@rahul05ranjan/dhruv-cli 1.3.0 → 1.4.6

package/.github/workflows/release.yml

@@ -0,0 +1,229 @@
+name: Release Management
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      release_type:
+        description: 'Release type (patch, minor, major, prerelease)'
+        required: true
+        default: 'patch'
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+          - prerelease
+
+permissions:
+  contents: write
+  packages: write
+  pull-requests: write
+  issues: write
+  id-token: write
+
+jobs:
+  pre-release-validation:
+    name: Pre-Release Validation
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run full test suite
+        run: npm run test:ci
+
+      - name: Build project
+        run: npm run build
+
+      - name: Generate documentation
+        run: npm run docs
+
+      - name: Run security audit
+        run: npm audit --omit=dev --audit-level=high
+
+      - name: Package size check
+        run: |
+          npm pack --dry-run
+          du -sh *.tgz || echo "No package found"
+
+      - name: Validate package contents
+        run: |
+          npm pack
+          tar -tzf *.tgz | head -20
+
+  release:
+    name: Create Release
+    runs-on: ubuntu-latest
+    needs: pre-release-validation
+    timeout-minutes: 15
+    environment: production
+    env:
+      # Authentication uses OIDC with npm 11.5.1+; provenance is an attestation.
+      NPM_CONFIG_PROVENANCE: 'true'
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+          cache: 'npm'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Build project
+        run: npm run build
+
+      - name: Generate documentation
+        run: npm run docs
+
+      - name: Install npm with trusted publishing support
+        run: npm install --global npm@11.17.0
+
+      - name: Generate changelog
+        run: |
+          npx conventional-changelog-cli -p angular -i CHANGELOG.md -s
+          git add CHANGELOG.md || echo "No changelog changes"
+
+      - name: Create Release PR
+        if: github.event_name == 'workflow_dispatch'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'chore(release): prepare release ${{ github.event.inputs.release_type }}'
+          title: 'chore(release): prepare ${{ github.event.inputs.release_type }} release'
+          body: |
+            ## Release Preparation
+            
+            This PR prepares a ${{ github.event.inputs.release_type }} release.
+            
+            ### Changes included:
+            - Updated version in package.json
+            - Generated changelog
+            - Updated documentation
+            
+            ### Pre-release checklist:
+            - [ ] All tests passing
+            - [ ] Documentation updated
+            - [ ] Security audit clean
+            - [ ] Breaking changes documented
+            
+            **Auto-generated by Release Management workflow**
+          branch: release/prepare-${{ github.event.inputs.release_type }}
+          delete-branch: true
+
+      - name: Release with semantic-release
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npx semantic-release
+
+      - name: Manual publish for workflow dispatch
+        if: github.event_name == 'workflow_dispatch'
+        run: |
+          # For manual releases, update version first
+          npm version ${{ github.event.inputs.release_type }} --no-git-tag-version
+          npm publish --access public --provenance
+
+      - name: Update GitHub Pages
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./docs
+          publish_branch: gh-pages
+          enable_jekyll: false
+
+      - name: Create GitHub Release
+        if: startsWith(github.ref, 'refs/tags/v')
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/**
+            docs/**
+            *.tgz
+          generate_release_notes: true
+          draft: false
+          prerelease: ${{ contains(github.ref, 'alpha') || contains(github.ref, 'beta') || contains(github.ref, 'rc') }}
+
+  post-release:
+    name: Post Release Tasks
+    runs-on: ubuntu-latest
+    needs: release
+    if: always() && (needs.release.result == 'success')
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Update repository topics
+        # Best-effort: GITHUB_TOKEN cannot replaceAllTopics without admin.
+        continue-on-error: true
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const packageJson = require('./package.json');
+            const topics = [
+              'cli',
+              'ai',
+              'developer-tools',
+              'ollama',
+              'typescript',
+              `version-${packageJson.version.replace(/\./g, '-')}`
+            ];
+            
+            await github.rest.repos.replaceAllTopics({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              names: topics
+            });
+
+      - name: Notify stakeholders
+        uses: 8398a7/action-slack@v3
+        continue-on-error: true
+        with:
+          status: 'success'
+          channel: '#releases'
+          text: |
+            🎉 New release published!
+            
+            **Repository:** ${{ github.repository }}
+            **Version:** ${{ github.ref_name }}
+            **Release Notes:** ${{ github.server_url }}/${{ github.repository }}/releases/tag/${{ github.ref_name }}
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

