_dispatch:
     types: [release-closed]
 

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -21,6 +21,10 @@ name: Compliance Evidence Upload
 
 on:
   workflow_dispatch:
+    inputs:
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   push:
     branches: [develop]
     paths:
@@ -443,16 +447,15 @@ jobs:
             DERIVED_RELEASE="${REQS[0]}"
           fi
 
-          if [ "$PRIOR_EVENT" = "deployment_status" ] && [ "${#REQS[@]}" -eq 0 ]; then
-            echo "::error::Deployment-origin E2E evidence requires tagged or in-scope REQ attribution; refusing _compliance-docs fallback."
-            exit 1
-          fi
-
           if [ "${#REQS[@]}" -eq 0 ]; then
             if echo "$DERIVED_RELEASE" | grep -qE '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$'; then
               echo "No tracked REQ was executed for standalone/integration housekeeping ${DERIVED_RELEASE}; preserving this as GitHub historical CI without portal approval evidence."
               exit 0
             fi
+            if [ "$PRIOR_EVENT" = "deployment_status" ]; then
+              echo "::error::Deployment-origin E2E evidence requires tagged or in-scope REQ attribution; refusing _compliance-docs fallback."
+              exit 1
+            fi
             REQS=(_compliance-docs)
           fi
           # A bounded Playwright process exits the workflow with `failure`

package/sdlc/files/ci/feature-e2e.yml.template

@@ -61,7 +61,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: {{NODE_VERSION}}
       - name: Install dependencies (skip if lockfile unchanged)
@@ -84,7 +84,8 @@ jobs:
 {{E2E_DEV_SERVER_STEP}}
 
       - name: Wait for dev server
-        run: npx wait-on http://localhost:3000 --timeout 120000
+        # Keep a process-level bound in addition to wait-on's internal timer.
+        run: timeout --signal=TERM --kill-after=15s 150s npx wait-on http://localhost:3000 --timeout 120000
 
       # Compute the set of e2e spec files added on this branch (relative
       # to the merge base). The evidenceShot helper reads E2E_NEW_SPECS

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -29,6 +29,9 @@ on:
       release:
         description: 'Optional REQ-XXX / version to promote (blank = all in-scope from pending release tickets).'
         required: false
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   deployment_status:
     types: [created]
 

package/sdlc/files/ci/python/ci.yml.template

@@ -14,6 +14,10 @@ name: CI Pipeline
 
 on:
   workflow_dispatch:
+    inputs:
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   pull_request:
     branches: [{{INTEGRATION_BRANCH}}]
   push:
@@ -311,11 +315,10 @@ jobs:
     name: Upload Evidence
     runs-on: {{RUNNER}}
     needs: [quality-gates, register-release]
-    # `always()` instead of `!failure()` so failed gates still upload their
-    # evidence — `status=failed` is itself the audit trail. `!cancelled()`
-    # still guards against partial state on operator-cancel.
-    # DevAudit-Installer#96.
-    if: ${{ always() && !cancelled() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
+    # Pull requests do not register or upload release evidence. Keeping this
+    # intentionally inapplicable job out of `always()` avoids a cancelled
+    # aggregate workflow when Register Release is correctly skipped (#500).
+    if: ${{ !cancelled() && github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}

package/sdlc/files/ci/reconcile-deployment.yml.template

@@ -24,6 +24,9 @@ on:
       health_url:
         description: 'Configured production health URL'
         required: true
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
 
 jobs:
   reconcile:

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"