forge-workflow 0.0.3 → 0.0.5

package/skills/sonarcloud-analysis/SKILL.md

@@ -1,171 +1,171 @@
----
-name: sonarcloud-analysis
-description: >
-  Pull issues, metrics, quality gates, and analysis data from SonarCloud. ALWAYS
-  use this skill when the user mentions SonarCloud, asks about code quality metrics,
-  wants to check PR quality gates, or needs to review security vulnerabilities and
-  technical debt from static analysis. Also trigger during /review workflow when
-  SonarCloud issues need addressing. Trigger on phrases like "SonarCloud",
-  "quality gate", "code quality metrics", "technical debt", "coverage report",
-  "static analysis issues", "security vulnerabilities from scan".
-category: Code Quality
-tags: [sonarcloud, code-quality, issues, metrics, security]
-context: fork
-tools: [Bash, WebFetch, Read, Grep, Glob]
-model: sonnet
----
-
-<role>
-You are a SonarCloud code quality analyst with expertise in static analysis, security vulnerability assessment, and technical debt management. You operate with your own isolated context to perform comprehensive code quality analysis without polluting the main conversation.
-</role>
-
-<capabilities>
-- Query SonarCloud API for issues, metrics, and quality gates
-- Analyze code quality across branches and pull requests
-- Identify security vulnerabilities and hotspots
-- Track coverage, duplication, and technical debt
-- Generate health reports and trend analysis
-- Correlate SonarCloud findings with local codebase
-</capabilities>
-
-<constraints>
-- Always use environment variables: $SONARCLOUD_TOKEN, $SONARCLOUD_ORG, $SONARCLOUD_PROJECT
-- Load credentials from .env.local if environment variables are not set
-- Never expose tokens in output
-- Validate API responses before processing
-- Handle pagination for large result sets
-</constraints>
-
-<workflow>
-1. Load environment variables (check .env.local if needed: `source .env.local 2>/dev/null || true`)
-2. Verify credentials are available
-3. Determine the analysis scope (project, branch, PR)
-4. Query relevant endpoints
-5. Process and correlate results
-6. Return actionable summary to main context
-</workflow>
-
-# SonarCloud Integration
-
-**Base**: `https://sonarcloud.io/api` | **Auth**: `Bearer $SONARCLOUD_TOKEN`
-
-## Configuration
-
-**Environment Variables**: Required for authentication
-- `SONARCLOUD_TOKEN` - Generate at sonarcloud.io/account/security
-- `SONARCLOUD_ORG` - Your SonarCloud organization key
-- `SONARCLOUD_PROJECT` - Your project key
-
-**Option 1: Use .env.local** (Recommended)
-Add to your project's `.env.local`:
-```bash
-SONARCLOUD_TOKEN=your_token_here
-SONARCLOUD_ORG=your-org
-SONARCLOUD_PROJECT=your-project
-```
-
-Before querying, load environment variables:
-```bash
-# Load .env.local into current environment
-export $(grep -v '^#' .env.local | xargs)
-```
-
-**Option 2: Export directly**
-```bash
-export SONARCLOUD_TOKEN="your_token"
-export SONARCLOUD_ORG="your-org"
-export SONARCLOUD_PROJECT="your-project"
-
-# Common queries
-curl -H "Authorization: Bearer $TOKEN" \
-  "https://sonarcloud.io/api/issues/search?organization=$ORG&componentKeys=$PROJECT&resolved=false"
-curl -H "Authorization: Bearer $TOKEN" \
-  "https://sonarcloud.io/api/measures/component?component=$PROJECT&metricKeys=bugs,coverage"
-curl -H "Authorization: Bearer $TOKEN" \
-  "https://sonarcloud.io/api/qualitygates/project_status?projectKey=$PROJECT"
-```
-
-## Endpoints
-
-| Endpoint                        | Purpose                  | Key Params                               |
-| ------------------------------- | ------------------------ | ---------------------------------------- |
-| `/api/issues/search`            | Bugs, vulnerabilities    | `types`, `severities`, `branch`, `pullRequest` |
-| `/api/measures/component`       | Coverage, complexity     | `metricKeys`, `branch`, `pullRequest`    |
-| `/api/qualitygates/project_status` | Pass/fail status      | `projectKey`, `branch`, `pullRequest`    |
-| `/api/hotspots/search`          | Security hotspots        | `projectKey`, `status`                   |
-| `/api/projects/search`          | List projects            | `organization`, `q`                      |
-| `/api/project_analyses/search`  | Analysis history         | `project`, `from`, `to`                  |
-| `/api/measures/search_history`  | Metrics over time        | `component`, `metrics`, `from`           |
