aidevops 2.52.1

package/.agent/tools/code-review/auditing.md

@@ -0,0 +1,383 @@
+---
+description: Code auditing services and security analysis
+mode: subagent
+tools:
+  read: true
+  write: false
+  edit: false
+  bash: true
+  glob: true
+  grep: true
+  webfetch: true
+  task: true
+---
+
+# Code Auditing Services Guide
+
+<!-- AI-CONTEXT-START -->
+
+## Quick Reference
+
+- **Helper**: `.agent/scripts/code-audit-helper.sh`
+- **Services**: CodeRabbit (AI reviews), CodeFactor (quality), Codacy (enterprise), SonarCloud (security)
+- **Config**: `configs/code-audit-config.json`
+- **Commands**: `services` | `audit [repo]` | `report [repo] [file]` | `start-mcp [service] [port]`
+- **MCP Ports**: CodeRabbit (3003), Codacy (3004), SonarCloud (3005)
+- **Quality Gates**: 80% coverage, 0 major bugs, 0 high vulnerabilities, <3% duplication
+- **Service Commands**: `coderabbit-repos`, `codacy-repos`, `sonarcloud-projects`, `codefactor-repos`
+- **CI/CD**: GitHub Actions integration with quality gate enforcement
+<!-- AI-CONTEXT-END -->
+
+Comprehensive code quality and security auditing across multiple platforms including CodeRabbit, CodeFactor, Codacy, and SonarCloud with AI assistant integration.
+
+## Services Overview
+
+### **Supported Code Auditing Services:**
+
+#### **CodeRabbit**
+
+- **Focus**: AI-powered code reviews and analysis
+- **Strengths**: Context-aware reviews, security analysis, best practices
+- **API**: Comprehensive REST API with MCP integration
+- **Use Case**: Automated code reviews and quality analysis
+
+#### **CodeFactor**
+
+- **Focus**: Automated code quality analysis
+- **Strengths**: Simple setup, clear metrics, GitHub integration
+- **API**: REST API for repository and issue management
+- **Use Case**: Continuous code quality monitoring
+
+#### **Codacy**
+
+- **Focus**: Automated code quality and security analysis
+- **Strengths**: Comprehensive metrics, team collaboration, custom rules
+- **API**: Full REST API with MCP server support
+- **Use Case**: Enterprise code quality management
+
+#### **SonarCloud**
+
+- **Focus**: Code quality and security analysis
+- **Strengths**: Industry standard, comprehensive rules, quality gates
+- **API**: Extensive web API with MCP integration
+- **Use Case**: Professional code quality and security analysis
+
+## Configuration
+
+### **Setup Configuration:**
+
+```bash
+# Copy template
+cp configs/code-audit-config.json.txt configs/code-audit-config.json
+
+# Edit with your service API tokens
+```
+
+### **Multi-Service Configuration:**
+
+```json
+{
+  "services": {
+    "coderabbit": {
+      "accounts": {
+        "personal": {
+          "api_token": "YOUR_CODERABBIT_API_TOKEN_HERE",
+          "base_url": "https://api.coderabbit.ai/v1",
+          "organization": "your-github-username"
+        }
+      }
+    },
+    "codacy": {
+      "accounts": {
+        "organization": {
+          "api_token": "YOUR_CODACY_API_TOKEN_HERE",
+          "base_url": "https://app.codacy.com/api/v3",
+          "organization": "your-organization"
+        }
+      }
+    }
+  }
+}
+```
+
+## Usage Examples
+
+### **Basic Commands:**
+
+```bash
+# List all configured services
+./.agent/scripts/code-audit-helper.sh services
+
+# Run comprehensive audit across all services
+./.agent/scripts/code-audit-helper.sh audit my-repository
+
+# Generate detailed audit report
+./.agent/scripts/code-audit-helper.sh report my-repository audit-report.json
+```
+
