@metasession.co/devaudit-cli 0.3.4 → 0.3.5

package/dist/index.js

@@ -56,7 +56,7 @@ function emitJsonResult(payload) {
 
 // package.json
 var package_default = {
-  version: "0.3.4"};
+  version: "0.3.5"};
 
 // src/lib/version.ts
 var CLI_VERSION = package_default.version;
@@ -1234,11 +1234,12 @@ var GitHubProvider = class {
     }
     if (!res.ok) throw new Error(`GitHub REST variable create failed: HTTP ${res.status}`);
   }
-  async applyBranchProtection(cwd, branch, requiredChecks) {
+  async applyBranchProtection(cwd, branch, requiredChecks, options) {
+    const reviewCount = options?.requiredReviewCount ?? 0;
     const body = {
       required_status_checks: { strict: false, contexts: requiredChecks },
-      enforce_admins: false,
-      required_pull_request_reviews: { dismiss_stale_reviews: true, required_approving_review_count: 0 },
+      enforce_admins: true,
+      required_pull_request_reviews: { dismiss_stale_reviews: true, required_approving_review_count: reviewCount },
       restrictions: null
     };
     if (this.preferGhCli && await ghAvailable()) {
@@ -1731,13 +1732,22 @@ async function bootstrapNode(ctx) {
   await execa("npx", ["husky", "init"], { cwd: ctx.projectPath, stdio: "inherit" });
   return { step: "8/11 Bootstrap hook framework", status: "ok", message: ".husky/ bootstrapped" };
 }
-
-// src/install/branch-protection.ts
 var REQUIRED_CHECKS = [
   "Compliance Validation",
   "DevAudit Release Approval",
   "Quality Gates"
 ];
+var MAIN_REVIEW_COUNT = 1;
+var DEVELOP_REVIEW_COUNT = 0;
+async function resolveIntegrationBranch(projectPath) {
+  try {
+    const raw = await promises.readFile(join(projectPath, "sdlc-config.json"), "utf-8");
+    const config = JSON.parse(raw);
+    return config.integration_branch ?? "develop";
+  } catch {
+    return "develop";
+  }
+}
 async function configureBranchProtection(ctx, provider) {
   if (ctx.installMode === "developer") {
     return {
@@ -1757,25 +1767,34 @@ async function configureBranchProtection(ctx, provider) {
     };
   }
   const repo = `${meta.owner}/${meta.name}`;
+  const integrationBranch = await resolveIntegrationBranch(ctx.projectPath);
   if (ctx.dryRun) {
     return {
       step: "9/11 Configure branch protection",
       status: "planned",
-      message: `would apply branch protection on ${repo}:${meta.defaultBranch} with checks=${JSON.stringify(REQUIRED_CHECKS)}`
+      message: `would apply branch protection on ${repo}:${meta.defaultBranch} (1 review) + ${integrationBranch} (0 reviews) with checks=${JSON.stringify(REQUIRED_CHECKS)}`
     };
   }
-  const result = await provider.applyBranchProtection(ctx.projectPath, meta.defaultBranch, REQUIRED_CHECKS);
-  if (result.applied) {
-    return {
-      step: "9/11 Configure branch protection",
-      status: "ok",
-      message: `required checks on ${meta.defaultBranch}: ${REQUIRED_CHECKS.join(", ")}`
-    };
+  const results = [];
+  const mainResult = await provider.applyBranchProtection(ctx.projectPath, meta.defaultBranch, REQUIRED_CHECKS, { requiredReviewCount: MAIN_REVIEW_COUNT });
+  if (mainResult.applied) {
+    results.push(`${meta.defaultBranch}: ok (${MAIN_REVIEW_COUNT} review)`);
+  } else {
+    results.push(`${meta.defaultBranch}: FAILED \u2014 ${mainResult.message ?? "unknown"}`);
   }
+  if (integrationBranch !== meta.defaultBranch) {
