@metasession.co/devaudit-cli 0.3.3 → 0.3.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@metasession.co/devaudit-cli",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.4",
|
|
4
4
|
"description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|
|
@@ -33,7 +33,7 @@
|
|
|
33
33
|
},
|
|
34
34
|
"dependencies": {
|
|
35
35
|
"@clack/prompts": "^0.8.2",
|
|
36
|
-
"@metasession.co/devaudit-plugin-sdk": "^0.3.
|
|
36
|
+
"@metasession.co/devaudit-plugin-sdk": "^0.3.4",
|
|
37
37
|
"ajv": "^8.20.0",
|
|
38
38
|
"commander": "^12.1.0",
|
|
39
39
|
"consola": "^3.2.3",
|
|
@@ -0,0 +1,189 @@
|
|
|
1
|
+
---
|
|
2
|
+
description: Install or update DevAudit SDLC in a consuming project — auto-detects which is needed and runs the correct command.
|
|
3
|
+
---
|
|
4
|
+
|
|
5
|
+
# DevAudit Install or Update — Consumer Workflow
|
|
6
|
+
|
|
7
|
+
This workflow detects whether your project needs a fresh DevAudit install or just a template update, then runs the correct command. Run this from the **consuming project's** root directory (not DevAudit-Installer).
|
|
8
|
+
|
|
9
|
+
> **This workflow is synced into consuming projects by `devaudit install`/`update` (section 2i).** It lands at `.devin/workflows/devaudit-update-install.md` and is available as `/devaudit-update-install` in Windsurf.
|
|
10
|
+
|
|
11
|
+
## Prerequisites
|
|
12
|
+
|
|
13
|
+
- Node.js >= 22
|
|
14
|
+
- You are in the consuming project's root directory
|
|
15
|
+
- For a fresh install: you need a DevAudit portal token (`DEVAUDIT_USER_TOKEN`) and know your project slug, stack, and host
|
|
16
|
+
- For an update: the project was previously onboarded (has `sdlc-config.json`)
|
|
17
|
+
|
|
18
|
+
## Steps
|
|
19
|
+
|
|
20
|
+
### 1. Detect whether this is a fresh install or an update
|
|
21
|
+
|
|
22
|
+
The presence of `sdlc-config.json` in the project root is the marker:
|
|
23
|
+
|
|
24
|
+
```bash
|
|
25
|
+
// turbo
|
|
26
|
+
if [ -f sdlc-config.json ]; then
|
|
27
|
+
echo "MODE: update"
|
|
28
|
+
echo "Existing sdlc-config.json found — project is already onboarded"
|
|
29
|
+
cat sdlc-config.json
|
|
30
|
+
else
|
|
31
|
+
echo "MODE: install"
|
|
32
|
+
echo "No sdlc-config.json found — project needs a fresh DevAudit install"
|
|
33
|
+
fi
|
|
34
|
+
```
|
|
35
|
+
|
|
36
|
+
Also check for other DevAudit markers that confirm onboarding:
|
|
37
|
+
|
|
38
|
+
```bash
|
|
39
|
+
// turbo
|
|
40
|
+
echo "SDLC/ dir: $(test -d SDLC && echo YES || echo NO)"
|
|
41
|
+
echo ".husky/ hooks: $(test -f .husky/pre-push && echo YES || echo NO)"
|
|
42
|
+
echo "scripts/ dir: $(test -d scripts && echo YES || echo NO)"
|
|
43
|
+
echo "CI workflow: $(test -f .github/workflows/ci.yml && echo YES || echo NO)"
|
|
44
|
+
echo "INSTRUCTIONS.md: $(test -f INSTRUCTIONS.md && echo YES || echo NO)"
|
|
45
|
+
echo "SDLC/bin/ binary: $(test -f SDLC/bin/devaudit-sdlc.js && echo YES || echo NO)"
|
|
46
|
+
echo "SDLC/blueprints: $(test -d SDLC/blueprints && echo YES || echo NO)"
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
If `MODE: install` — proceed to step 2.
|
|
50
|
+
If `MODE: update` — skip to step 3.
|
|
51
|
+
|
|
52
|
+
### 2. Fresh install — run `devaudit install`
|
|
53
|
+
|
|
54
|
+
This onboards the project into the DevAudit SDLC framework. It creates `sdlc-config.json`, syncs all templates, sets up git hooks, CI workflows, and registers the project with the DevAudit portal.
