@prism-d1/cli 1.0.93 → 1.0.94
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/assets/github-workflows/prism-eval-gate-kiro.yml +311 -1
- package/dist/assets/gitlab-workflows/prism-eval-gate.yml +333 -116
- package/dist/assets/infra/lib/lambda/velocity-widget.ts +1 -1
- package/dist/src/commands/bootstrapper/install-eval-harness.d.ts +5 -5
- package/dist/src/commands/bootstrapper/install-eval-harness.d.ts.map +1 -1
- package/dist/src/commands/bootstrapper/install-eval-harness.js +157 -75
- package/dist/src/commands/bootstrapper/install-eval-harness.js.map +1 -1
- package/dist/src/commands/bootstrapper/install-github-workflows.d.ts +6 -2
- package/dist/src/commands/bootstrapper/install-github-workflows.d.ts.map +1 -1
- package/dist/src/commands/bootstrapper/install-github-workflows.js +36 -48
- package/dist/src/commands/bootstrapper/install-github-workflows.js.map +1 -1
- package/dist/src/commands/bootstrapper/install-gitlab-workflows.d.ts.map +1 -1
- package/dist/src/commands/bootstrapper/install-gitlab-workflows.js +10 -1
- package/dist/src/commands/bootstrapper/install-gitlab-workflows.js.map +1 -1
- package/package.json +1 -1
- package/dist/assets/github-workflows/prism-eval-gate.yml +0 -490
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync,
|
|
1
|
+
import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, rmSync } from 'node:fs';
|
|
2
2
|
import { resolve, dirname } from 'node:path';
|
|
3
3
|
import { fileURLToPath } from 'node:url';
|
|
4
4
|
import { createInterface } from 'node:readline';
|
|
@@ -42,19 +42,113 @@ async function writeWorkflow(src, dest, region, label, ask) {
|
|
|
42
42
|
}
|
|
43
43
|
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
44
44
|
const EVAL_SOURCE = getAssetPath(import.meta.url, 'bootstrapper/eval-harness');
|
|
45
|
+
/**
|
|
46
|
+
* Starter gitleaks config, written only when the repo has none.
|
|
47
|
+
*
|
|
48
|
+
* The secret-scan step in the workflow runs with or without this file --
|
|
49
|
+
* gitleaks ships usable defaults. What the defaults do not know is which
|
|
50
|
+
* credential-shaped strings in THIS repo are deliberate, so the first PR that
|
|
51
|
+
* touches a test fixture fails the gate on a fake key. A team that hits that
|
|
52
|
+
* with no obvious place to record the exception tends to delete the gate rather
|
|
53
|
+
* than tune it, so the tuning surface ships up front and is documented inline.
|
|
54
|
+
*
|
|
55
|
+
* `useDefault = true` is what keeps this additive: without it, declaring a
|
|
56
|
+
* config REPLACES the entire default ruleset and the gate silently stops
|
|
57
|
+
* detecting anything it does not name explicitly.
|
|
58
|
+
*/
|
|
59
|
+
const GITLEAKS_STARTER_CONFIG = `# gitleaks configuration for the PRISM eval gate.
|
|
60
|
+
#
|
|
61
|
+
# The gate scans only the commits a PR introduces, so anything flagged here is
|
|
62
|
+
# something this PR added. Two ways to handle a false positive:
|
|
63
|
+
#
|
|
64
|
+
# 1. Allowlist the path or pattern below (preferred -- reviewable, and it
|
|
65
|
+
# keeps working as the file changes).
|
|
66
|
+
# 2. Add an inline "gitleaks:allow" comment on the offending line.
|
|
67
|
+
#
|
|
68
|
+
# A real exposure is NOT a false positive: rotate the credential first, because
|
|
69
|
+
# deleting it from the branch does not un-expose what was already pushed.
|
|
70
|
+
|
|
71
|
+
[extend]
|
|
72
|
+
# Keep gitleaks' built-in ruleset. Removing this line replaces the defaults
|
|
73
|
+
# entirely rather than adding to them, which turns the gate into a no-op for
|
|
74
|
+
# every credential type not restated in this file.
|
|
75
|
+
useDefault = true
|
|
76
|
+
|
|
77
|
+
[[allowlists]]
|
|
78
|
+
description = "Test fixtures and documented examples"
|
|
79
|
+
paths = [
|
|
80
|
+
'''(^|/)tests?/''',
|
|
81
|
+
'''(^|/)__fixtures__/''',
|
|
82
|
+
'''(^|/)__tests__/''',
|
|
83
|
+
'''\\.example($|\\.)''',
|
|
84
|
+
]
|
|
85
|
+
`;
|
|
86
|
+
function installGitleaksConfig(gitRoot) {
|
|
87
|
+
const dest = resolve(gitRoot, '.gitleaks.toml');
|
|
88
|
+
if (existsSync(dest)) {
|
|
89
|
+
console.log('✓ Kept existing .gitleaks.toml');
|
|
90
|
+
return;
|
|
91
|
+
}
|
|
92
|
+
writeFileSync(dest, GITLEAKS_STARTER_CONFIG);
|
|
93
|
+
console.log('✓ Installed .gitleaks.toml (allowlist starter)');
|
|
94
|
+
}
|
|
95
|
+
/**
|
|
96
|
+
* Rubric the agent-eval workflow scores against. Deliberately just the one.
