@rahul05ranjan/dhruv-cli 1.3.0 → 1.4.6

package/.github/workflows/dependabot-auto-merge.yml

@@ -6,14 +6,73 @@ on:
       - opened
       - synchronize
       - reopened
+      - ready_for_review
+
+permissions:
+  contents: write
+  pull-requests: write
+  checks: read
 
 jobs:
+  auto-approve:
+    name: Auto Approve Dependabot PRs
+    if: github.actor == 'dependabot[bot]' && github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Approve Dependabot PRs
+        uses: hmarr/auto-approve-action@v4
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
   auto-merge:
-    if: github.actor == 'dependabot[bot]'
+    name: Auto Merge Dependabot PRs
+    needs: auto-approve
+    if: github.actor == 'dependabot[bot]' && github.event.pull_request.draft == false
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - name: Enable auto-merge for Dependabot PRs
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Get Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge for patch updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
         uses: peter-evans/enable-pull-request-automerge@v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           merge-method: squash
+
+      - name: Enable auto-merge for minor updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-minor' && contains(steps.metadata.outputs.dependency-names, '@types/')
+        uses: peter-evans/enable-pull-request-automerge@v3
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          merge-method: squash
+
+      - name: Comment on major updates
+        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          body: |
+            🚨 **Major Version Update Detected**
+            
+            This PR updates a dependency to a new major version. Please review the changelog and test thoroughly before merging.
+            
+            **Dependency:** ${{ steps.metadata.outputs.dependency-names }}
+            **Update Type:** ${{ steps.metadata.outputs.update-type }}
+            
+            This PR will not be auto-merged and requires manual review.

