@prism-d1/cli 1.0.93 → 1.0.95

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -1,490 +0,0 @@
-# prism-eval-gate.yml — Evaluate AI-generated code quality on PRs.
-#
-# Copy this file to .github/workflows/prism-eval-gate.yml in your repo.
-#
-# Required setup:
-#   - OIDC provider configured for GitHub Actions in your AWS account
-#   - IAM role with bedrock:InvokeModel and events:PutEvents permissions
-#   - Repository secret PRISM_METRICS_ROLE_ARN set to the OIDC role ARN
-#   - .prism/eval-harness/ directory in your repo (run: bash prism-cli bootstrapper install-eval-harness)
-#   - At least one rubric JSON in .prism/eval-harness/rubrics/
-
-name: PRISM Eval Gate
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-    branches: [main, master]
-
-
-env:
-  PRISM_AWS_REGION: us-west-2
-  PRISM_REPO: github.com/${{ github.repository }}
-
-permissions:
-  id-token: write
-  contents: read
-  pull-requests: write
-
-jobs:
-  eval-gate:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
-        with:
-          role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
-          aws-region: ${{ env.PRISM_AWS_REGION }}
-
-      - name: Read team ID
-        id: prism-config
-        run: |
-          TEAM_ID=$(jq -r '.team_id // "no_team"' .prism/config.json 2>/dev/null || echo "no_team")
-          echo "team_id=${TEAM_ID}" >> "$GITHUB_OUTPUT"
-
-      - name: Install dependencies
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq jq bc
-
-      - name: Identify AI-generated changes
-        id: detect-ai
-        run: |
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
-          HEAD_SHA="${{ github.sha }}"
-
-          AI_SHAS=""
-          for SHA in $(git rev-list "${BASE_SHA}..${HEAD_SHA}"); do
-            if git log -1 --format='%B' "${SHA}" | grep -q 'AI-Origin: ai-generated\|AI-Origin: ai-assisted'; then
-              AI_SHAS="${AI_SHAS} ${SHA}"
-            fi
-          done
-          AI_SHAS=$(echo "${AI_SHAS}" | xargs)
-
-          if [[ -z "${AI_SHAS}" ]]; then
-            echo "has_ai_changes=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          echo "has_ai_changes=true" >> "$GITHUB_OUTPUT"
-          echo "ai_shas=${AI_SHAS}" >> "$GITHUB_OUTPUT"
-
-          # Collect changed source files from AI commits
-          CHANGED_FILES=""
-          for SHA in ${AI_SHAS}; do
-            FILES=$(git diff-tree --no-commit-id --name-only -r "${SHA}" \
-              | grep -E '\.(ts|js|py|go|java|rs|tsx|jsx)$' | grep -v '\.test\.\|\.spec\.' || true)
-            CHANGED_FILES="${CHANGED_FILES}\n${FILES}"
-          done
-
-          echo -e "${CHANGED_FILES}" | sort -u | grep -v '^$' > /tmp/ai-changed-files.txt || true
-          FILE_COUNT=$(wc -l < /tmp/ai-changed-files.txt | tr -d ' ')
-          echo "file_count=${FILE_COUNT}" >> "$GITHUB_OUTPUT"
-
-      - name: Run evaluations
-        id: eval
-        if: steps.detect-ai.outputs.has_ai_changes == 'true'
-        run: |
-          set -o pipefail
-          chmod +x .prism/eval-harness/run-eval.sh
-
-          # Find spec from commit trailers
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
-          HEAD_SHA="${{ github.sha }}"
-          SPEC_REF=$(git log "${BASE_SHA}..${HEAD_SHA}" --format='%(trailers:key=Spec,valueonly)' | head -1 | tr -d '[:space:]' || true)
-          SPEC_FLAG=""
-          [[ -n "${SPEC_REF}" && -f "${SPEC_REF}" ]] && SPEC_FLAG="--spec ${SPEC_REF}"
-
-          PASS_COUNT=0
-          FAIL_COUNT=0
-          TOTAL_SCORE=0
-          TOTAL_HALLUCINATIONS=0
-          RESULTS=""
-
-          while IFS= read -r FILE; do
-            [[ -z "${FILE}" || ! -f "${FILE}" ]] && continue
-
-            # Auto-select rubric based on file path
-            if echo "${FILE}" | grep -qiE '(agent|assistant|orchestrat|workflow|chain)'; then
-              RUBRIC=".prism/eval-harness/rubrics/agent-quality.json"