|
|
97
|
+
*
|
|
98
|
+
* The retired Bedrock gate auto-selected among five rubrics by file path.
|
|
99
|
+
* prism-agent-eval.yml only ever reads agent-quality.json, so shipping the
|
|
100
|
+
* other four into a repo would leave four files nothing executes -- read later
|
|
101
|
+
* as "the eval gate uses these", which is exactly the confusion retiring the
|
|
102
|
+
* Bedrock gate is meant to remove. The four remain in the CLI's assets because
|
|
103
|
+
* the Claude/Kiro steering docs cite them as codified quality standards; they
|
|
104
|
+
* are reference material, not an installed dependency.
|
|
105
|
+
*/
|
|
106
|
+
const AGENT_EVAL_RUBRIC = 'agent-quality.json';
|
|
107
|
+
/**
|
|
108
|
+
* Installs the Bedrock scorer that prism-agent-eval.yml shells out to.
|
|
109
|
+
*
|
|
110
|
+
* This is NOT the retired eval gate. The gate is kiro-cli and needs none of
|
|
111
|
+
* this. prism-agent-eval.yml is a separate workflow that runs an agent in mock
|
|
112
|
+
* mode and scores its output, and it hard-codes paths to run-eval.sh,
|
|
113
|
+
* eval-config.json and rubrics/agent-quality.json.
|
|
114
|
+
*
|
|
115
|
+
* Installing it unconditionally also fixes a latent gap: install-github-workflows
|
|
116
|
+
* always wrote prism-agent-eval.yml, but its harness only arrived with the
|
|
117
|
+
* bedrock eval-gate mode. Anyone who installed the kiro gate got an agent-eval
|
|
118
|
+
* workflow that could never find run-eval.sh, and retiring bedrock mode would
|
|
119
|
+
* have made that permanent rather than surfacing it.
|
|
120
|
+
*/
|
|
121
|
+
function installAgentEvalHarness(targetDir, model, threshold, region) {
|
|
122
|
+
mkdirSync(resolve(targetDir, 'rubrics'), { recursive: true });
|
|
123
|
+
copyFileSync(resolve(EVAL_SOURCE, 'run-eval.sh'), resolve(targetDir, 'run-eval.sh'));
|
|
124
|
+
chmodSync(resolve(targetDir, 'run-eval.sh'), 0o755);
|
|
125
|
+
copyFileSync(resolve(EVAL_SOURCE, 'rubrics', AGENT_EVAL_RUBRIC), resolve(targetDir, 'rubrics', AGENT_EVAL_RUBRIC));
|
|
126
|
+
// run-eval.sh reads eval_model_id and pass_threshold from this file and exits
|
|
127
|
+
// 2 without it, so it ships alongside rather than being optional.
|
|
128
|
+
const config = {
|
|
129
|
+
pass_threshold: parseFloat(threshold),
|
|
130
|
+
eval_model_id: model,
|
|
131
|
+
aws_region: region,
|
|
132
|
+
event_bus: 'prism-d1-metrics',
|
|
133
|
+
emit_to_eventbridge: true,
|
|
134
|
+
};
|
|
135
|
+
writeFileSync(resolve(targetDir, 'eval-config.json'), JSON.stringify(config, null, 2) + '\n');
|
|
136
|
+
console.log('✓ Installed .prism/eval-harness/ (run-eval.sh + eval-config.json + agent-quality rubric)');
|
|
137
|
+
console.log(' Used by prism-agent-eval.yml only — the eval gate itself is kiro-cli and needs none of it.');
|
|
138
|
+
}
|
|
45
139
|
function prompt(question, defaultValue) {
|
|
46
140
|
const rl = createInterface({ input: process.stdin, output: process.stdout });
|
|
47
141
|
const suffix = defaultValue ? ` [${defaultValue}]` : '';
|
|
48
142
|
return new Promise((r) => rl.question(`${question}${suffix}: `, (a) => { rl.close(); r(a.trim() || defaultValue || ''); }));
|
|
49
143
|
}
|
|
50
144
|
export default {
|
|
51
|
-
description: 'Install eval
|
|
145
|
+
description: 'Install the kiro-cli eval gate (review rules + workflow + secret scanning)',
|
|
52
146
|
options: [
|
|
53
|
-
{ flags: '--mode <mode>', description: 'Eval mode: "kiro" (recommended, headless kiro-cli) or "bedrock" (legacy run-eval.sh)' },
|
|
54
|
-
{ flags: '--with-rubrics', description: 'Include production rubrics (bedrock mode only)' },
|
|
55
|
-
{ flags: '--model <id>', description: 'Bedrock model ID for evaluation (bedrock mode only)' },
|
|
56
|
-
{ flags: '--threshold <n>', description: 'Pass threshold (0-1)' },
|
|
57
147
|
{ flags: '--region <region>', description: 'AWS region for EventBridge/CloudWatch/Continuum', default: DEFAULT_REGION },
|
|
148
|
+
{ flags: '--agent-eval-model <id>', description: 'Bedrock model prism-agent-eval.yml scores with', default: 'us.anthropic.claude-haiku-4-5-20251001-v1:0' },
|
|
149
|
+
{ flags: '--agent-eval-threshold <n>', description: 'Pass threshold for prism-agent-eval.yml (0-1)', default: '0.82' },
|
|
150
|
+
{ flags: '--skip-agent-eval-harness', description: 'Do not install .prism/eval-harness/ (only if you are not using prism-agent-eval.yml)' },
|
|
151
|
+
{ flags: '--mode <mode>', description: '[retired] Only "kiro" remains; "bedrock" now errors' },
|
|
58
152
|
{ flags: '--uninstall', description: 'Remove eval-harness directory and steering files' },
|
|
59
153
|
],
|
|
60
154
|
async action(opts) {
|
|
@@ -74,34 +168,40 @@ export default {
|
|
|
74
168
|
// Worth being categorical about given the command being built.