package/.github/workflows/deploy.yml

@@ -0,0 +1,336 @@
+name: Deployment Pipeline
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Deployment environment'
+        required: true
+        default: 'staging'
+        type: choice
+        options:
+          - staging
+          - production
+      version:
+        description: 'Version to deploy (leave empty for latest)'
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+  deployments: write
+  id-token: write
+
+env:
+  NODE_VERSION: '22.14.0'
+  REGISTRY_URL: 'https://registry.npmjs.org'
+
+jobs:
+  pre-deployment:
+    name: Pre-deployment Checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      environment: ${{ steps.environment.outputs.environment }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Determine version
+        id: version
+        run: |
+          if [[ "${{ github.event_name }}" == "release" ]]; then
+            VERSION="${{ github.event.release.tag_name }}"
+          elif [[ -n "${{ github.event.inputs.version }}" ]]; then
+            VERSION="${{ github.event.inputs.version }}"
+          else
+            VERSION=$(cat package.json | jq -r '.version')
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "Deploying version: ${VERSION}"
+
+      - name: Determine environment
+        id: environment
+        run: |
+          if [[ "${{ github.event_name }}" == "release" ]]; then
+            if [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
+              ENVIRONMENT="staging"
+            else
+              ENVIRONMENT="production"
+            fi
+          else
+            ENVIRONMENT="${{ github.event.inputs.environment }}"
+          fi
+          echo "environment=${ENVIRONMENT}" >> $GITHUB_OUTPUT
+          echo "Deploying to environment: ${ENVIRONMENT}"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          registry-url: ${{ env.REGISTRY_URL }}
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run comprehensive tests
+        run: |
+          npm run test:ci
+          npm run lint
+          npm run build
+
+      - name: Security scan
+        run: npm audit --audit-level=moderate
+
+      - name: Package validation
+        run: |
+          npm pack --dry-run
+          echo "Package size check..."
+          npm pack
+          ls -lah *.tgz
+
+  deploy-staging:
+    name: Deploy to Staging
+    runs-on: ubuntu-latest
+    needs: pre-deployment
+    if: needs.pre-deployment.outputs.environment == 'staging' || (github.event_name == 'release' && github.event.release.prerelease)
+    timeout-minutes: 20
+    environment:
+      name: staging
+      url: https://staging.example.com
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          registry-url: ${{ env.REGISTRY_URL }}
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Install npm with trusted publishing support
+        run: npm install --global npm@11.17.0
+
+      - name: Build for staging
+        run: |
+          NODE_ENV=staging npm run build
+          npm run docs
+
+      - name: Deploy to staging NPM registry
+        if: github.event_name == 'release' && github.event.release.prerelease
+        # npm 11.5.1+ authenticates using the workflow's OIDC identity.
+        run: npm publish --tag beta --access public --provenance
+
+      - name: Deploy documentation to staging
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./docs
+          publish_branch: gh-pages-staging
+          destination_dir: staging
+
+      - name: Staging health check
+        run: |
+          echo "Running staging health checks..."
+          # Add your staging health check commands here
+          curl -f https://staging.example.com/health || echo "Health check failed"
+
+      - name: Notify staging deployment
+        uses: 8398a7/action-slack@v3
+        if: always()
+        continue-on-error: true
+        with:
+          status: ${{ job.status }}
+          channel: '#deployments'
+          text: |
+            🚀 Staging Deployment ${{ job.status }}
+            
+            **Version:** ${{ needs.pre-deployment.outputs.version }}
+            **Branch:** ${{ github.ref_name }}
+            **Commit:** ${{ github.sha }}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
+
+  deploy-production:
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    needs: [pre-deployment, deploy-staging]
+    if: needs.pre-deployment.outputs.environment == 'production' && (github.event_name == 'release' && !github.event.release.prerelease)
+    timeout-minutes: 30
+    environment:
+      name: production
+      url: https://www.npmjs.com/package/dhruv-cli
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: 'npm'
+          registry-url: ${{ env.REGISTRY_URL }}
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Install npm with trusted publishing support