package/.github/workflows/security.yml

@@ -0,0 +1,198 @@
+name: Security Monitoring
+
+on:
+  schedule:
+    - cron: '0 6 * * 1' # Every Monday at 6 AM UTC
+  workflow_dispatch:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  secret-scan:
+    name: Secret Scanning
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run TruffleHog
+        uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          # Use the action's event-aware range (push, PR, or full history).
+          extra_args: --debug --only-verified
+
+  license-check:
+    name: License Compliance
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.8.1'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Check licenses
+        run: |
+          npx license-checker --summary --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;Unlicense' || echo "License check completed with warnings"
+        continue-on-error: true
+
+  supply-chain:
+    name: Supply Chain Security
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.8.1'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Run OSV Scanner
+        uses: google/osv-scanner-action/osv-scanner-action@v2.6.0
+        continue-on-error: true
+        with:
+          scan-args: |-
+            --recursive
+            ./
+
+      - name: Run Snyk Security Scan
+        uses: snyk/actions/node@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --severity-threshold=high
+        continue-on-error: true
+
+  sbom-generation:
+    name: Generate SBOM
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.8.1'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --prefer-offline --no-audit
+
+      - name: Generate SBOM
+        run: |
+          npx --yes @cyclonedx/cyclonedx-npm --output-file sbom.json
+          npx --yes @cyclonedx/cyclonedx-npm --output-file sbom.xml --output-format XML
+
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-files
+          path: |
+            sbom.json
+            sbom.xml
+          retention-days: 90
+
+  security-scorecard:
+    name: OSSF Scorecard
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+      id-token: write
+    # Scorecard only supports analysis from the repository's default branch.
+    if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload SARIF results
+        if: always() && hashFiles('results.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+
+  container-scan:
+    name: Container and Dependency Scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: github.event_name != 'pull_request'
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@v4
+
+      # Scorecard publishing only permits approved actions in its own job.
+      - name: Container and dependency scan
+        uses: anchore/scan-action@v7.4.2
+        id: scan
+        with:
+          path: "."
+          fail-build: false
+          output-format: sarif
+
+      - name: Upload Anchore scan SARIF file
+        if: always() && steps.scan.outputs.sarif != ''
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: ${{ steps.scan.outputs.sarif }}

package/.releaserc.json

@@ -0,0 +1,50 @@
+{
+  "branches": [
+    "main",
+    {
+      "name": "improvement",
+      "prerelease": "beta"
+    },
+    {
+      "name": "development",
+      "prerelease": "alpha"
+    }
+  ],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/changelog",
+      {
+        "changelogFile": "CHANGELOG.md"
+      }
+    ],
+    "@semantic-release/npm",
+    [
+      "@semantic-release/github",
+      {
+        "assets": [
+          {
+            "path": "dist/**",
+            "label": "Distribution files"
+          },
+          {
+            "path": "docs/**",
+            "label": "Documentation"
+          }
+        ]
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": [
+          "CHANGELOG.md",
+          "package.json",
+          "package-lock.json"
+        ],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ]
+  ]
+}

package/AGENTS.md

@@ -0,0 +1,13 @@
+## Agent skills
+
+### Issue tracker
+
+Issues live in GitHub Issues (rahul05ranjan/dhruv-cli), via the `gh` CLI. See `docs/agents/issue-tracker.md`.
+
+### Triage labels
+
+Default five-role vocabulary: `needs-triage`, `needs-info`, `ready-for-agent`, `ready-for-human`, `wontfix`. See `docs/agents/triage-labels.md`.
+
+### Domain docs
+
+Single-context: one `CONTEXT.md` + `docs/adr/` at the repo root. See `docs/agents/domain.md`.