|
|
75
169
|
rmSync(targetDir, { recursive: true, force: true });
|
|
76
170
|
console.log('✓ Removed .prism/eval-harness/');
|
|
171
|
+
console.log(' Note: prism-agent-eval.yml shells out to run-eval.sh from that');
|
|
172
|
+
console.log(' directory and will now fail. Remove the workflow too, or reinstall.');
|
|
77
173
|
}
|
|
78
174
|
const steeringFile = resolve(gitRoot, '.kiro/steering/code-review.md');
|
|
79
175
|
if (existsSync(steeringFile)) {
|
|
80
176
|
rmSync(steeringFile, { force: true });
|
|
81
177
|
console.log('✓ Removed .kiro/steering/code-review.md');
|
|
82
178
|
}
|
|
179
|
+
// .gitleaks.toml is deliberately left in place. It is an allowlist a team
|
|
180
|
+
// tunes over time, it is inert once the workflow is gone, and deleting it
|
|
181
|
+
// would silently discard that work on a reinstall.
|
|
182
|
+
if (existsSync(resolve(gitRoot, '.gitleaks.toml'))) {
|
|
183
|
+
console.log(' Kept .gitleaks.toml (delete manually if unwanted)');
|
|
184
|
+
}
|
|
83
185
|
return;
|
|
84
186
|
}
|
|
85
|
-
//
|
|
86
|
-
|
|
87
|
-
//
|
|
88
|
-
//
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
console.error(
|
|
93
|
-
console.error('
|
|
187
|
+
// The Bedrock eval gate is retired. Erroring rather than ignoring the flag:
|
|
188
|
+
// a pinned script passing --mode bedrock would otherwise silently install a
|
|
189
|
+
// different gate than it asked for, and the divergence would only surface as
|
|
190
|
+
// a missing KIRO_API_KEY on the next PR.
|
|
191
|
+
if (opts.mode && opts.mode !== 'kiro') {
|
|
192
|
+
console.error(`Error: --mode "${opts.mode}" is no longer available.`);
|
|
193
|
+
console.error(' The Bedrock rubric eval gate has been retired; kiro-cli is the only mode.');
|
|
194
|
+
console.error(' Drop the flag (or pass --mode kiro) to install the kiro gate.');
|
|
195
|
+
console.error('');
|
|
196
|
+
console.error(' Already running the Bedrock gate? It keeps working until you replace it.');
|
|
197
|
+
console.error(' To migrate: run this command, then delete the KIRO-unrelated Bedrock');
|
|
198
|
+
console.error(' gate config and remove the bedrock:InvokeModel grant from your OIDC role.');
|
|
94
199
|
process.exit(1);
|
|
95
200
|
}
|
|
96
|
-
|
|
97
|
-
await installKiroMode(gitRoot, opts);
|
|
98
|
-
}
|
|
99
|
-
else {
|
|
100
|
-
await installBedrockMode(gitRoot, targetDir, opts);
|
|
101
|
-
}
|
|
201
|
+
await installKiroMode(gitRoot, targetDir, opts);
|
|
102
202
|
},
|
|
103
203
|
};
|
|
104
|
-
async function installKiroMode(gitRoot, opts) {
|
|
204
|
+
async function installKiroMode(gitRoot, targetDir, opts) {
|
|
105
205
|
const region = opts.region || DEFAULT_REGION;
|
|
106
206
|
// --- Install steering file ---
|
|
107
207
|
const steeringDir = resolve(gitRoot, '.kiro/steering');
|
|
@@ -129,67 +229,49 @@ async function installKiroMode(gitRoot, opts) {
|
|
|
129
229
|
mkdirSync(workflowsDir, { recursive: true });
|
|
130
230
|
await writeWorkflow(workflowSrc, resolve(workflowsDir, 'prism-eval-gate.yml'), region, '.github/workflows/prism-eval-gate.yml', prompt);
|
|
131
231
|
}
|
|
232
|
+
// --- Secret scanning config ---
|
|
233
|
+
installGitleaksConfig(gitRoot);
|
|
234
|
+
// --- Agent-eval harness (separate workflow, still Bedrock-scored) ---
|
|
235
|
+
if (opts.skipAgentEvalHarness) {
|
|
236
|
+
console.log(' Skipped .prism/eval-harness/ (--skip-agent-eval-harness)');
|
|
237
|
+
console.log(' prism-agent-eval.yml will fail if installed — it needs run-eval.sh.');
|
|
238
|
+
}
|
|
239
|
+
else {
|
|
240
|
+
installAgentEvalHarness(targetDir, opts.agentEvalModel || 'us.anthropic.claude-haiku-4-5-20251001-v1:0', opts.agentEvalThreshold || '0.82', region);
