@metasession.co/devaudit-cli 0.3.27 → 0.3.29

package/sdlc/files/ci/check-release-approval.yml.template

@@ -22,6 +22,10 @@ on:
   pull_request:
     branches: [main]
   workflow_dispatch:
+    inputs:
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   repository_dispatch:
     types: [release-approved]
 

package/sdlc/files/ci/ci.yml.template

@@ -15,6 +15,10 @@ name: CI Pipeline
 
 on:
   workflow_dispatch:
+    inputs:
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   pull_request:
     branches: [{{INTEGRATION_BRANCH}}]
   push:
@@ -178,7 +182,9 @@ jobs:
 {{E2E_DEV_SERVER_STEP}}
 
       - name: Wait for dev server
-        run: npx wait-on http://localhost:3000 --timeout 120000
+        # The inner wait-on timeout is diagnostic; the outer deadline keeps a
+        # hung child from consuming the entire quality-gates job budget.
+        run: timeout --signal=TERM --kill-after=15s 150s npx wait-on http://localhost:3000 --timeout 120000
 
       # Compute the set of e2e spec files added on this branch (relative
       # to the merge base). The evidenceShot helper in the consumer's
@@ -352,8 +358,10 @@ jobs:
           fi
           chmod +x scripts/standalone-housekeeping-release.sh scripts/upload-evidence.sh 2>/dev/null || true
           bash scripts/standalone-housekeeping-release.sh validate "$VERSION" "$DECLARATION"
+          # A bare-date version identifies the release, not a requirement. Use
+          # the portal's common evidence scope while preserving release ownership.
           bash scripts/upload-evidence.sh \
-            {{PROJECT_SLUG}} "$VERSION" release_ticket "$DECLARATION" \
+            {{PROJECT_SLUG}} _compliance-docs release_ticket "$DECLARATION" \
             --release "$VERSION" --create-release-if-missing \
             --environment uat --category release_artifact --sdlc-stage 2 \
             --git-sha ${{ github.sha }} --branch ${{ github.ref_name }}

package/sdlc/files/ci/close-out-release.yml.template

@@ -28,6 +28,9 @@ on:
       release_pr:
         description: 'Release PR number or URL to backlink (optional)'
         required: false
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   repository_dispatch:
     types: [release-closed]
 

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -21,6 +21,10 @@ name: Compliance Evidence Upload
 
 on:
   workflow_dispatch:
+    inputs:
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   push:
     branches: [develop]
     paths:
@@ -443,16 +447,15 @@ jobs:
             DERIVED_RELEASE="${REQS[0]}"
           fi
 
-          if [ "$PRIOR_EVENT" = "deployment_status" ] && [ "${#REQS[@]}" -eq 0 ]; then
-            echo "::error::Deployment-origin E2E evidence requires tagged or in-scope REQ attribution; refusing _compliance-docs fallback."
-            exit 1
-          fi
-
           if [ "${#REQS[@]}" -eq 0 ]; then
             if echo "$DERIVED_RELEASE" | grep -qE '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$'; then
               echo "No tracked REQ was executed for standalone/integration housekeeping ${DERIVED_RELEASE}; preserving this as GitHub historical CI without portal approval evidence."
               exit 0
             fi
+            if [ "$PRIOR_EVENT" = "deployment_status" ]; then
+              echo "::error::Deployment-origin E2E evidence requires tagged or in-scope REQ attribution; refusing _compliance-docs fallback."
+              exit 1
+            fi
             REQS=(_compliance-docs)
           fi
           # A bounded Playwright process exits the workflow with `failure`

package/sdlc/files/ci/feature-e2e.yml.template

@@ -61,7 +61,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: {{NODE_VERSION}}
       - name: Install dependencies (skip if lockfile unchanged)
@@ -84,7 +84,8 @@ jobs:
 {{E2E_DEV_SERVER_STEP}}
 
       - name: Wait for dev server
-        run: npx wait-on http://localhost:3000 --timeout 120000
+        # Keep a process-level bound in addition to wait-on's internal timer.
+        run: timeout --signal=TERM --kill-after=15s 150s npx wait-on http://localhost:3000 --timeout 120000
 
       # Compute the set of e2e spec files added on this branch (relative
       # to the merge base). The evidenceShot helper reads E2E_NEW_SPECS

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -29,6 +29,9 @@ on:
       release:
         description: 'Optional REQ-XXX / version to promote (blank = all in-scope from pending release tickets).'
         required: false
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   deployment_status:
     types: [created]
 

package/sdlc/files/ci/python/ci.yml.template

@@ -14,6 +14,10 @@ name: CI Pipeline
 
 on:
   workflow_dispatch:
+    inputs:
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
   pull_request:
     branches: [{{INTEGRATION_BRANCH}}]
   push:
@@ -311,11 +315,10 @@ jobs:
     name: Upload Evidence
     runs-on: {{RUNNER}}
     needs: [quality-gates, register-release]
-    # `always()` instead of `!failure()` so failed gates still upload their
-    # evidence — `status=failed` is itself the audit trail. `!cancelled()`
-    # still guards against partial state on operator-cancel.
-    # DevAudit-Installer#96.
-    if: ${{ always() && !cancelled() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
+    # Pull requests do not register or upload release evidence. Keeping this
+    # intentionally inapplicable job out of `always()` avoids a cancelled
+    # aggregate workflow when Register Release is correctly skipped (#500).
+    if: ${{ !cancelled() && github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}

package/sdlc/files/ci/reconcile-deployment.yml.template

@@ -24,6 +24,9 @@ on:
       health_url:
         description: 'Configured production health URL'
         required: true
+      runner_label:
+        description: 'Optional one-run runner label override. Blank uses repository CI_RUNNER_LABEL.'
+        required: false
 
 jobs:
   reconcile:

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.27",
+  "version": "0.3.29",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"