+        run: npm install --global npm@11.17.0
+
+      - name: Build for production
+        run: |
+          NODE_ENV=production npm run build
+          npm run docs
+
+      - name: Final production tests
+        run: |
+          npm run test:ci
+          npm run lint
+          npm audit --audit-level=moderate
+
+      - name: Deploy to NPM
+        # OIDC trusted publisher (no token: see staging step above).
+        run: npm publish --access public --provenance
+
+      - name: Deploy documentation to production
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./docs
+          publish_branch: gh-pages
+          enable_jekyll: false
+
+      - name: Create deployment artifact
+        run: |
+          mkdir -p artifacts
+          cp -r dist/* artifacts/
+          cp package.json artifacts/
+          cp README.md artifacts/
+          tar -czf deployment-${{ needs.pre-deployment.outputs.version }}.tar.gz artifacts/
+
+      - name: Upload deployment artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: deployment-${{ needs.pre-deployment.outputs.version }}
+          path: deployment-${{ needs.pre-deployment.outputs.version }}.tar.gz
+          retention-days: 90
+
+      - name: Production health check
+        run: |
+          echo "Waiting for NPM propagation..."
+          sleep 60
+          
+          echo "Verifying NPM package..."
+          npm view dhruv-cli version
+          
+          echo "Testing package installation..."
+          npm install -g dhruv-cli@${{ needs.pre-deployment.outputs.version }}
+          dhruv-cli --version
+
+      - name: Update GitHub release
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.repos.updateRelease({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              release_id: ${{ github.event.release.id }},
+              body: ${{ github.event.release.body }} + '\n\n---\n\n✅ **Successfully deployed to production**\n\n- 📦 NPM: https://www.npmjs.com/package/dhruv-cli\n- 📚 Documentation: https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}\n- 🔍 Health Status: ✅ All systems operational'
+            });
+
+      - name: Notify production deployment
+        uses: 8398a7/action-slack@v3
+        if: always()
+        continue-on-error: true
+        with:
+          status: ${{ job.status }}
+          channel: '#releases'
+          text: |
+            🎉 Production Deployment ${{ job.status }}
+            
+            **Version:** ${{ needs.pre-deployment.outputs.version }}
+            **NPM:** https://www.npmjs.com/package/dhruv-cli
+            **Docs:** https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}
+            **Release:** ${{ github.event.release.html_url }}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
+
+  rollback:
+    name: Rollback Capability
+    runs-on: ubuntu-latest
+    if: failure() && (needs.deploy-staging.result == 'failure' || needs.deploy-production.result == 'failure')
+    needs: [pre-deployment, deploy-staging, deploy-production]
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Create rollback issue
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = `🚨 Deployment Failure - Rollback Required`;
+            const body = `
+            ## Deployment Failure Alert
+            
+            A deployment has failed and may require rollback procedures.
+            
+            ### Failure Details
+            - **Version:** ${{ needs.pre-deployment.outputs.version }}
+            - **Environment:** ${{ needs.pre-deployment.outputs.environment }}
+            - **Workflow:** ${{ github.workflow }}
+            - **Run ID:** ${{ github.run_id }}
+            
+            ### Failed Jobs
+            - Deploy Staging: ${{ needs.deploy-staging.result }}
+            - Deploy Production: ${{ needs.deploy-production.result }}
+            
+            ### Immediate Actions Required
+            - [ ] Assess impact of deployment failure
+            - [ ] Determine if rollback is necessary
+            - [ ] Execute rollback procedures if needed
+            - [ ] Investigate root cause
+            - [ ] Fix underlying issues
+            
+            ### Rollback Commands
+            \`\`\`bash
+            # If NPM package was published, deprecate if necessary
+            npm deprecate dhruv-cli@${{ needs.pre-deployment.outputs.version }} "Deployment failed, please use previous version"
+            \`\`\`
+            
+            **This issue was automatically created by the deployment pipeline.**
+            `;
+            
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: title,
+              body: body,
+              labels: ['deployment', 'urgent', 'rollback'],
+              assignees: ['${{ github.repository_owner }}']
+            });