|
|
241
|
+
}
|
|
132
242
|
console.log('\n════════════════════════════════════════════════');
|
|
133
|
-
console.log(' ✅
|
|
243
|
+
console.log(' ✅ Eval gate installed (kiro-cli)');
|
|
134
244
|
console.log('════════════════════════════════════════════════');
|
|
135
|
-
console.log('\n
|
|
245
|
+
console.log('\n Gate: kiro-cli headless review + gitleaks secret scan');
|
|
136
246
|
console.log(' Rules: .kiro/steering/code-review.md');
|
|
137
|
-
console.log(' Workflow:
|
|
247
|
+
console.log(' Workflow: .github/workflows/prism-eval-gate.yml');
|
|
138
248
|
console.log('\n Required: Add KIRO_API_KEY as a GitHub repository secret');
|
|
139
249
|
console.log(' Generate at: https://app.kiro.dev → Settings → API Keys');
|
|
140
250
|
console.log('\n Optional: Add PRISM_METRICS_ROLE_ARN for EventBridge metrics');
|
|
251
|
+
console.log('\n Secret scanning (gitleaks) is already active — no secret or');
|
|
252
|
+
console.log(' AWS role needed, so it is the only gate that runs on fork PRs.');
|
|
253
|
+
console.log(' It scans the commits each PR adds and fails closed if it cannot');
|
|
254
|
+
console.log(' run. Tune false positives in .gitleaks.toml.');
|
|
141
255
|
console.log('');
|
|
256
|
+
printGitleaksAdoptionNote();
|
|
142
257
|
}
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
console.log('
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
emit_to_eventbridge: true,
|
|
161
|
-
};
|
|
162
|
-
writeFileSync(resolve(targetDir, 'eval-config.json'), JSON.stringify(config, null, 2) + '\n');
|
|
163
|
-
console.log('✓ Created .prism/eval-harness/eval-config.json');
|
|
164
|
-
// --- Rubrics ---
|
|
165
|
-
if (opts.withRubrics) {
|
|
166
|
-
const rubricsSrc = resolve(EVAL_SOURCE, 'rubrics');
|
|
167
|
-
for (const file of readdirSync(rubricsSrc).filter(f => f.endsWith('.json'))) {
|
|
168
|
-
copyFileSync(resolve(rubricsSrc, file), resolve(targetDir, 'rubrics', file));
|
|
169
|
-
}
|
|
170
|
-
console.log(`✓ Installed ${readdirSync(resolve(targetDir, 'rubrics')).length} production rubrics`);
|
|
171
|
-
}
|
|
172
|
-
else {
|
|
173
|
-
console.log('✓ rubrics/ directory created (empty — add your own rubric JSON files)');
|
|
174
|
-
}
|
|
175
|
-
// --- Workflow ---
|
|
176
|
-
const workflowsDir = resolve(gitRoot, '.github/workflows');
|
|
177
|
-
const workflowSrc = getAssetPath(import.meta.url, 'bootstrapper/github-workflows/prism-eval-gate.yml');
|
|
178
|
-
if (existsSync(workflowSrc)) {
|
|
179
|
-
mkdirSync(workflowsDir, { recursive: true });
|
|
180
|
-
await writeWorkflow(workflowSrc, resolve(workflowsDir, 'prism-eval-gate.yml'), region, '.github/workflows/prism-eval-gate.yml', prompt);
|
|
181
|
-
}
|
|
182
|
-
console.log('\n════════════════════════════════════════════════');
|
|
183
|
-
console.log(' ✅ Eval harness installed (legacy Bedrock mode)!');
|
|
184
|
-
console.log('════════════════════════════════════════════════');
|
|
185
|
-
console.log(`\n Model: ${model}`);
|
|
186
|
-
console.log(` Threshold: ${threshold}`);
|
|
187
|
-
console.log(` Rubrics: ${opts.withRubrics ? 'production set' : 'empty (add your own)'}`);
|
|
188
|
-
if (!opts.withRubrics) {
|
|
189
|
-
console.log('\n Next: Create a rubric at .prism/eval-harness/rubrics/my-rubric.json');
|
|
190
|
-
console.log(' See: bootstrapper/eval-harness/rubrics/ for examples');
|
|
191
|
-
}
|
|
192
|
-
console.log('\n 💡 Consider upgrading to kiro mode: prism-cli bootstrapper install-eval-harness --mode kiro');
|
|
258
|
+
/**
|
|
259
|
+
* Adoption note for repos that already contain a committed secret.