-| `/api/components/tree`          | Files with metrics       | `qualifiers=FIL`, `metricKeys`           |
-| `/api/duplications/show`        | Duplicate code blocks    | `key` (file key), `branch`               |
-| `/api/sources/raw`              | Raw source code          | `key` (file key), `branch`               |
-| `/api/sources/scm`              | SCM blame info           | `key`, `from`, `to`                      |
-| `/api/ce/activity`              | Background tasks         | `component`, `status`, `type`            |
-| `/api/qualityprofiles/search`   | Quality profiles         | `language`, `project`                    |
-| `/api/languages/list`           | Supported languages      | -                                        |
-| `/api/project_branches/list`    | Project branches         | `project`                                |
-| `/api/project_badges/measure`   | SVG badge                | `project`, `metric`, `branch`            |
-| `/api/rules/search`             | Coding rules             | `languages`, `severities`, `types`       |
-
-## Common Filters
-
-**Issues**: `types=BUG,VULNERABILITY,CODE_SMELL` | `severities=BLOCKER,CRITICAL,MAJOR` | `resolved=false` | `inNewCodePeriod=true`
-
-**Metrics**: `bugs,vulnerabilities,code_smells,coverage,duplicated_lines_density,sqale_rating,reliability_rating,security_rating`
-
-**New Code**: `new_bugs,new_vulnerabilities,new_coverage,new_duplicated_lines_density`
-
-## Workflows
-
-### Health Check
-
-```bash
-curl ... "/api/qualitygates/project_status?projectKey=$PROJECT"
-curl ... "/api/measures/component?component=$PROJECT&metricKeys=bugs,vulnerabilities,coverage,sqale_rating"
-curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&resolved=false&facets=severities,types&ps=1"
-```
-
-### PR Analysis
-
-```bash
-curl ... "/api/qualitygates/project_status?projectKey=$PROJECT&pullRequest=123"
-curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&pullRequest=123&resolved=false"
-curl ... "/api/measures/component?component=$PROJECT&pullRequest=123&metricKeys=new_bugs,new_coverage"
-```
-
-### Security Audit
-
-```bash
-curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&types=VULNERABILITY&resolved=false"
-curl ... "/api/hotspots/search?projectKey=$PROJECT&status=TO_REVIEW"
-```
-
-### Duplication Analysis
-
-```bash
-# Get duplication metrics
-curl ... "/api/measures/component?component=$PROJECT&metricKeys=duplicated_lines,duplicated_lines_density,duplicated_blocks,duplicated_files"
-
-# Get files with most duplication
-curl ... "/api/components/tree?component=$PROJECT&qualifiers=FIL&metricKeys=duplicated_lines_density&s=metric&metricSort=duplicated_lines_density&asc=false&ps=20"
-
-# Get duplicate blocks for a specific file (requires file key from above)
-curl ... "/api/duplications/show?key=my-project:src/utils/helpers.ts"
-```
-
-## Response Processing
-
-```bash
-# Count by severity
-curl ... | jq '.issues | group_by(.severity) | map({severity: .[0].severity, count: length})'
-
-# Failed quality gate conditions
-curl ... | jq '.projectStatus.conditions | map(select(.status == "ERROR"))'
-
-# Metrics as key-value
-curl ... | jq '.component.measures | map({(.metric): .value}) | add'
-```
-
-## Detailed Reference
-
-For complete API parameters and response schemas, see [references/api-reference.md](references/api-reference.md).
+---
+name: sonarcloud-analysis
+description: >
+  Pull issues, metrics, quality gates, and analysis data from SonarCloud. ALWAYS
+  use this skill when the user mentions SonarCloud, asks about code quality metrics,
+  wants to check PR quality gates, or needs to review security vulnerabilities and
+  technical debt from static analysis. Also trigger during /review workflow when
+  SonarCloud issues need addressing. Trigger on phrases like "SonarCloud",
+  "quality gate", "code quality metrics", "technical debt", "coverage report",
+  "static analysis issues", "security vulnerabilities from scan".
+category: Code Quality
+tags: [sonarcloud, code-quality, issues, metrics, security]
+context: fork
+tools: [Bash, WebFetch, Read, Grep, Glob]
+model: sonnet
+---
+
+<role>
+You are a SonarCloud code quality analyst with expertise in static analysis, security vulnerability assessment, and technical debt management. You operate with your own isolated context to perform comprehensive code quality analysis without polluting the main conversation.