-            elif echo "${FILE}" | grep -qiE '(auth|security|guard|policy|iam|permission|crypto)'; then
-              RUBRIC=".prism/eval-harness/rubrics/security-compliance.json"
-            elif echo "${FILE}" | grep -qiE '(api|handler|route|controller)'; then
-              RUBRIC=".prism/eval-harness/rubrics/api-response-quality.json"
-            else
-              RUBRIC=".prism/eval-harness/rubrics/code-quality.json"
-            fi
-
-            # Fall back to first available rubric if selected doesn't exist
-            [[ -f "${RUBRIC}" ]] || RUBRIC=$(ls .prism/eval-harness/rubrics/*.json 2>/dev/null | head -1)
-            [[ -f "${RUBRIC}" ]] || { echo "No rubrics found"; exit 1; }
-
-            echo "Evaluating: ${FILE} (rubric: $(basename "${RUBRIC}" .json))"
-
-            set +e
-            OUTPUT=$(./.prism/eval-harness/run-eval.sh "${RUBRIC}" "${FILE}" ${SPEC_FLAG} 2>&1)
-            EXIT_CODE=$?
-            set -e
-
-            SCORE=$(echo "${OUTPUT}" | grep '^Score:' | awk '{print $2}' || echo "0")
-            RESULT=$(echo "${OUTPUT}" | grep '^Result:' | awk '{print $2}' || echo "UNKNOWN")
-            HALLUC=$(echo "${OUTPUT}" | grep '^Hallucinations:' | awk '{print $2}' || echo "0")
-
-            TOTAL_SCORE=$(echo "${TOTAL_SCORE} + ${SCORE}" | bc -l)
-            TOTAL_HALLUCINATIONS=$((TOTAL_HALLUCINATIONS + HALLUC))
-
-            if [[ "${RESULT}" == "SKIP" ]]; then
-              continue
-            elif [[ "${RESULT}" == "PASS" ]]; then
-              PASS_COUNT=$((PASS_COUNT + 1))
-            else
-              FAIL_COUNT=$((FAIL_COUNT + 1))
-            fi
-
-            RESULTS="${RESULTS}\n| \`${FILE}\` | $(basename "${RUBRIC}" .json) | ${SCORE} | ${RESULT} |"
-          done < /tmp/ai-changed-files.txt
-
-          TOTAL_FILES=$((PASS_COUNT + FAIL_COUNT))
-          AVG_SCORE="0"
-          [[ "${TOTAL_FILES}" -gt 0 ]] && AVG_SCORE=$(echo "scale=4; ${TOTAL_SCORE} / ${TOTAL_FILES}" | bc -l)
-
-          echo "pass_count=${PASS_COUNT}" >> "$GITHUB_OUTPUT"
-          echo "fail_count=${FAIL_COUNT}" >> "$GITHUB_OUTPUT"
-          echo "avg_score=${AVG_SCORE}" >> "$GITHUB_OUTPUT"
-          echo "total_files=${TOTAL_FILES}" >> "$GITHUB_OUTPUT"
-          echo "hallucinations=${TOTAL_HALLUCINATIONS}" >> "$GITHUB_OUTPUT"
-          echo -e "${RESULTS}" > /tmp/eval-results-table.txt
-
-          [[ "${FAIL_COUNT}" -gt 0 ]] && echo "overall_result=FAIL" >> "$GITHUB_OUTPUT" || echo "overall_result=PASS" >> "$GITHUB_OUTPUT"
-
-      - name: Post PR comment
-        if: always()
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            const fs = require('fs');
-            const hasAI = '${{ steps.detect-ai.outputs.has_ai_changes }}' === 'true';
-
-            let body;
-            if (!hasAI) {
-              body = ':white_check_mark: **PRISM Eval Gate** — No AI-generated code detected. Skipped.';
-            } else {
-              const avg = '${{ steps.eval.outputs.avg_score }}';
-              const pass = '${{ steps.eval.outputs.pass_count }}';
-              const fail = '${{ steps.eval.outputs.fail_count }}';
-              const total = '${{ steps.eval.outputs.total_files }}';
-              const result = '${{ steps.eval.outputs.overall_result }}';
-              const halluc = '${{ steps.eval.outputs.hallucinations }}';
-              const emoji = result === 'PASS' ? ':white_check_mark:' : ':x:';
-              const table = fs.existsSync('/tmp/eval-results-table.txt')
-                ? fs.readFileSync('/tmp/eval-results-table.txt', 'utf8').trim() : '';
-
-              body = `## ${emoji} PRISM Eval Gate — ${result}\n\n` +
-                `**Score**: ${avg} | **Files**: ${total} | **Pass**: ${pass} | **Fail**: ${fail} | **Hallucinations**: ${halluc}\n\n` +
-                `| File | Rubric | Score | Result |\n|---|---|---|---|\n${table}\n\n` +
-                `> Threshold: 0.82 | Model: claude-sonnet-4-20250514`;