|
|
260
|
+
*
|
|
261
|
+
* The gate scans only each PR's own commits, so a pre-existing leak does not
|
|
262
|
+
* block unrelated work -- but it also means the gate will never surface it.
|
|
263
|
+
* Without being told, a team reasonably concludes a green gate means a clean
|
|
264
|
+
* repo. It does not: it means nothing new was added.
|
|
265
|
+
*/
|
|
266
|
+
function printGitleaksAdoptionNote() {
|
|
267
|
+
console.log(' One-time sweep for secrets already in history (the PR gate');
|
|
268
|
+
console.log(' deliberately does not scan history, so it will not find these):');
|
|
269
|
+
console.log(' gitleaks git . --redact');
|
|
270
|
+
console.log(' Rotate anything it reports — deleting it from a branch does not');
|
|
271
|
+
console.log(' un-expose what was already pushed. To adopt the gate before');
|
|
272
|
+
console.log(' finishing that cleanup, record the known findings as a baseline:');
|
|
273
|
+
console.log(' mkdir -p .prism && \\');
|
|
274
|
+
console.log(' gitleaks git . --report-path=.prism/gitleaks-baseline.json');
|
|
193
275
|
console.log('');
|
|
194
276
|
}
|
|
195
277
|
//# sourceMappingURL=install-eval-harness.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"install-eval-harness.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,
|
|
1
|
+
{"version":3,"file":"install-eval-harness.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9G,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEpE;;;;;;;GAOG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAY,EACZ,MAAc,EACd,KAAa,EACb,GAA+C;IAE/C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,4EAA4E;IAC5E,sEAAsE;IACtE,IAAI,OAAe,CAAC;IACpB,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,UAAU,GAAG,qBAAqB,cAAc,EAAE,CAAC;QACzD,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,aAAa,MAAM,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;CA0B/B,CAAC;AAEF,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAE/C;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAAC,SAAiB,EAAE,KAAa,EAAE,SAAiB,EAAE,MAAc;IAClG,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9D,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;IACrF,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,CAAC,CAAC;IAEpD,YAAY,CACV,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC,EAClD,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CACjD,CAAC;IAEF,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,MAAM,GAAG;QACb,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;QACrC,aAAa,EAAE,KAAK;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,kBAAkB;QAC7B,mBAAmB,EAAE,IAAI;KAC1B,CAAC;IACF,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAE9F,OAAO,CAAC,GAAG,CAAC,0FAA0F,CAAC,CAAC;IACxG,OAAO,CAAC,GAAG,CAAC,gGAAgG,CAAC,CAAC;AAChH,CAAC;AAED,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,eAAe;IACb,WAAW,EAAE,4EAA4E;IACzF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,iDAAiD,EAAE,OAAO,EAAE,cAAc,EAAE;QACvH,EAAE,KAAK,EAAE,yBAAyB,EAAE,WAAW,EAAE,gDAAgD,EAAE,OAAO,EAAE,6CAA6C,EAAE;QAC3J,EAAE,KAAK,EAAE,4BAA4B,EAAE,WAAW,EAAE,+CAA+C,EAAE,OAAO,EAAE,MAAM,EAAE;QACtH,EAAE,KAAK,EAAE,2BAA2B,EAAE,WAAW,EAAE,sFAAsF,EAAE;QAC3I,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,qDAAqD,EAAE;QAC9F,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,kDAAkD,EAAE;KAC1F;IACD,KAAK,CAAC,MAAM,CAAC,IAOZ;QACC,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAE1D,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,sEAAsE;gBACtE,+DAA+D;gBAC/D,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;gBAChF,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,+BAA+B,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;YACD,0EAA0E;YAC1E,0EAA0E;YAC1E,mDAAmD;YACnD,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;YACrE,CAAC;YACD,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,yCAAyC;QACzC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;YACtE,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;YAC7F,OAAO,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACjF,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;YAC5F,OAAO,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;YACxF,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;YAC7F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;CACF,CAAC;AAEF,KAAK,UAAU,eAAe,CAC5B,OAAe,EACf,SAAiB,EACjB,IAKC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAE7C,gCAAgC;IAChC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACvD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;IAE5D,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,wDAAwD,CAAC,CAAC;IAC5G,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,aAAa,CACjB,WAAW,EACX,OAAO,CAAC,YAAY,EAAE,qBAAqB,CAAC,EAC5C,MAAM,EACN,uCAAuC,EACvC,MAAM,CACP,CAAC;IACJ,CAAC;IAED,iCAAiC;IACjC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,uEAAuE;IACvE,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACzF,CAAC;SAAM,CAAC;QACN,uBAAuB,CACrB,SAAS,EACT,IAAI,CAAC,cAAc,IAAI,6CAA6C,EACpE,IAAI,CAAC,kBAAkB,IAAI,MAAM,EACjC,MAAM,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAC/E,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,yBAAyB,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,yBAAyB;IAChC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC"}
|
|
@@ -1,10 +1,14 @@
|
|
|
1
1
|
declare const _default: {
|
|
2
2
|
description: string;
|
|
3
|
-
options: {
|
|
3
|
+
options: ({
|
|
4
4
|
flags: string;
|
|
5
5
|
description: string;
|
|
6
6
|
default: string;
|
|
7
|
-
}
|
|
7
|
+
} | {
|
|
8
|
+
flags: string;
|
|
9
|
+
description: string;
|
|
10
|
+
default?: undefined;
|
|
11
|
+
})[];
|
|
8
12
|
action(opts: {
|
|
9
13
|
mode?: string;
|
|
10
14
|
region?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"install-github-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"install-github-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":";;;;;;;;;;;iBAiCqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAP1E,wBA4EE"}
|
|
@@ -3,61 +3,53 @@ import { join } from 'node:path';
|
|
|
3
3
|
import { getAssetPath } from '../../utils/root.js';
|
|
4
4
|
import { applyRegion, DEFAULT_REGION } from '../../utils/region.js';
|
|
5
5
|
/**
|
|
6
|
-
* The eval gate ships as one asset
|
|
6
|
+
* The eval gate ships as one asset and installs under a different name.