|
|
55
|
+
|
|
56
|
+
You will need:
|
|
57
|
+
- Your DevAudit portal token (set as `DEVAUDIT_USER_TOKEN` env var or pass via `--token`)
|
|
58
|
+
- Your project slug (the name registered on the DevAudit portal)
|
|
59
|
+
- Your stack (e.g. `node`, `python`) and host (e.g. `railway`, `vercel`)
|
|
60
|
+
|
|
61
|
+
```bash
|
|
62
|
+
DEVAUDIT_USER_TOKEN=your_token_here npx @metasession.co/devaudit-cli install --yes
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
For interactive mode (prompts for stack, host, etc.):
|
|
66
|
+
|
|
67
|
+
```bash
|
|
68
|
+
DEVAUDIT_USER_TOKEN=your_token_here npx @metasession.co/devaudit-cli install
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
For a dry run first (no mutations):
|
|
72
|
+
|
|
73
|
+
```bash
|
|
74
|
+
DEVAUDIT_USER_TOKEN=your_token_here npx @metasession.co/devaudit-cli install --dry-run
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
After install completes, verify the markers:
|
|
78
|
+
|
|
79
|
+
```bash
|
|
80
|
+
// turbo
|
|
81
|
+
echo "sdlc-config.json: $(test -f sdlc-config.json && echo YES || echo NO)"
|
|
82
|
+
echo "SDLC/ dir: $(test -d SDLC && echo YES || echo NO)"
|
|
83
|
+
echo ".husky/ hooks: $(test -f .husky/pre-push && echo YES || echo NO)"
|
|
84
|
+
echo "CI workflow: $(test -f .github/workflows/ci.yml && echo YES || echo NO)"
|
|
85
|
+
echo "INSTRUCTIONS.md: $(test -f INSTRUCTIONS.md && echo YES || echo NO)"
|
|
86
|
+
echo "SDLC/bin/ binary: $(test -f SDLC/bin/devaudit-sdlc.js && echo YES || echo NO)"
|
|
87
|
+
echo "SDLC/blueprints: $(test -d SDLC/blueprints && echo YES || echo NO)"
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
All should show `YES`. If any show `NO`, check the install output for errors.
|
|
91
|
+
|
|
92
|
+
Skip to step 4.
|
|
93
|
+
|
|
94
|
+
### 3. Update — run `devaudit update`
|
|
95
|
+
|
|
96
|
+
This syncs the latest SDLC templates, binary, blueprints, hooks, scripts, and skills from the published CLI package into your repo. It does NOT touch `sdlc-config.json`, portal registration, or secrets.
|
|
97
|
+
|
|
98
|
+
```bash
|
|
99
|
+
npx @metasession.co/devaudit-cli update .
|
|
100
|
+
```
|
|
101
|
+
|
|
102
|
+
For a dry run first (no mutations):
|
|
103
|
+
|
|
104
|
+
```bash
|
|
105
|
+
npx @metasession.co/devaudit-cli update --dry-run .
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
After update completes, verify the new binary + blueprints landed:
|
|
109
|
+
|
|
110
|
+
```bash
|
|
111
|
+
// turbo
|
|
112
|
+
echo "SDLC/bin/ binary: $(test -f SDLC/bin/devaudit-sdlc.js && echo YES || echo NO)"
|
|
113
|
+
echo "SDLC/blueprints: $(ls SDLC/blueprints/*.raw.md 2>/dev/null | wc -l) file(s)"
|
|
114
|
+
echo "Binary works: $(node SDLC/bin/devaudit-sdlc.js --phase=issue --view >/dev/null 2>&1 && echo YES || echo NO)"
|
|
115
|
+
```
|
|
116
|
+
|
|
117
|
+
Expected: `binary: YES`, `blueprints: 6 file(s)`, `Binary works: YES`.
|
|
118
|
+
|
|
119
|
+
### 4. Review the diff
|
|
120
|
+
|
|
121
|
+
Whether install or update, review what changed before committing:
|
|
122
|
+
|
|
123
|
+
```bash
|
|
124
|
+
// turbo
|
|
125
|
+
git status --short
|
|
126
|
+
git diff --stat
|
|
127
|
+
```
|
|
128
|
+
|
|
129
|
+
Key files to expect:
|
|
130
|
+
- `SDLC/` — stage docs, blueprints, binary, config templates
|
|
131
|
+
- `.husky/` — pre-commit, pre-push, commit-msg hooks
|
|
132
|
+
- `.github/workflows/ci.yml` — CI pipeline with quality gates
|
|
133
|
+
- `scripts/` — evidence upload, compliance validation scripts
|
|
134
|
+
- `INSTRUCTIONS.md`, `CLAUDE.md`, `.cursorrules`, `.windsurfrules` — AI agent pointers
|
|
135
|
+
- `.claude/skills/` — sdlc-implementer and e2e-test-engineer skills
|
|
136
|
+
- `.gitignore` — sentinel file entries
|
|
137
|
+
|
|
138
|
+
### 5. Hand off to the sdlc-implementer skill
|
|
139
|
+
|
|
140
|
+
The changes are staged in the working tree. The remaining steps — invoking the SDLC engine for the sentinel, running local gates, creating a feature branch, committing, pushing, opening a PR, monitoring CI, and handling post-merge housekeeping release stubs — are all owned by the **sdlc-implementer** skill that was synced into `.claude/skills/` by the install/update.
|
|
141
|
+
|
|
142
|
+
Invoke the sdlc-implementer skill and tell it:
|
|
143
|
+
|
|
144
|
+
> **Housekeeping change.** The working tree has uncommitted changes from `devaudit install` (or `devaudit update`). Commit type is `chore:`, no `REQ-XXX`. Use the SDLC lightweight path: invoke the SDLC engine for the sentinel, run local gates, create a `chore/sync-devaudit-sdlc-{version}` branch, commit, push, open a PR targeting `develop`, monitor CI, and guide merge. After merge, CI will auto-generate housekeeping release stubs (release ticket + security summary) — remind the operator to review and sign off on those.