+### **CodeRabbit Operations:**
+
+```bash
+# List CodeRabbit repositories
+./.agent/scripts/code-audit-helper.sh coderabbit-repos personal
+
+# Get analysis for repository
+./.agent/scripts/code-audit-helper.sh coderabbit-analysis personal repo-id
+
+# Start CodeRabbit MCP server
+./.agent/scripts/code-audit-helper.sh start-mcp coderabbit 3003
+```
+
+### **CodeFactor Operations:**
+
+```bash
+# List CodeFactor repositories
+./.agent/scripts/code-audit-helper.sh codefactor-repos personal
+
+# Get issues for repository
+./.agent/scripts/code-audit-helper.sh codefactor-issues personal my-repo
+
+# Check repository grade
+curl -H "X-CF-TOKEN: $API_TOKEN" https://www.codefactor.io/api/v1/repositories/my-repo
+```
+
+### **Codacy Operations:**
+
+```bash
+# List Codacy repositories
+./.agent/scripts/code-audit-helper.sh codacy-repos organization
+
+# Get quality overview
+./.agent/scripts/code-audit-helper.sh codacy-quality organization my-repo
+
+# Start Codacy MCP server
+./.agent/scripts/code-audit-helper.sh start-mcp codacy 3004
+```
+
+### **SonarCloud Operations:**
+
+```bash
+# List SonarCloud projects
+./.agent/scripts/code-audit-helper.sh sonarcloud-projects personal
+
+# Get project measures
+./.agent/scripts/code-audit-helper.sh sonarcloud-measures personal project-key
+
+# Start SonarCloud MCP server
+./.agent/scripts/code-audit-helper.sh start-mcp sonarcloud 3005
+```
+
+## Security Best Practices
+
+### **API Security:**
+
+- **Token management**: Store API tokens securely
+- **Scope limitation**: Use tokens with minimal required permissions
+- **Regular rotation**: Rotate API tokens regularly
+- **Access monitoring**: Monitor API usage and access patterns
+- **Rate limiting**: Respect service rate limits
+
+### **Code Security:**
+
+```bash
+# Regular security audits
+./.agent/scripts/code-audit-helper.sh audit my-repository
+
+# Monitor for security vulnerabilities
+# Check SonarCloud security hotspots
+./.agent/scripts/code-audit-helper.sh sonarcloud-measures personal project-key
+
+# Review Codacy security issues
+./.agent/scripts/code-audit-helper.sh codacy-quality organization my-repo
+```
+
+## Quality Gates & Metrics
+
+### **Key Quality Metrics:**
+
+- **Code Coverage**: Minimum 80%, target 90%
+- **Code Smells**: Maximum 10 major issues
+- **Security Hotspots**: Zero high-severity issues
+- **Bugs**: Zero major bugs
+- **Vulnerabilities**: Zero high-severity vulnerabilities
+- **Duplicated Lines**: Maximum 3% duplication
+
+### **Quality Gate Configuration:**
+
+```json
+{
+  "quality_gates": {
+    "code_coverage": {
+      "minimum": 80,
+      "target": 90,
+      "fail_build": true
+    },
+    "security_hotspots": {
+      "maximum": 0,
+      "severity": "high",
+      "fail_build": true
+    }
+  }
+}
+```
+
+## MCP Integration
+
+### **Available MCP Servers:**
+
+#### **CodeRabbit MCP:**
+
+```bash
+# Start CodeRabbit MCP server
+./.agent/scripts/code-audit-helper.sh start-mcp coderabbit 3003
+
+# Configure in AI assistant
+{
+  "coderabbit": {
+    "command": "coderabbit-mcp-server",
+    "args": ["--port", "3003"],
+    "env": {
+      "CODERABBIT_API_TOKEN": "your-token"
+    }
+  }
+}
+```
+
+#### **Codacy MCP:**
+
+```bash
+# Install Codacy MCP server
+# https://github.com/codacy/codacy-mcp-server
+
+# Start server
+./.agent/scripts/code-audit-helper.sh start-mcp codacy 3004
+```
+
+#### **SonarCloud MCP:**
+
+```bash
+# Install SonarQube MCP server