|
|
7
7
|
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
8
|
+
* The asset is `prism-eval-gate-kiro.yml` but the installed file is
|
|
9
|
+
* `prism-eval-gate.yml`, matching what `install-eval-harness` writes so the two
|
|
10
|
+
* installers converge on one file rather than leaving a mode-specific name
|
|
11
|
+
* behind. Both declare `name: PRISM Eval Gate` on the same `pull_request`
|
|
12
|
+
* triggers, so two files means two same-named check runs on every PR.
|
|
12
13
|
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
14
|
+
* The legacy Bedrock rubric gate is retired. Its asset is gone, so nothing here
|
|
15
|
+
* selects between modes any more -- but a repo that installed it earlier still
|
|
16
|
+
* has `prism-eval-gate.yml` from that era at the same path, which this command
|
|
17
|
+
* overwrites in place. That is the intended migration: same filename, same check
|
|
18
|
+
* name, so the branch protection rule keeps matching.
|
|
16
19
|
*/
|
|
17
|
-
const
|
|
18
|
-
kiro: 'prism-eval-gate-kiro.yml',
|
|
19
|
-
bedrock: 'prism-eval-gate.yml',
|
|
20
|
-
};
|
|
20
|
+
const EVAL_GATE_ASSET = 'prism-eval-gate-kiro.yml';
|
|
21
21
|
const EVAL_GATE_OUTPUT = 'prism-eval-gate.yml';
|
|
22
|
-
/** Rules
|
|
23
|
-
const
|
|
24
|
-
kiro: '.kiro/steering/code-review.md',
|
|
25
|
-
bedrock: '.prism/eval-harness/ (run-eval.sh + rubrics)',
|
|
26
|
-
};
|
|
22
|
+
/** Rules the gate reads, installed separately by install-eval-harness. */
|
|
23
|
+
const GATE_COMPANION = '.kiro/steering/code-review.md';
|
|
27
24
|
export default {
|
|
28
25
|
description: 'Install GitHub Actions workflow templates into the current repo',
|
|
29
26
|
options: [
|
|
30
|
-
{ flags: '--mode <mode>', description: 'Eval gate mode: "kiro" (default, headless kiro-cli) or "bedrock" (legacy rubrics). Only one gate is installed', default: 'kiro' },
|
|
31
27
|
{ flags: '--region <region>', description: 'AWS region for EventBridge/CloudWatch; must match setup-github-oidc', default: DEFAULT_REGION },
|
|
32
28
|
{ flags: '--output-dir <dir>', description: 'Output directory', default: '.github/workflows' },
|
|
29
|
+
{ flags: '--mode <mode>', description: '[retired] Only the kiro gate remains; "bedrock" now errors' },
|
|
33
30
|
],
|
|
34
31
|
async action(opts) {
|
|
35
32
|
const region = opts.region || DEFAULT_REGION;
|
|
36
33
|
const outputDir = opts.outputDir;
|
|
37
|
-
//
|
|
38
|
-
// bedrock would
|
|
39
|
-
//
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
console.error(
|
|
43
|
-
console.error(
|
|
34
|
+
// Erroring rather than ignoring the flag: a pinned script passing
|
|
35
|
+
// --mode bedrock would otherwise silently receive the kiro gate and only
|
|
36
|
+
// discover the swap as a missing KIRO_API_KEY on its next PR.