-            }
-
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number
-            });
-            const existing = comments.find(c => c.body.includes('PRISM Eval Gate'));
-            const params = { owner: context.repo.owner, repo: context.repo.repo, body };
-
-            if (existing) {
-              await github.rest.issues.updateComment({ ...params, comment_id: existing.id });
-            } else {
-              await github.rest.issues.createComment({ ...params, issue_number: context.issue.number });
-            }
-
-      - name: Emit prism.d1.eval event
-        if: steps.detect-ai.outputs.has_ai_changes == 'true'
-        run: |
-          TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-          EVAL_EVENT=$(jq -n \
-            --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${PRISM_REPO}" \
-            --arg timestamp "${TIMESTAMP}" \
-            --argjson score "${{ steps.eval.outputs.avg_score }}" \
-            --arg result "${{ steps.eval.outputs.overall_result }}" \
-            --argjson total_files "${{ steps.eval.outputs.total_files }}" \
-            --argjson pass_count "${{ steps.eval.outputs.pass_count }}" \
-            --argjson fail_count "${{ steps.eval.outputs.fail_count }}" \
-            --argjson hallucinations "${{ steps.eval.outputs.hallucinations }}" \
-            --arg pr_number "${{ github.event.pull_request.number }}" \
-            '{
-              team_id: $team_id, repo: $repo, timestamp: $timestamp, prism_level: 2,
-              metric: {name: "eval_score", value: $score, unit: "score"},
-              ai_context: {tool: "bedrock-eval", model: "anthropic.claude-sonnet-4-20250514", origin: "ai-generated"},
-              eval: {total_files: $total_files, pass_count: $pass_count, fail_count: $fail_count,
-                     result: $result, pr_number: ($pr_number | tonumber), hallucinations_caught: $hallucinations}
-            }')
-          aws events put-events --region $PRISM_AWS_REGION --entries "[{
-            \"Source\":\"prism.d1.velocity\",\"DetailType\":\"prism.d1.eval\",
-            \"EventBusName\":\"prism-d1-metrics\",
-            \"Detail\":$(echo "${EVAL_EVENT}" | jq -c '.' | jq -Rs '.')}]"
-
-      - name: Upgrade AWS CLI v2 (securityagent code review requires v2.36+)
-        run: |
-          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
-          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip.sha256" -o /tmp/awscliv2.zip.sha256
-          cd /tmp && sha256sum -c awscliv2.zip.sha256
-          unzip -qo /tmp/awscliv2.zip -d /tmp
-          sudo /tmp/aws/install --update --install-dir /usr/local/aws-cli --bin-dir /usr/local/bin 2>/dev/null || \
-            sudo /tmp/aws/install --install-dir /usr/local/aws-cli --bin-dir /usr/local/bin 2>/dev/null || true
-          rm -rf /tmp/aws /tmp/awscliv2.zip /tmp/awscliv2.zip.sha256
-          hash -r
-          echo "AWS CLI: $(aws --version)"
-          echo "Has create-code-review: $(aws securityagent create-code-review help 2>&1 | head -1)"
-
-      - name: AWS Continuum diff scan
-        id: security-gate
-        env:
-          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
-        run: |
-          echo "::group::Retrieve Continuum config from SSM"
-          AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
-          SCAN_BUCKET=$(aws ssm get-parameter --name /prism/continuum/scan-bucket --query Parameter.Value --output text 2>/dev/null || echo "")
-          SERVICE_ROLE=$(aws ssm get-parameter --name /prism/continuum/service-role-arn --query Parameter.Value --output text 2>/dev/null || echo "")
-          echo "::endgroup::"
-
-          # Skip if core infrastructure not deployed
-          if [[ -z "$AGENT_SPACE_ID" || -z "$SCAN_BUCKET" ]]; then
-            echo "⚠️ AWS Continuum not configured (agent-space-id or scan-bucket missing). Skipping security scan."