|
|
145
|
+
|
|
146
|
+
The skill will:
|
|
147
|
+
1. Invoke `node SDLC/bin/devaudit-sdlc.js --phase=issue --view` to write the `.sdlc-implementer-invoked` sentinel
|
|
148
|
+
2. Run local gates (lint, tsc, test)
|
|
149
|
+
3. Create a `chore/` branch, commit, and push
|
|
150
|
+
4. Open a PR targeting `develop`
|
|
151
|
+
5. Monitor CI checks
|
|
152
|
+
6. Guide review → merge
|
|
153
|
+
7. Remind the operator about the housekeeping release stub PR that CI auto-opens after merge
|
|
154
|
+
|
|
155
|
+
**Do not** manually run these steps yourself — the skill owns the SDLC ceremony and stays in sync with the framework's evolution. If the skill is not available (e.g. the AI agent doesn't support skills), fall back to the manual steps documented in `SDLC/0-project-setup.md` and the sdlc-implementer skill definition at `.claude/skills/sdlc-implementer/SKILL.md`.
|
|
156
|
+
|
|
157
|
+
## What install does (fresh project)
|
|
158
|
+
|
|
159
|
+
1. Creates `sdlc-config.json` with stack, host, and project slug
|
|
160
|
+
2. Syncs all SDLC templates (stage docs, skills, blueprints, binary)
|
|
161
|
+
3. Sets up git hooks (husky: pre-commit, pre-push, commit-msg, prepare-commit-msg)
|
|
162
|
+
4. Generates CI workflow (`.github/workflows/ci.yml`) with quality gates
|
|
163
|
+
5. Registers the project on the DevAudit portal
|
|
164
|
+
6. Issues an API key and stores it as a GitHub secret
|
|
165
|
+
7. Applies branch protection rules
|
|
166
|
+
8. Syncs scripts (evidence upload, compliance validation)
|
|
167
|
+
9. Adds `postinstall` script (`playwright install chromium`) to `package.json` if `@playwright/test` is a required dep and no postinstall exists — ensures browsers auto-install after `npm ci`
|
|
168
|
+
10. Syncs Windsurf workflow files to `.devin/workflows/` — including this workflow itself
|
|
169
|
+
|
|
170
|
+
## What update does (existing project)
|
|
171
|
+
|
|
172
|
+
1. Syncs all SDLC templates (stage docs, skills, blueprints, binary) — overwrites with latest
|
|
173
|
+
2. Syncs git hooks — overwrites with latest
|
|
174
|
+
3. Regenerates CI workflow from template — overwrites with latest
|
|
175
|
+
4. Syncs scripts — overwrites with latest
|
|
176
|
+
5. Updates AI agent pointer files (`.cursorrules`, `.windsurfrules`, `CLAUDE.md`, etc.)
|
|
177
|
+
6. Adds sentinel entries to `.gitignore` if missing
|
|
178
|
+
7. Adds `postinstall` script (`playwright install chromium`) to `package.json` if `@playwright/test` is a required dep and no postinstall exists — ensures browsers auto-install after `npm ci`
|
|
179
|
+
8. Syncs Windsurf workflow files to `.devin/workflows/` — overwrites with latest
|
|
180
|
+
9. Does NOT touch: `sdlc-config.json`, portal registration, API keys, secrets, branch protection
|
|
181
|
+
|
|
182
|
+
## Common issues
|
|
183
|
+
|
|
184
|
+
- **`npx` prompts to install the package** — this is normal on first run. Answer `y` to proceed. The package is `@metasession.co/devaudit-cli`.
|
|
185
|
+
- **Install fails with 401/403** — `DEVAUDIT_USER_TOKEN` is missing, expired, or wrong. Get a new token from the DevAudit portal `/settings/api-keys`.
|
|
186
|
+
- **Update overwrites custom CI config** — `devaudit update` regenerates `ci.yml` from the template. If you have project-specific customizations, keep them in a separate workflow file (e.g. `.github/workflows/project-specific.yml`) rather than editing `ci.yml` directly.
|
|
187
|
+
- **`SDLC/bin/devaudit-sdlc.js` missing after update** — the sync section 2h failed. Check that the CLI version you're using is >= 0.3.2 (the version that added the engine sync).
|
|
188
|
+
- **Postinstall script not added** — ensure you're using CLI >= 0.3.3. If a `postinstall` script already exists (and doesn't mention `playwright install`), it won't be overwritten — a warning is logged instead. Add `playwright install chromium` manually if needed.
|
|
189
|
+
- **Pre-push hook blocks pushes** — the hook checks for `.sdlc-implementer-invoked`. Run `node SDLC/bin/devaudit-sdlc.js --phase=issue` before committing to write the sentinel.
|
package/sdlc/package.json
CHANGED