|
|
37
|
+
if (opts.mode && opts.mode !== 'kiro') {
|
|
38
|
+
console.error(`Error: --mode "${opts.mode}" is no longer available.`);
|
|
39
|
+
console.error(' The Bedrock rubric eval gate has been retired; kiro-cli is the only gate.');
|
|
40
|
+
console.error(' Drop the flag (or pass --mode kiro).');
|
|
44
41
|
process.exit(1);
|
|
45
42
|
}
|
|
46
43
|
console.log(`\n📦 Installing GitHub Actions workflows`);
|
|
47
|
-
console.log(`
|
|
44
|
+
console.log(` Gate: kiro-cli eval gate + gitleaks secret scan`);
|
|
48
45
|
console.log(` Region: ${region}`);
|
|
49
46
|
console.log(` Output: ${outputDir}/\n`);
|
|
50
47
|
mkdirSync(outputDir, { recursive: true });
|
|
51
48
|
const assetDir = getAssetPath(import.meta.url, 'github-workflows/prism-ai-metrics.yml').replace('/prism-ai-metrics.yml', '');
|
|
52
49
|
const files = readdirSync(assetDir).filter(f => f.endsWith('.yml'));
|
|
53
|
-
const gateAssets = new Set(Object.values(EVAL_GATE_ASSETS));
|
|
54
|
-
const selectedGate = EVAL_GATE_ASSETS[mode];
|
|
55
50
|
let installed = 0;
|
|
56
51
|
for (const file of files) {
|
|
57
|
-
|
|
58
|
-
if (gateAssets.has(file) && file !== selectedGate)
|
|
59
|
-
continue;
|
|
60
|
-
const outName = gateAssets.has(file) ? EVAL_GATE_OUTPUT : file;
|
|
52
|
+
const outName = file === EVAL_GATE_ASSET ? EVAL_GATE_OUTPUT : file;
|
|
61
53
|
let content = readFileSync(join(assetDir, file), 'utf-8');
|
|
62
54
|
// All workflows define PRISM_AWS_REGION in a top-level env: block and
|
|
63
55
|
// reference it everywhere else. The installer only needs to swap that one
|
|
@@ -73,14 +65,15 @@ export default {
|
|
|
73
65
|
}
|
|
74
66
|
}
|
|
75
67
|
writeFileSync(join(outputDir, outName), content);
|
|
76
|
-
console.log(` ✓ ${outName}${file === outName ? '' : ` (
|
|
68
|
+
console.log(` ✓ ${outName}${file === outName ? '' : ` (from ${file})`}`);
|
|
77
69
|
installed++;
|
|
78
70
|
}
|
|
79
|
-
// A pre-mode install of this command copied every asset
|
|
80
|
-
// can still hold
|
|
81
|
-
//
|
|
82
|
-
|
|
83
|
-
|
|
71
|
+
// A pre-mode install of this command copied every asset under its own name,
|
|
72
|
+
// so an upgrading repo can still hold prism-eval-gate-kiro.yml alongside the
|
|
73
|
+
// prism-eval-gate.yml just written. Reported rather than deleted: it is a
|
|
74
|
+
// tracked file in the user's repo, not ours to remove.
|
|
75
|
+
const stale = join(outputDir, EVAL_GATE_ASSET);
|
|
76
|
+
if (existsSync(stale)) {
|
|
84
77
|
console.warn(`\n ⚠ ${stale} is also present, left over from an earlier install.`);
|
|
85
78
|
console.warn(` It declares the same check name and trigger as ${EVAL_GATE_OUTPUT},`);
|
|
86
79
|
console.warn(` so both gates would run on every PR. Remove it:`);
|
|
@@ -90,16 +83,11 @@ export default {
|
|
|
90
83
|
console.log(`\nNext steps:`);
|
|
91
84
|
console.log(` 1. Run: prism-cli bootstrapper setup-github-oidc --region ${region}`);
|
|
92
85
|
console.log(` 2. Add repository secret PRISM_METRICS_ROLE_ARN in GitHub`);
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
else {
|
|
99
|
-
console.log(` 3. Run: prism-cli bootstrapper install-eval-harness --with-rubrics`);
|
|
100
|
-
console.log(` — installs ${MODE_COMPANION.bedrock}, which the gate reads`);
|
|
101
|
-
}
|
|
102
|
-
console.log(` ${mode === 'kiro' ? '5' : '4'}. Commit and push the workflow files`);
|
|
86
|
+
console.log(` 3. Add repository secret KIRO_API_KEY (https://app.kiro.dev → Settings → API Keys)`);
|
|
87
|
+
console.log(` 4. Run: prism-cli bootstrapper install-eval-harness`);
|
|
88
|
+
console.log(` — installs ${GATE_COMPANION} (the rules the gate reviews against),`);
|
|
89
|
+
console.log(` a .gitleaks.toml starter, and the harness prism-agent-eval.yml needs`);
|
|
90
|
+
console.log(` 5. Commit and push the workflow files`);
|
|
103
91
|
console.log('');
|
|
104
92
|
},
|
|
105
93
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"install-github-workflows.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAyB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE3F
|
|
1
|
+
{"version":3,"file":"install-github-workflows.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-github-workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAyB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,0EAA0E;AAC1E,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD,eAAe;IACb,WAAW,EAAE,iEAAiE;IAC9E,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,qEAAqE,EAAE,OAAO,EAAE,cAAc,EAAE;QAC3I,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,EAAE;QAC9F,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,4DAA4D,EAAE;KACtG;IACD,KAAK,CAAC,MAAM,CAAC,IAA2D;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,kEAAkE;QAClE,yEAAyE;QACzE,8DAA8D;QAC9D,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,kBAAkB,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;YACtE,OAAO,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;YAC7F,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,cAAc,SAAS,KAAK,CAAC,CAAC;QAE1C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;YACnE,IAAI,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,sEAAsE;YACtE,0EAA0E;YAC1E,0EAA0E;YAC1E,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,qBAAqB,cAAc,EAAE,CAAC;gBACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,oEAAoE;oBACpE,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,GAAG,EAAE,CAAC,CAAC;YAC5E,SAAS,EAAE,CAAC;QACd,CAAC;QAED,4EAA4E;QAC5E,6EAA6E;QAC7E,0EAA0E;QAC1E,uDAAuD;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,sDAAsD,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,sDAAsD,gBAAgB,GAAG,CAAC,CAAC;YACxF,OAAO,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,SAAS,sBAAsB,SAAS,GAAG,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,+DAA+D,MAAM,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,mBAAmB,cAAc,wCAAwC,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"install-gitlab-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-gitlab-workflows.ts"],"names":[],"mappings":";;;;;;;iBAwBqB;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAP/E,