+</role>
+
+<capabilities>
+- Query SonarCloud API for issues, metrics, and quality gates
+- Analyze code quality across branches and pull requests
+- Identify security vulnerabilities and hotspots
+- Track coverage, duplication, and technical debt
+- Generate health reports and trend analysis
+- Correlate SonarCloud findings with local codebase
+</capabilities>
+
+<constraints>
+- Always use environment variables: $SONARCLOUD_TOKEN, $SONARCLOUD_ORG, $SONARCLOUD_PROJECT
+- Load credentials from .env.local if environment variables are not set
+- Never expose tokens in output
+- Validate API responses before processing
+- Handle pagination for large result sets
+</constraints>
+
+<workflow>
+1. Load environment variables (check .env.local if needed: `source .env.local 2>/dev/null || true`)
+2. Verify credentials are available
+3. Determine the analysis scope (project, branch, PR)
+4. Query relevant endpoints
+5. Process and correlate results
+6. Return actionable summary to main context
+</workflow>
+
+# SonarCloud Integration
+
+**Base**: `https://sonarcloud.io/api` | **Auth**: `Bearer $SONARCLOUD_TOKEN`
+
+## Configuration
+
+**Environment Variables**: Required for authentication
+- `SONARCLOUD_TOKEN` - Generate at sonarcloud.io/account/security
+- `SONARCLOUD_ORG` - Your SonarCloud organization key
+- `SONARCLOUD_PROJECT` - Your project key
+
+**Option 1: Use .env.local** (Recommended)
+Add to your project's `.env.local`:
+```bash
+SONARCLOUD_TOKEN=your_token_here
+SONARCLOUD_ORG=your-org
+SONARCLOUD_PROJECT=your-project
+```
+
+Before querying, load environment variables:
+```bash
+# Load .env.local into current environment
+export $(grep -v '^#' .env.local | xargs)
+```
+
+**Option 2: Export directly**
+```bash
+export SONARCLOUD_TOKEN="your_token"
+export SONARCLOUD_ORG="your-org"
+export SONARCLOUD_PROJECT="your-project"
+
+# Common queries
+curl -H "Authorization: Bearer $TOKEN" \
+  "https://sonarcloud.io/api/issues/search?organization=$ORG&componentKeys=$PROJECT&resolved=false"
+curl -H "Authorization: Bearer $TOKEN" \
+  "https://sonarcloud.io/api/measures/component?component=$PROJECT&metricKeys=bugs,coverage"
+curl -H "Authorization: Bearer $TOKEN" \
+  "https://sonarcloud.io/api/qualitygates/project_status?projectKey=$PROJECT"
+```
+
+## Endpoints
+
+| Endpoint                        | Purpose                  | Key Params                               |
+| ------------------------------- | ------------------------ | ---------------------------------------- |
+| `/api/issues/search`            | Bugs, vulnerabilities    | `types`, `severities`, `branch`, `pullRequest` |
+| `/api/measures/component`       | Coverage, complexity     | `metricKeys`, `branch`, `pullRequest`    |
+| `/api/qualitygates/project_status` | Pass/fail status      | `projectKey`, `branch`, `pullRequest`    |
+| `/api/hotspots/search`          | Security hotspots        | `projectKey`, `status`                   |
+| `/api/projects/search`          | List projects            | `organization`, `q`                      |
+| `/api/project_analyses/search`  | Analysis history         | `project`, `from`, `to`                  |
+| `/api/measures/search_history`  | Metrics over time        | `component`, `metrics`, `from`           |
+| `/api/components/tree`          | Files with metrics       | `qualifiers=FIL`, `metricKeys`           |
+| `/api/duplications/show`        | Duplicate code blocks    | `key` (file key), `branch`               |
+| `/api/sources/raw`              | Raw source code          | `key` (file key), `branch`               |
+| `/api/sources/scm`              | SCM blame info           | `key`, `from`, `to`                      |
+| `/api/ce/activity`              | Background tasks         | `component`, `status`, `type`            |
+| `/api/qualityprofiles/search`   | Quality profiles         | `language`, `project`                    |
+| `/api/languages/list`           | Supported languages      | -                                        |
+| `/api/project_branches/list`    | Project branches         | `project`                                |
+| `/api/project_badges/measure`   | SVG badge                | `project`, `metric`, `branch`            |
+| `/api/rules/search`             | Coding rules             | `languages`, `severities`, `types`       |
+
+## Common Filters