+# https://github.com/SonarSource/sonarqube-mcp-server
+
+# Start server
+./.agent/scripts/code-audit-helper.sh start-mcp sonarcloud 3005
+```
+
+### **AI Assistant Capabilities:**
+
+With MCP integration, AI assistants can:
+
+- **Real-time code analysis** during development
+- **Automated quality reports** generation
+- **Security vulnerability** detection and reporting
+- **Code review assistance** with context-aware suggestions
+- **Quality trend analysis** over time
+- **Automated issue prioritization** based on severity
+
+## CI/CD Integration
+
+### **GitHub Actions Integration:**
+
+```yaml
+name: Code Quality Audit
+on: [push, pull_request]
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Run Code Audit
+        run: |
+          ./.agent/scripts/code-audit-helper.sh audit ${{ github.repository }}
+          ./.agent/scripts/code-audit-helper.sh report ${{ github.repository }} audit-report.json
+      - name: Upload Report
+        uses: actions/upload-artifact@v3
+        with:
+          name: audit-report
+          path: audit-report.json
+```
+
+### **Quality Gate Enforcement:**
+
+```bash
+#!/bin/bash
+# Quality gate script for CI/CD
+REPO_NAME="$1"
+REPORT_FILE="audit-report-$(date +%Y%m%d-%H%M%S).json"
+
+# Run comprehensive audit
+./.agent/scripts/code-audit-helper.sh audit "$REPO_NAME"
+./.agent/scripts/code-audit-helper.sh report "$REPO_NAME" "$REPORT_FILE"
+
+# Check quality gates
+COVERAGE=$(jq -r '.coverage' "$REPORT_FILE")
+BUGS=$(jq -r '.bugs' "$REPORT_FILE")
+VULNERABILITIES=$(jq -r '.vulnerabilities' "$REPORT_FILE")
+
+# Fail build if quality gates not met
+if (( $(echo "$COVERAGE < 80" | bc -l) )); then
+    echo "❌ Coverage below 80%: $COVERAGE%"
+    exit 1
+fi
+
+if (( BUGS > 0 )); then
+    echo "❌ Bugs found: $BUGS"
+    exit 1
+fi
+
+if (( VULNERABILITIES > 0 )); then
+    echo "❌ Vulnerabilities found: $VULNERABILITIES"
+    exit 1
+fi
+
+echo "✅ All quality gates passed"
+```
+
+## Best Practices
+
+### **Code Quality Management:**
+
+1. **Consistent standards**: Apply consistent quality standards across projects
+2. **Regular monitoring**: Monitor code quality metrics continuously
+3. **Team education**: Educate team on quality best practices
+4. **Automated enforcement**: Use quality gates to enforce standards
+5. **Continuous improvement**: Regularly review and improve quality processes
+
+### **Security Analysis:**
+
+- **Regular scans**: Run security scans on every commit
+- **Vulnerability tracking**: Track and remediate vulnerabilities promptly
+- **Dependency scanning**: Monitor dependencies for security issues
+- **Secret detection**: Scan for accidentally committed secrets
+- **Compliance monitoring**: Monitor compliance with security standards
+
+### **Automation Strategies:**
+
+- **CI/CD integration**: Integrate quality checks into CI/CD pipelines
+- **Automated reporting**: Generate automated quality reports
+- **Issue tracking**: Automatically create issues for quality problems
+- **Notification systems**: Set up notifications for quality gate failures
+- **Trend analysis**: Analyze quality trends over time
+
+## AI Assistant Integration
+
+### **Automated Code Quality:**
+
+- **Real-time analysis**: AI can analyze code quality in real-time
+- **Intelligent prioritization**: AI can prioritize issues by impact
+- **Automated fixes**: AI can suggest or implement automated fixes
+- **Quality coaching**: AI can provide quality improvement guidance