|
|
1
|
+
{"version":3,"file":"install-gitlab-workflows.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-gitlab-workflows.ts"],"names":[],"mappings":";;;;;;;iBAwBqB;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE;;AAP/E,wBA+DE"}
|
|
@@ -59,7 +59,16 @@ export default {
|
|
|
59
59
|
console.log(` 1. Copy ${outputDir}/.gitlab-ci.yml to your repo root`);
|
|
60
60
|
console.log(` 2. Run: prism-cli bootstrapper setup-gitlab-oidc`);
|
|
61
61
|
console.log(` 3. Add CI/CD variable PRISM_METRICS_ROLE_ARN in GitLab`);
|
|
62
|
-
console.log(` 4. (
|
|
62
|
+
console.log(` 4. Add CI/CD variable KIRO_API_KEY (masked) — required by the eval gate`);
|
|
63
|
+
console.log(` Generate at: https://app.kiro.dev → Settings → API Keys`);
|
|
64
|
+
console.log(` 5. Run: prism-cli bootstrapper install-eval-harness`);
|
|
65
|
+
console.log(` — installs .kiro/steering/code-review.md (the rules the gate reviews`);
|
|
66
|
+
console.log(` against), a .gitleaks.toml starter, and the prism-agent-eval harness`);
|
|
67
|
+
console.log(` 6. (Optional) Create pipeline schedule for weekly DORA assessment`);
|
|
68
|
+
console.log('');
|
|
69
|
+
console.log(` Secret scanning (gitleaks) needs no CI/CD variable and no AWS role, so it`);
|
|
70
|
+
console.log(` is the only part of the gate that runs on fork merge requests — where`);
|
|
71
|
+
console.log(` GitLab withholds protected variables and KIRO_API_KEY is absent.`);
|
|
63
72
|
console.log('');
|
|
64
73
|
},
|
|
65
74
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"install-gitlab-workflows.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-gitlab-workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAyB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE3F,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,eAAe;IACb,WAAW,EAAE,4DAA4D;IACzE,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,oBAAoB,EAAE;QACpH,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,WAAW,EAAE;QAC1G,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,yBAAyB,EAAE;KACrG;IACD,KAAK,CAAC,MAAM,CAAC,IAAgE;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,MAAM,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,KAAK,CAAC,CAAC;QAE5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACjH,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,mCAAmC;YACnC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,6BAA6B,EAAE,QAAQ,SAAS,EAAE,CAAC,CAAC;YAC9E,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,qBAAqB,cAAc,EAAE,CAAC;gBACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,IAAI,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACvC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;YACzD,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,sBAAsB,SAAS,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,mCAAmC,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
|
|
1
|
+
{"version":3,"file":"install-gitlab-workflows.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-gitlab-workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC1F,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAyB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE3F,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,eAAe;IACb,WAAW,EAAE,4DAA4D;IACzE,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,oBAAoB,EAAE;QACpH,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,uCAAuC,EAAE,OAAO,EAAE,WAAW,EAAE;QAC1G,EAAE,KAAK,EAAE,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,EAAE,OAAO,EAAE,yBAAyB,EAAE;KACrG;IACD,KAAK,CAAC,MAAM,CAAC,IAAgE;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,MAAM,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAEjC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,KAAK,CAAC,CAAC;QAE5C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iCAAiC,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACjH,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1D,mCAAmC;YACnC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,6BAA6B,EAAE,QAAQ,SAAS,EAAE,CAAC,CAAC;YAC9E,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,qBAAqB,cAAc,EAAE,CAAC;gBACzD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC;gBACvE,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;YACD,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QAED,sCAAsC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,IAAI,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACvC,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,4BAA4B,EAAE,SAAS,CAAC,CAAC;YACzD,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,MAAM,sBAAsB,SAAS,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,mCAAmC,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;QACzF,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;QAClF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
|