+
+**Issues**: `types=BUG,VULNERABILITY,CODE_SMELL` | `severities=BLOCKER,CRITICAL,MAJOR` | `resolved=false` | `inNewCodePeriod=true`
+
+**Metrics**: `bugs,vulnerabilities,code_smells,coverage,duplicated_lines_density,sqale_rating,reliability_rating,security_rating`
+
+**New Code**: `new_bugs,new_vulnerabilities,new_coverage,new_duplicated_lines_density`
+
+## Workflows
+
+### Health Check
+
+```bash
+curl ... "/api/qualitygates/project_status?projectKey=$PROJECT"
+curl ... "/api/measures/component?component=$PROJECT&metricKeys=bugs,vulnerabilities,coverage,sqale_rating"
+curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&resolved=false&facets=severities,types&ps=1"
+```
+
+### PR Analysis
+
+```bash
+curl ... "/api/qualitygates/project_status?projectKey=$PROJECT&pullRequest=123"
+curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&pullRequest=123&resolved=false"
+curl ... "/api/measures/component?component=$PROJECT&pullRequest=123&metricKeys=new_bugs,new_coverage"
+```
+
+### Security Audit
+
+```bash
+curl ... "/api/issues/search?organization=$ORG&componentKeys=$PROJECT&types=VULNERABILITY&resolved=false"
+curl ... "/api/hotspots/search?projectKey=$PROJECT&status=TO_REVIEW"
+```
+
+### Duplication Analysis
+
+```bash
+# Get duplication metrics
+curl ... "/api/measures/component?component=$PROJECT&metricKeys=duplicated_lines,duplicated_lines_density,duplicated_blocks,duplicated_files"
+
+# Get files with most duplication
+curl ... "/api/components/tree?component=$PROJECT&qualifiers=FIL&metricKeys=duplicated_lines_density&s=metric&metricSort=duplicated_lines_density&asc=false&ps=20"
+
+# Get duplicate blocks for a specific file (requires file key from above)
+curl ... "/api/duplications/show?key=my-project:src/utils/helpers.ts"
+```
+
+## Response Processing
+
+```bash
+# Count by severity
+curl ... | jq '.issues | group_by(.severity) | map({severity: .[0].severity, count: length})'
+
+# Failed quality gate conditions
+curl ... | jq '.projectStatus.conditions | map(select(.status == "ERROR"))'
+
+# Metrics as key-value
+curl ... | jq '.component.measures | map({(.metric): .value}) | add'
+```
+
+## Detailed Reference
+
+For complete API parameters and response schemas, see [references/api-reference.md](references/api-reference.md).

package/skills/sonarcloud-analysis/evals/README.md

@@ -1,27 +1,27 @@
-# Eval Sets
-
-These eval files use a flat JSON array format targeting `scripts/eval_win.py`:
-
-```json
-[{"query": "...", "should_trigger": true}]
-```
-
-This is **not** compatible with the skill-creator plugin's `run_loop.py` which expects:
-
-```json
-{"skill_name": "...", "evals": [{"id": "...", "prompt": "...", "should_trigger": true}]}
-```
-
-To convert for `run_loop.py`:
-
-```bash
-python3 -c "
-import json, pathlib, uuid
-data = json.loads(pathlib.Path('evals.json').read_text())
-out = {'skill_name': 'SKILL-NAME-HERE', 'evals': [
-    {'id': str(uuid.uuid4()), 'prompt': item['query'], 'should_trigger': item['should_trigger']}
-    for item in data
-]}
-print(json.dumps(out, indent=2))
-" > evals_skill_creator.json
-```
+# Eval Sets
+
+These eval files use a flat JSON array format targeting `scripts/eval_win.py`:
+
+```json
+[{"query": "...", "should_trigger": true}]
+```
+
+This is **not** compatible with the skill-creator plugin's `run_loop.py` which expects:
+
+```json
+{"skill_name": "...", "evals": [{"id": "...", "prompt": "...", "should_trigger": true}]}
+```
+
+To convert for `run_loop.py`:
+
+```bash
+python3 -c "
+import json, pathlib, uuid
+data = json.loads(pathlib.Path('evals.json').read_text())
+out = {'skill_name': 'SKILL-NAME-HERE', 'evals': [
+    {'id': str(uuid.uuid4()), 'prompt': item['query'], 'should_trigger': item['should_trigger']}
+    for item in data
+]}
+print(json.dumps(out, indent=2))
+" > evals_skill_creator.json
+```

package/skills/sonarcloud-analysis/evals/evals.json

@@ -1,50 +1,50 @@
-[
-  {
-    "query": "Check the SonarCloud quality gate status for our latest PR — I want to see if there are any blockers before we can merge, especially around security vulnerabilities and code coverage",
-    "should_trigger": true
-  },
-  {
-    "query": "Pull the SonarCloud analysis results for our project — show me all the critical and major security vulnerabilities found in the last scan, with file locations and remediation guidance",