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            echo "skipped=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Continuum IS configured from here on, so every failure below fails
-          # closed. The CLI probe runs after the config lookup on purpose: before
-          # it, "never deployed" and "deployed but cannot scan" are
-          # indistinguishable, and the old order silently passed the gate on a repo
-          # that had opted into scanning.
-          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
-            echo "::error::Continuum is configured but this AWS CLI lacks the securityagent code review commands (need v2.36+)."
-            echo "  The security scan cannot run, so this PR is not verified."
-            echo "scan_error=true" >> "$GITHUB_OUTPUT"
-            echo "findings=-1" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          # Fallback for service role if SSM param not yet deployed
-          if [[ -z "$SERVICE_ROLE" ]]; then
-            ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
-            SERVICE_ROLE="arn:aws:iam::${ACCOUNT_ID}:role/prism-d1-security-agent-prism-d1-security"
-            echo "::notice::service-role-arn SSM param not found, using convention: ${SERVICE_ROLE}"
-          fi
-
-          # Derive repo slug for per-repo SSM key (org/repo → org-repo)
-          REPO_SLUG=$(echo "${{ github.repository }}" | tr '/' '-')
-
-          echo "::group::Resolve Code Review for ${REPO_SLUG}"
-          CODE_REVIEW_ID=$(aws ssm get-parameter --name "/prism/continuum/code-review-id/${REPO_SLUG}" --query Parameter.Value --output text 2>/dev/null || echo "")
-
-          if [[ -z "$CODE_REVIEW_ID" ]]; then
-            echo "  No Code Review found for ${REPO_SLUG} -- bootstrapping..."
-            echo "  CLI version: $(aws --version 2>&1 | head -1)"
-            echo "  CLI path: $(which aws)"
-
-            # Upload repo ZIP first (required as source context for the CodeReview)
-            git archive HEAD --format=zip -o /tmp/repo.zip
-            aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
-
-            # Continuum rejects a title containing anything outside
-            # [A-Za-z0-9_-]. REPO_SLUG keeps the dot from the host component
-            # (github.com-owner-repo) because SSM parameter names and S3 keys
-            # both accept dots and those paths must stay stable. The title is
-            # the only consumer that cannot, so it gets its own sanitised form.
-            #
-            # This broke when CI switched to emitting fully-qualified repo names
-            # (github.com/owner/repo) so attribution keys would match codeburn's.
-            # A bare owner/repo slug had no dot and validated fine.
-            #
-            # printf, not echo: tr -c would otherwise rewrite the trailing
-            # newline into a hyphen and leave every title ending in one.
-            CR_TITLE=$(printf '%s-ci-diff-scan' "${REPO_SLUG}" | tr -c 'A-Za-z0-9_-' '-' | cut -c1-100)
-
-            # Create the CodeReview
-            CR_OUTPUT=$(aws securityagent create-code-review \
-              --agent-space-id "$AGENT_SPACE_ID" \
-              --title "$CR_TITLE" \
-              --service-role "$SERVICE_ROLE" \
-              --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
-              --output json 2>&1) || true
-            # `|| echo ""` is load-bearing. CR_OUTPUT captures stderr via 2>&1,
-            # so a failed create leaves AWS's error TEXT here, not JSON. jq exits
-            # 5 on a parse error, and under bash -eo pipefail that aborts the
-            # whole step -- which made the diagnostic below unreachable and
-            # surfaced a bare "Process completed with exit code 5" instead of the
-            # actual ValidationException.
-            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null || echo "")
-
-            if [[ -z "$CODE_REVIEW_ID" ]]; then
-              echo "  ⚠️ Bootstrap failed:"
-              echo "  $CR_OUTPUT"
-              echo "  Run 'prism-cli securityagent setup' to create it manually."