package/.github/workflows/monitoring.yml

@@ -0,0 +1,270 @@
+name: Monitoring & Health Check
+
+on:
+  schedule:
+    - cron: '0 0 * * *'  # Daily at midnight UTC
+    - cron: '0 12 * * *' # Daily at noon UTC
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - 'package.json'
+      - 'src/**'
+
+permissions:
+  contents: read
+  issues: write
+  security-events: write
+
+jobs:
+  health-check:
+    name: Application Health Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.8.1'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Build application
+        run: npm run build
+
+      - name: Test CLI functionality
+        run: |
+          echo "Testing CLI help command"
+          node dist/index.js --help || echo "CLI help failed"
+          
+          echo "Testing CLI version command"
+          node dist/index.js --version || echo "CLI version failed"
+          
+          echo "Testing CLI status command"
+          node dist/index.js status || echo "CLI status failed"
+
+      - name: Performance benchmark
+        run: |
+          echo "Running performance tests..."
+          time node dist/index.js --version
+          
+          # Memory usage check
+          echo "Checking memory usage..."
+          /usr/bin/time -v node dist/index.js --help 2>&1 | grep "Maximum resident set size" || echo "Memory check failed"
+
+      - name: Check bundle size
+        run: |
+          echo "Checking bundle sizes..."
+          du -h dist/ | sort -hr
+          
+          # Check if any bundle exceeds size limits
+          find dist/ -name "*.js" -size +1M -exec echo "WARNING: Large bundle found: {}" \;
+
+  dependency-security:
+    name: Dependency Security Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.8.1'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run npm audit
+        run: |
+          echo "Running npm security audit..."
+          npm audit --audit-level=moderate || echo "Audit found issues"
+
+      - name: Check for known vulnerabilities
+        uses: anchore/scan-action@v3
+        continue-on-error: true
+        with:
+          path: "."
+          fail-build: false
+          output-format: sarif
+
+      - name: Upload SARIF results
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        continue-on-error: true
+        with:
+          sarif_file: results.sarif
+
+      - name: License compliance check
+        run: |
+          echo "Checking license compliance..."
+          npx license-checker --summary || echo "License checker not available"
+
+  availability-monitor:
+    name: Service Availability Monitor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.event_name == 'schedule'
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - name: Check NPM package availability
+        run: |
+          echo "Checking NPM package availability..."
+          curl -f https://registry.npmjs.org/dhruv-cli || echo "NPM package check failed"
+
+      - name: Check GitHub repository health
+        run: |
+          echo "Checking GitHub repository health..."
+          curl -f https://api.github.com/repos/${{ github.repository }} || echo "GitHub API check failed"
+
+      - name: Check documentation site
+        run: |
+          echo "Checking documentation availability..."
+          curl -f https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}/ || echo "Documentation site check failed"
+
+  quality-metrics:
+    name: Code Quality Metrics
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.8.1'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run test coverage
+        run: npm run test:ci
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          file: ./coverage/lcov.info
+          flags: unittests
+          name: codecov-umbrella
+          fail_ci_if_error: false
+
+      - name: Code complexity analysis
+        run: |
+          echo "Running code complexity analysis..."
+          npx complexity-report src/ --format json > complexity.json || echo "Complexity analysis failed"
+          cat complexity.json | jq '.reports[] | select(.complexity.cyclomatic > 10)' || echo "No high complexity functions found"
+
+      - name: Technical debt analysis
+        run: |
+          echo "Analyzing technical debt..."
+          # Count TODO/FIXME comments
+          find src/ -name "*.ts" -exec grep -c "TODO\|FIXME\|HACK" {} + | awk -F: '{sum+=$2} END {print "Technical debt items:", sum}'
+          
+          # Check for code smells
+          find src/ -name "*.ts" -exec wc -l {} + | sort -nr | head -10
+
+  create-issue-on-failure:
+    name: Create Issue on Failure
+    runs-on: ubuntu-latest
+    needs: [health-check, dependency-security, availability-monitor, quality-metrics]
+    if: always() && (needs.health-check.result == 'failure' || needs.dependency-security.result == 'failure' || needs.availability-monitor.result == 'failure' || needs.quality-metrics.result == 'failure')
+    timeout-minutes: 5
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Create failure issue
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const title = `🚨 Monitoring Alert: Workflow Failure Detected`;
+            const body = `
+            ## Monitoring Alert
+            
+            A monitoring workflow has failed. Please investigate immediately.
+            
+            ### Failure Details
+            - **Workflow**: ${{ github.workflow }}
+            - **Run ID**: ${{ github.run_id }}
+            - **Commit**: ${{ github.sha }}
+            - **Trigger**: ${{ github.event_name }}
+            - **Time**: ${new Date().toISOString()}
+            
+            ### Job Results
+            - Health Check: ${{ needs.health-check.result }}
+            - Dependency Security: ${{ needs.dependency-security.result }}
+            - Availability Monitor: ${{ needs.availability-monitor.result }}
+            - Quality Metrics: ${{ needs.quality-metrics.result }}
+            
+            ### Action Required
+            - [ ] Check workflow logs: [View Run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})
+            - [ ] Investigate failures
+            - [ ] Fix underlying issues
+            - [ ] Verify fixes work
+            - [ ] Close this issue when resolved
+            
+            **This issue was automatically created by the monitoring workflow.**
+            `;
+            
+            // Check if similar issue already exists
+            const issues = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              labels: ['monitoring', 'automated'],
+              state: 'open'
+            });
+            
+            const existingIssue = issues.data.find(issue => 
+              issue.title.includes('Monitoring Alert') && 
+              issue.body.includes('${{ github.run_id }}')
+            );
+            
+            if (!existingIssue) {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title: title,
+                body: body,
+                labels: ['bug', 'monitoring', 'automated', 'urgent'],
+                assignees: ['${{ github.repository_owner }}']
+              });
+            }
+
+      - name: Send failure notification
+        if: always() && (needs.health-check.result == 'failure' || needs.dependency-security.result == 'failure' || needs.availability-monitor.result == 'failure' || needs.quality-metrics.result == 'failure')
+        uses: actions/github-script@v7
+        with:
+          script: |
+            console.log('Failure notification system activated');
+            // Additional notification logic can be added here