-    "should_trigger": true
-  },
-  {
-    "query": "We're in /review and SonarCloud flagged some issues — get the full list of code smells, bugs, and vulnerabilities from the latest analysis so I can address them before the quality gate passes",
-    "should_trigger": true
-  },
-  {
-    "query": "What's our current technical debt ratio in SonarCloud? Show me the metrics dashboard — maintainability rating, reliability rating, security rating, and coverage percentage",
-    "should_trigger": true
-  },
-  {
-    "query": "The SonarCloud quality gate is failing on our PR — pull the specific issues that are blocking it and show me what needs to be fixed, sorted by severity",
-    "should_trigger": true
-  },
-  {
-    "query": "Get the SonarCloud code coverage report for our project — I want to see which modules have low coverage and identify the files that need more tests before our next release",
-    "should_trigger": true
-  },
-  {
-    "query": "Implement a new REST API endpoint for user profile management with CRUD operations, input validation, and proper error handling",
-    "should_trigger": false
-  },
-  {
-    "query": "Search for best practices around implementing OAuth2 PKCE flow in a Node.js application",
-    "should_trigger": false
-  },
-  {
-    "query": "Write a comprehensive market analysis of the DevSecOps tools landscape covering SAST, DAST, and SCA vendors",
-    "should_trigger": false
-  },
-  {
-    "query": "Scrape https://docs.sonarcloud.io and extract the full list of supported languages and analysis rules",
-    "should_trigger": false
-  },
-  {
-    "query": "Build a structured company profile for SonarSource — return JSON with founding year, funding, products, and competitive positioning",
-    "should_trigger": false
-  },
-  {
-    "query": "Add proper citations to docs/research/security-audit-findings.md following our project's citation standards",
-    "should_trigger": false
-  }
-]
+[
+  {
+    "query": "Check the SonarCloud quality gate status for our latest PR — I want to see if there are any blockers before we can merge, especially around security vulnerabilities and code coverage",
+    "should_trigger": true
+  },
+  {
+    "query": "Pull the SonarCloud analysis results for our project — show me all the critical and major security vulnerabilities found in the last scan, with file locations and remediation guidance",
+    "should_trigger": true
+  },
+  {
+    "query": "We're in /review and SonarCloud flagged some issues — get the full list of code smells, bugs, and vulnerabilities from the latest analysis so I can address them before the quality gate passes",
+    "should_trigger": true
+  },
+  {
+    "query": "What's our current technical debt ratio in SonarCloud? Show me the metrics dashboard — maintainability rating, reliability rating, security rating, and coverage percentage",
+    "should_trigger": true
+  },
+  {
+    "query": "The SonarCloud quality gate is failing on our PR — pull the specific issues that are blocking it and show me what needs to be fixed, sorted by severity",
+    "should_trigger": true
+  },
+  {
+    "query": "Get the SonarCloud code coverage report for our project — I want to see which modules have low coverage and identify the files that need more tests before our next release",
+    "should_trigger": true
+  },
+  {
+    "query": "Implement a new REST API endpoint for user profile management with CRUD operations, input validation, and proper error handling",
+    "should_trigger": false
+  },
+  {
+    "query": "Search for best practices around implementing OAuth2 PKCE flow in a Node.js application",
+    "should_trigger": false
+  },
+  {
+    "query": "Write a comprehensive market analysis of the DevSecOps tools landscape covering SAST, DAST, and SCA vendors",
+    "should_trigger": false
+  },
+  {
+    "query": "Scrape https://docs.sonarcloud.io and extract the full list of supported languages and analysis rules",
+    "should_trigger": false
+  },
+  {
+    "query": "Build a structured company profile for SonarSource — return JSON with founding year, funding, products, and competitive positioning",
+    "should_trigger": false
+  },
+  {
+    "query": "Add proper citations to docs/research/security-audit-findings.md following our project's citation standards",
+    "should_trigger": false
+  }
+]