-              echo "scan_error=true" >> "$GITHUB_OUTPUT"
-              echo "findings=-1" >> "$GITHUB_OUTPUT"
-              exit 0
-            fi
-
-            # Persist for future runs
-            aws ssm put-parameter \
-              --name "/prism/continuum/code-review-id/${REPO_SLUG}" \
-              --value "$CODE_REVIEW_ID" \
-              --type String --overwrite > /dev/null
-
-            echo "  [x] Code Review created: ${CODE_REVIEW_ID}"
-            echo "  [x] Saved to SSM"
-          fi
-
-          echo "  Using Code Review: ${CODE_REVIEW_ID}"
-
-          # Upload fresh repo ZIP (context for accurate cross-module analysis)
-          git archive HEAD --format=zip -o /tmp/repo.zip
-          aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
-          echo "::endgroup::"
-
-          echo "::group::Generate and upload diff"
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
-          HEAD_SHA="${{ github.sha }}"
-          git diff "${BASE_SHA}..${HEAD_SHA}" > /tmp/changes.patch
-
-          DIFF_SIZE=$(wc -c < /tmp/changes.patch)
-          if [[ "$DIFF_SIZE" -eq 0 ]]; then
-            echo "No changes to scan."
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          DIFF_KEY="diffs/${REPO_SLUG}/${{ github.event.pull_request.number }}/${HEAD_SHA}.patch"
-          aws s3 cp /tmp/changes.patch "s3://${SCAN_BUCKET}/${DIFF_KEY}" --quiet
-          echo "::endgroup::"
-
-          echo "::group::Start Continuum diff scan"
-          JOB_RESPONSE=$(aws securityagent start-code-review-job \
-            --agent-space-id "${AGENT_SPACE_ID}" \
-            --code-review-id "${CODE_REVIEW_ID}" \
-            --diff-source "{\"s3Uri\":\"s3://${SCAN_BUCKET}/${DIFF_KEY}\"}" \
-            --output json)
-
-          JOB_ID=$(echo "$JOB_RESPONSE" | jq -r '.codeReviewJobId')
-          echo "Job started: ${JOB_ID}"
-          echo "::endgroup::"
-
-          echo "::group::Poll for completion (timeout: 30 min)"
-          for i in $(seq 1 60); do
-            sleep 30
-            STATUS=$(aws securityagent batch-get-code-review-jobs \
-              --agent-space-id "${AGENT_SPACE_ID}" \
-              --code-review-job-ids "${JOB_ID}" \
-              --query 'codeReviewJobs[0].status' --output text 2>/dev/null || echo "UNKNOWN")
-
-            echo "  Poll ${i}/60: ${STATUS}"
-            if [[ "$STATUS" == "COMPLETED" || "$STATUS" == "FAILED" || "$STATUS" == "STOPPED" ]]; then
-              break
-            fi
-          done
-          echo "::endgroup::"
-
-          if [[ "$STATUS" == "FAILED" ]]; then
-            echo "::warning::Continuum scan failed — check Security Agent logs"
-            echo "scan_error=true" >> "$GITHUB_OUTPUT"
-            echo "findings=-1" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [[ "$STATUS" != "COMPLETED" ]]; then
-            echo "::warning::Continuum scan timed out (status: ${STATUS})"
-            echo "scan_error=true" >> "$GITHUB_OUTPUT"
-            echo "findings=-1" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          echo "::group::Retrieve findings"
-          # No empty-array fallback: an API error there is indistinguishable from a
-          # clean scan, so it would pass the gate.
