@metasession.co/devaudit-cli 0.3.9 → 0.3.10

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -34,6 +34,9 @@ jobs:
   production-evidence:
     name: Production Evidence
     runs-on: {{RUNNER}}
+    permissions:
+      contents: read
+      issues: write
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
@@ -151,7 +154,9 @@ jobs:
       - name: File incident on smoke failure
         if: failure()
         env:
-          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          # GitHub issue/label mutations use the workflow token. DevAudit
+          # user tokens are portal PATs, not guaranteed GitHub PATs (#305).
+          GH_TOKEN: ${{ github.token }}
           PROD_URL: ${{ secrets.{{PRODUCTION_URL_SECRET}} }}
           GIT_SHA: ${{ github.sha }}
           CI_RUN: ${{ github.run_id }}

package/sdlc/files/ci/quality-gates-provenance.yml.template

@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: Verify prior Quality Gates success on head SHA
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           CURRENT_RUN_ID: ${{ github.run_id }}
         run: |

package/sdlc/files/stacks/node/hooks/pre-push

@@ -38,6 +38,9 @@ echo "Pre-push: TypeScript check passed."
 # Previous code had two `while read` loops; the second consumed nothing
 # because stdin was already exhausted by the first (devaudit-installer#278).
 PUSH_REFS="$(cat)"
+PUSH_REFS_FILE=$(mktemp)
+trap 'rm -f "$PUSH_REFS_FILE"' EXIT HUP INT TERM
+printf '%s\n' "$PUSH_REFS" > "$PUSH_REFS_FILE"
 
 INTEGRATION_BRANCH=$(jq -r '.integration_branch // "develop"' sdlc-config.json 2>/dev/null || echo "develop")
 
@@ -49,7 +52,8 @@ INTEGRATION_BRANCH=$(jq -r '.integration_branch // "develop"' sdlc-config.json 2
 # (written by e2e-test-engineer Phase 5½ after validating tagTest/evidenceShot).
 # Scoped to integration-branch pushes (correct for the normal workflow).
 
-echo "$PUSH_REFS" | while read -r local_ref local_sha remote_ref remote_sha; do
+while read -r local_ref local_sha remote_ref remote_sha; do
+  [ -n "${local_ref:-}" ] || continue
   # Check if pushing to the integration branch
   case "$remote_ref" in
     *"refs/heads/$INTEGRATION_BRANCH") ;;
@@ -103,7 +107,7 @@ echo "$PUSH_REFS" | while read -r local_ref local_sha remote_ref remote_sha; do
     fi
     echo "Pre-push: E2E evidence wiring check passed."
   fi
-done
+done < "$PUSH_REFS_FILE"
 
 # ── 3. Skill-invocation sentinel (devaudit-installer#226) ────────────
 # If feat/fix/refactor/perf commits are in the push, verify the
@@ -115,11 +119,9 @@ done
 TRACKED_TYPES='^(feat|fix|refactor|perf)(\(.+\))?!?:'
 HAS_TRACKED=false
 
-# Parse stdin refs in the current shell (not a subshell) so HAS_TRACKED propagates.
-for ref_line in $PUSH_REFS; do
-  set -- $ref_line
-  local_sha="$2"
-  remote_sha="$4"
+# Parse captured refs in the current shell so HAS_TRACKED propagates.
+while read -r local_ref local_sha remote_ref remote_sha; do
+  [ -n "${local_ref:-}" ] || continue
   if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
     RANGE="$local_sha"
   else
@@ -129,7 +131,7 @@ for ref_line in $PUSH_REFS; do
   if echo "$COMMITS" | grep -qE "$TRACKED_TYPES"; then
     HAS_TRACKED=true
   fi
-done
+done < "$PUSH_REFS_FILE"
 
 if [ "$HAS_TRACKED" = "true" ]; then
   if [ ! -f .sdlc-implementer-invoked ]; then
@@ -147,10 +149,8 @@ if [ "$HAS_TRACKED" = "true" ]; then
   # If the commit touches Phase 3 artifacts (compliance/evidence/REQ-XXX/),
   # the sentinel must contain a phase "3" record. If it touches Phase 5
   # close-out (approved-releases/ or RTM RELEASED), sentinel must have phase "5".
-  for ref_line in $PUSH_REFS; do
-    set -- $ref_line
-    local_sha="$2"
-    remote_sha="$4"
+  while read -r local_ref local_sha remote_ref remote_sha; do
+    [ -n "${local_ref:-}" ] || continue
     if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
       RANGE="$local_sha"
     else
@@ -181,7 +181,7 @@ if [ "$HAS_TRACKED" = "true" ]; then
         exit 1
       fi
     fi
-  done
+  done < "$PUSH_REFS_FILE"
   echo "Pre-push: phase-progression check passed."
 fi
 

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"