+- **Trend prediction**: AI can predict quality trends and issues
+
+### **Development Workflows:**
+
+- **Code review assistance**: AI-powered code review suggestions
+- **Quality gate automation**: Automated quality gate enforcement
+- **Issue resolution**: AI-assisted issue resolution and fixes
+- **Documentation generation**: Automated quality documentation
+- **Team reporting**: Automated team quality reports and insights
+
+---
+
+**The code auditing framework provides comprehensive code quality and security analysis across multiple platforms with AI assistant integration for automated DevOps workflows.**

package/.agent/tools/code-review/automation.md

@@ -0,0 +1,219 @@
+---
+description: Automated quality checks and CI/CD integration
+mode: subagent
+tools:
+  read: true
+  write: true
+  edit: true
+  bash: true
+  glob: true
+  grep: true
+  webfetch: false
+  task: true
+---
+
+# Quality Automation Guide
+
+<!-- AI-CONTEXT-START -->
+
+## Quick Reference
+
+- Master script: `bash .agent/scripts/linters-local.sh` (multi-platform validation)
+- Fix script: `bash .agent/scripts/quality-fix.sh [file|dir]`
+- SonarCloud rules: S7679 (positional params), S1481 (unused vars), S1192 (strings), S7682 (returns)
+- Specialized fixes:
+  - `fix-content-type.sh` - Content-Type header constants
+  - `fix-auth-headers.sh` - Authorization header patterns
+  - `fix-error-messages.sh` - Error message consolidation
+  - `markdown-formatter.sh` - Markdown linting/formatting
+- CLI manager: `bash .agent/scripts/quality-cli-manager.sh install|analyze|status all`
+- Platform CLIs: CodeRabbit, Codacy, SonarScanner
+- Achievement: 349 -> 42 issues (88% reduction), A-grade platforms
+<!-- AI-CONTEXT-END -->
+
+## Comprehensive Quality Management Tools
+
+> **Note**: This document is supplementary to the [AGENTS.md](../AGENTS.md).
+> For any conflicts, the Master Guide takes precedence as the single source of truth.
+
+### Overview
+
+This guide provides detailed documentation of our quality automation tools and their usage patterns.
+
+### Core Quality Scripts
+
+#### linters-local.sh - Master Quality Validator
+
+**Purpose**: Comprehensive multi-platform quality validation
+**Usage**: `bash .agent/scripts/linters-local.sh`
+
+**Checks Performed**:
+
+- SonarCloud issue analysis (S7679, S1481, S1192, S7682)
+- ShellCheck compliance validation
+- Return statement verification
+- Positional parameter detection
+- String literal duplication analysis
+
+**Output**: Color-coded quality report with actionable recommendations
+
+#### quality-fix.sh - Universal Issue Resolution
+
+**Purpose**: Automated fixing of common quality issues
+**Usage**: `bash .agent/scripts/quality-fix.sh [file|directory]`
+
+**Fixes Applied**:
+
+- Missing return statements in functions
+- Positional parameter usage patterns
+- Basic ShellCheck compliance issues
+- Function structure standardization
+
+### Specialized Fix Scripts
+
+#### String Literal Management
+
+**fix-content-type.sh**: Content-Type header consolidation
+
+- Targets: `"Content-Type: application/json"` (24+ occurrences)
+- Creates: `readonly CONTENT_TYPE_JSON` constants
+- Result: Eliminates S1192 violations for HTTP headers
+
+**fix-auth-headers.sh**: Authorization header standardization
+
+- Targets: `"Authorization: Bearer"` patterns
+- Creates: `readonly AUTH_BEARER_PREFIX` constants
+- Result: Consistent API authentication patterns
+
+**fix-error-messages.sh**: Error message consolidation
+