-          if ! FINDINGS_JSON=$(aws securityagent list-findings \
-            --agent-space-id "${AGENT_SPACE_ID}" \
-            --code-review-job-id "${JOB_ID}" \
-            --output json 2>&1); then
-            echo "::error::Continuum scan completed but its findings could not be retrieved: ${FINDINGS_JSON}"
-            echo "scan_error=true" >> "$GITHUB_OUTPUT"
-            echo "findings=-1" >> "$GITHUB_OUTPUT"
-            echo "::endgroup::"
-            exit 0
-          fi
-
-          TOTAL=$(echo "$FINDINGS_JSON" | jq '.findingsSummaries | length')
-          CRITICAL=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "CRITICAL")] | length')
-          HIGH=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "HIGH")] | length')
-          MEDIUM=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "MEDIUM")] | length')
-
-          echo "Findings: ${TOTAL} total (${CRITICAL} critical, ${HIGH} high, ${MEDIUM} medium)"
-          echo "findings=${TOTAL}" >> "$GITHUB_OUTPUT"
-          echo "critical=${CRITICAL}" >> "$GITHUB_OUTPUT"
-          echo "high=${HIGH}" >> "$GITHUB_OUTPUT"
-          echo "findings_json=$(echo "$FINDINGS_JSON" | jq -c '.findingsSummaries')" >> "$GITHUB_OUTPUT"
-          echo "::endgroup::"
-
-          # Print findings summary for PR annotations
-          if [[ "$TOTAL" -gt 0 ]]; then
-            echo "$FINDINGS_JSON" | jq -r '.findingsSummaries[] | "::error ::[\(.riskLevel)] \(.name | .[0:120])"'
-          fi
-
-      - name: Emit Continuum findings to EventBridge
-        if: steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true'
-        env:
-          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
-        run: |
-          PR_NUMBER="${{ github.event.pull_request.number }}"
-          REPO="${PRISM_REPO}"
-          TEAM_ID="${{ steps.prism-config.outputs.team_id }}"
-          FINDINGS='${{ steps.security-gate.outputs.findings_json }}'
-
-          AI_ORIGIN="human"
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
-          HEAD_SHA="${{ github.sha }}"
-          for SHA in $(git rev-list "${BASE_SHA}..${HEAD_SHA}"); do
-            if git log -1 --format='%B' "${SHA}" | grep -q 'AI-Origin: ai-generated\|AI-Origin: ai-assisted'; then
-              AI_ORIGIN="ai-assisted"; break
-            fi
-          done
-
-          ENTRIES=$(echo "${FINDINGS}" | jq --arg team_id "${TEAM_ID}" --arg repo "${REPO}" \
-            --arg ai_origin "${AI_ORIGIN}" --argjson pr_number "${PR_NUMBER}" '
-            to_entries | map(.value as $f |
-              {Source:"prism.d1.velocity", DetailType:"prism.d1.security.code_review",
-               EventBusName:"prism-d1-metrics",
-               Detail:({team_id:$team_id, repo:$repo, timestamp:($f.createdAt // now | tostring), prism_level:3,
-                 metric:{name:"security_finding",value:1,unit:"count"},
-                 ai_context:{tool:"continuum",model:"aws-continuum",origin:$ai_origin},
-                 security_agent_finding:{finding_id:($f.findingId // "cf-pr\($pr_number)-\(.key)"), phase:"code_review",
-                   severity:($f.riskLevel // "MEDIUM"),
-                   cwe_id:($f.cweId // null),
-                   ai_origin:$ai_origin, found_at:($f.createdAt // null)}
-               } | tostring)})' 2>/dev/null || echo "[]")
-
-          TOTAL=$(echo "${ENTRIES}" | jq 'length')
-          if [[ "$TOTAL" -gt 0 ]]; then
-            for i in $(seq 0 10 $((TOTAL - 1))); do
-              aws events put-events --entries "$(echo "${ENTRIES}" | jq ".[$i:$((i+10))]")"
-            done
-            echo "Emitted ${TOTAL} finding events to EventBridge"
-          fi
-
-      - name: Fail on eval or security issues
-        if: steps.eval.outputs.overall_result == 'FAIL' || steps.security-gate.outputs.scan_error == 'true' || (steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true')
-        run: |
-          [[ "${{ steps.eval.outputs.overall_result }}" == "FAIL" ]] && echo "❌ Eval gate failed"
-          if [[ "${{ steps.security-gate.outputs.scan_error }}" == "true" ]]; then
-            echo "⚠️ AWS Continuum scan encountered an error (did not complete successfully)"
-            echo "  The security gate cannot verify this PR is safe. Re-run the workflow or check Security Agent logs."
-          elif [[ "${{ steps.security-gate.outputs.findings }}" != "0" && "${{ steps.security-gate.outputs.skipped }}" != "true" ]]; then
-            echo "❌ AWS Continuum found ${{ steps.security-gate.outputs.findings }} security issues (${{ steps.security-gate.outputs.critical }} critical, ${{ steps.security-gate.outputs.high }} high)"
-          fi
-          exit 1