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+# [1.4.0](https://github.com/rahul05ranjan/dhruv-cli/compare/v1.4.5...v1.4.0) (2026-09-18)
+
+
+### Bug Fixes
+
+* **ci:** isolate Scorecard publishing from other security scans ([087833b](https://github.com/rahul05ranjan/dhruv-cli/commit/087833b470c2df96da54eb1f07fc5ef488106f61))
+* **ci:** repair trusted publishing and security workflows ([7f6d202](https://github.com/rahul05ranjan/dhruv-cli/commit/7f6d2028ffde96a446d6f346d0936c56fb830e61))
+* **ci:** update Anchore scanner for the current vulnerability database ([7009198](https://github.com/rahul05ranjan/dhruv-cli/commit/70091989b636878f61c741eb2b5abf21fb5df922))
 # Changelog
 
 ## [1.1.1](https://github.com/rahul05ranjan/dhruv-cli/compare/v1.1.0...v1.1.1) (2025-06-29)

package/PUBLISHING_FIX.md

@@ -0,0 +1,92 @@
+# 🔧 NPM Publishing Issue Resolution
+
+## Issue Description
+The GitHub Actions workflow was failing with:
+```
+npm ERR! 403 403 Forbidden - PUT https://registry.npmjs.org/@rahul05ranjan%2fdhruv-cli - You cannot publish over the previously published versions: 0.0.0-development.
+```
+
+## Root Cause
+The package.json had version `0.0.0-development` which already exists on NPM and cannot be republished.
+
+## Solution Applied
+
+### 1. ✅ Updated Package Version
+- Changed version from `0.0.0-development` to `1.4.0` (next logical version after `1.3.0`)
+- This avoids the conflict with existing published versions
+
+### 2. ✅ Added Semantic Release Configuration
+- Created `.releaserc.json` with proper semantic-release configuration
+- Added support for conventional commits and automated versioning
+- Installed required semantic-release plugins
+
+### 3. ✅ Improved CI/CD Workflows
+- **Modified `ci.yml`**: Removed direct npm publish to avoid conflicts
+- **Updated `release.yml`**: Enhanced with semantic-release support
+- **Created `build-publish.yml`**: New dedicated publishing workflow with version conflict detection
+
+### 4. ✅ Version Conflict Prevention
+The new `build-publish.yml` workflow includes:
+- Automatic version conflict detection
+- Smart version bumping based on commit messages
+- Support for manual version bumping
+- Proper Git tagging and GitHub releases
+
+## Current Status
+- ✅ Package version: `1.4.0` (ready for publishing)
+- ✅ Dry run successful: Package can be published without conflicts
+- ✅ All tests passing
+- ✅ Build successful
+- ✅ Linting clean
+- ✅ Documentation generated
+
+## Published Versions on NPM
+```json
+[
+  "0.0.0-development",
+  "1.0.0", "1.0.1", "1.1.0", "1.1.1", 
+  "1.1.2", "1.1.3", "1.1.4", "1.1.5", 
+  "1.1.6", "1.2.0", "1.2.1", "1.2.2", 
+  "1.2.3", "1.2.4", "1.3.0"
+]
+```
+
+## Next Steps
+1. **For immediate fix**: The package is ready to publish as version `1.4.0`
+2. **For future releases**: Use the new `build-publish.yml` workflow
+3. **For semantic releases**: Commit messages should follow conventional commits format
+
+## Workflow Recommendations
+
+### For Hotfixes/Patches
+```bash
+# Commit with conventional format
+git commit -m "fix: resolve critical issue"
+# This will trigger a patch release (1.4.1)
+```
+
+### For Features
+```bash
+# Commit with conventional format  
+git commit -m "feat: add new functionality"
+# This will trigger a minor release (1.5.0)
+```
+
+### For Breaking Changes
+```bash
+# Commit with breaking change notation
+git commit -m "feat!: major API changes
+
+BREAKING CHANGE: This changes the API structure"
+# This will trigger a major release (2.0.0)
+```
+
+## Files Modified
+- ✅ `package.json` - Updated version to 1.4.0
+- ✅ `.releaserc.json` - Added semantic-release configuration
+- ✅ `.github/workflows/ci.yml` - Removed direct publishing
+- ✅ `.github/workflows/release.yml` - Enhanced with semantic-release
+- ✅ `.github/workflows/build-publish.yml` - New intelligent publishing workflow
+- ✅ `package.json` - Added semantic-release dependencies
+
+The publishing issue is now resolved! 🎉