+- Targets: Common error patterns (`Unknown command:`, `Usage:`)
+- Creates: Error message constants
+- Result: Standardized user experience
+
+#### Markdown Quality Tools
+
+**markdown-formatter.sh**: Comprehensive markdown formatting
+
+- Fixes: Trailing whitespace, list markers, emphasis
+- Addresses: Codacy markdown formatting violations
+- Result: Professional documentation standards
+
+**markdown-lint-fix.sh**: Professional markdown linting
+
+- Integration: markdownlint-cli with auto-install
+- Configuration: Optimized .markdownlint.json
+- Result: Industry-standard markdown compliance
+
+### Quality CLI Integration
+
+#### Multi-Platform Analysis
+
+**quality-cli-manager.sh**: Unified CLI management
+
+```bash
+# Install all quality CLIs
+bash .agent/scripts/quality-cli-manager.sh install all
+
+# Run comprehensive analysis
+bash .agent/scripts/quality-cli-manager.sh analyze all
+
+# Check status of all platforms
+bash .agent/scripts/quality-cli-manager.sh status all
+```
+
+#### Individual Platform CLIs
+
+**CodeRabbit CLI**: AI-powered code review
+
+```bash
+bash .agent/scripts/coderabbit-cli.sh review
+bash .agent/scripts/coderabbit-cli.sh analyze .agent/scripts/
+```
+
+**Codacy CLI v2**: Comprehensive static analysis
+
+```bash
+bash .agent/scripts/codacy-cli.sh analyze
+bash .agent/scripts/codacy-cli.sh upload results.sarif
+```
+
+**SonarScanner CLI**: SonarCloud integration
+
+```bash
+bash .agent/scripts/sonarscanner-cli.sh analyze
+```
+
+### Automation Workflows
+
+#### Pre-Commit Quality Gate
+
+```bash
+#!/bin/bash
+# Run before every commit
+
+# 1. Comprehensive quality check
+bash .agent/scripts/linters-local.sh
+
+# 2. Fix common issues
+bash .agent/scripts/quality-fix.sh .
+
+# 3. Format markdown
+bash .agent/scripts/markdown-formatter.sh .
+
+# 4. Verify improvements
+bash .agent/scripts/linters-local.sh
+```
+
+#### Continuous Quality Monitoring
+
+```bash
+#!/bin/bash
+# Daily quality monitoring
+
+# 1. Multi-platform analysis
+bash .agent/scripts/quality-cli-manager.sh analyze all
+
+# 2. Generate quality report
+bash .agent/scripts/linters-local.sh > quality-report.txt
+
+# 3. Track progress
+echo "$(date): $(grep 'SonarCloud:' quality-report.txt)" >> quality-history.log
+```
+
+### Quality Metrics & Targets
+
+#### Current Achievement
+
+- **SonarCloud**: 349 → 42 issues (88% reduction)
+- **Critical Issues**: S7679 & S1481 = 0 (100% resolved)
+- **String Literals**: 50+ S1192 violations eliminated
+- **Platform Ratings**: A-grade across CodeFactor, Codacy
+
+#### Target Thresholds
+
+```bash
+# linters-local.sh thresholds
+readonly MAX_TOTAL_ISSUES=100
+readonly MAX_RETURN_ISSUES=0
+readonly MAX_POSITIONAL_ISSUES=0
+readonly MAX_STRING_LITERAL_ISSUES=0
+```
+
+### Best Practices
+
+#### Issue Resolution Priority
+
+1. **Critical (S7679, S1481)**: Immediate resolution required
+2. **High (S1192)**: Target 3+ occurrences for maximum impact
+3. **Medium (S7682)**: Systematic function standardization
+4. **Low (ShellCheck)**: Style and best practice improvements
+
+#### Automation Principles
+
+- **Batch Processing**: Target similar patterns across multiple files
+- **Functionality Preservation**: Never remove features to fix issues
+- **Reusable Tools**: Create scripts for recurring patterns
+- **Validation**: Always verify fixes don't break functionality
+
+This automation ecosystem enables systematic maintenance of zero technical debt while enhancing code quality and functionality.