+    const devResult = await provider.applyBranchProtection(ctx.projectPath, integrationBranch, REQUIRED_CHECKS, { requiredReviewCount: DEVELOP_REVIEW_COUNT });
+    if (devResult.applied) {
+      results.push(`${integrationBranch}: ok (${DEVELOP_REVIEW_COUNT} reviews)`);
+    } else {
+      results.push(`${integrationBranch}: FAILED \u2014 ${devResult.message ?? "unknown"}`);
+    }
+  }
+  const allOk = results.every((r) => r.includes(": ok"));
   return {
     step: "9/11 Configure branch protection",
-    status: "warn",
-    message: `${result.message ?? "branch-protection apply failed"} \u2014 configure manually`
+    status: allOk ? "ok" : "warn",
+    message: allOk ? results.join(" | ") : `${results.join(" | ")} \u2014 configure manually`
   };
 }
 var ajv = new Ajv({ allErrors: true, strict: false });
@@ -2496,6 +2515,60 @@ async function syncWorkflows(ctx) {
     message: files.length > 0 ? `synced to .devin/workflows/` : "no workflow files found"
   };
 }
+var REQUIRED_CHECKS2 = [
+  "Compliance Validation",
+  "DevAudit Release Approval",
+  "Quality Gates"
+];
+var MAIN_REVIEW_COUNT2 = 1;
+var DEVELOP_REVIEW_COUNT2 = 0;
+async function verifyBranchProtection(ctx) {
+  const config = await readSdlcConfig(ctx.projectPath);
+  const integrationBranch = config?.integration_branch ?? "develop";
+  config?.release_branch ?? "main";
+  let provider;
+  try {
+    provider = await getGitProvider(ctx.projectPath);
+  } catch (err) {
+    return {
+      name: "Branch protection",
+      filesSynced: 0,
+      warning: `git provider unavailable (${err.message}) \u2014 verify manually`
+    };
+  }
+  let meta;
+  try {
+    meta = await provider.getRepoMeta(ctx.projectPath);
+  } catch (err) {
+    return {
+      name: "Branch protection",
+      filesSynced: 0,
+      warning: `could not resolve repo (${err.message}) \u2014 verify manually`
+    };
+  }
+  const results = [];
+  const mainResult = await provider.applyBranchProtection(ctx.projectPath, meta.defaultBranch, REQUIRED_CHECKS2, { requiredReviewCount: MAIN_REVIEW_COUNT2 });
+  if (mainResult.applied) {
+    results.push(`${meta.defaultBranch}: ok`);
+  } else {
+    results.push(`${meta.defaultBranch}: failed \u2014 ${mainResult.message ?? "unknown"}`);
+  }
+  if (integrationBranch !== meta.defaultBranch) {
+    const devResult = await provider.applyBranchProtection(ctx.projectPath, integrationBranch, REQUIRED_CHECKS2, { requiredReviewCount: DEVELOP_REVIEW_COUNT2 });
+    if (devResult.applied) {
+      results.push(`${integrationBranch}: ok`);
+    } else {
+      results.push(`${integrationBranch}: failed \u2014 ${devResult.message ?? "unknown"}`);
+    }
+  }
+  const allOk = results.every((r) => r.endsWith(": ok"));
+  return {
+    name: "Branch protection",
+    filesSynced: 0,
+    message: results.join(" | "),
+    warning: allOk ? void 0 : "some branches failed \u2014 verify manually"
+  };
+}
 var TIER_1_DOCS = ["Test_Policy.md", "Test_Strategy.md", "Test_Architecture.md"];
 async function runValidation(projectPath) {
   const warnings = [];
@@ -2543,7 +2616,8 @@ var SECTION_RUNNERS = [
   { key: "2f", run: syncCiTemplates },
   { key: "2g", run: syncGitignore },
   { key: "2h", run: syncSdlcEngine },
-  { key: "2i", run: syncWorkflows }
+  { key: "2i", run: syncWorkflows },
+  { key: "2j", run: verifyBranchProtection }
 ];
 async function syncProject(projectPath) {
   const absPath = resolve(projectPath);