mjolnir-qa 3.0.0 → 4.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +360 -6
- package/README.ar.md +58 -29
- package/README.bn.md +58 -29
- package/README.br.md +58 -29
- package/README.bs.md +58 -29
- package/README.da.md +59 -30
- package/README.de.md +59 -30
- package/README.es.md +58 -29
- package/README.fr.md +59 -30
- package/README.gr.md +58 -29
- package/README.he.md +58 -29
- package/README.it.md +58 -29
- package/README.ja.md +58 -29
- package/README.ko.md +58 -29
- package/README.md +95 -56
- package/README.no.md +58 -29
- package/README.pl.md +58 -29
- package/README.ru.md +58 -29
- package/README.th.md +58 -29
- package/README.tr.md +58 -29
- package/README.uk.md +58 -29
- package/README.vi.md +58 -29
- package/README.zh.md +58 -29
- package/README.zht.md +58 -29
- package/dist/cli.d.mts +218 -14
- package/dist/cli.mjs +1410 -883
- package/dist/mcp/stdio.mjs +1072 -408
- package/dist/scan-pipeline-Bg-46cLS.mjs +2 -0
- package/dist/{scan-pipeline-CAH9_Qgh.mjs → scan-pipeline-CCJdEKNa.mjs} +1443 -809
- package/package.json +52 -8
- package/dist/scan-pipeline-CRe7-MQn.mjs +0 -2
package/README.md
CHANGED
|
@@ -18,7 +18,7 @@ when verification isn't earning its keep.
|
|
|
18
18
|
[](https://nodejs.org)
|
|
19
19
|
|
|
20
20
|
```bash
|
|
21
|
-
npx mjolnir-qa@
|
|
21
|
+
npx mjolnir-qa@4.0.0
|
|
22
22
|
```
|
|
23
23
|
|
|
24
24
|
[See it work](#see-it-work) · [Quickstart](#quickstart) · [What it finds](#what-mjölnir-finds) · [Score](#the-worthiness-score) · [Evidence](#the-evidence-model) · [Forensics](#runtime-forensics) · [CI](#ci-integrity) · [Agents](#ai-agents) · [Security](#trust-and-security) · [Limits](#what-mjölnir-cannot-tell-you) · [Docs](#documentation)
|
|
@@ -67,7 +67,7 @@ reported. Generated by `npm run docs:readme-brand` from
|
|
|
67
67
|
**Strict mode.** The most aggressive detections — `.only`, `continue-on-error`,
|
|
68
68
|
empty tests, retry abuse — live in the quarantine tier. They run only
|
|
69
69
|
under `--strict` and are capped to `info` severity: they flag, they never
|
|
70
|
-
gate. The default scan (`npx mjolnir-qa@
|
|
70
|
+
gate. The default scan (`npx mjolnir-qa@4.0.0` without `--strict`)
|
|
71
71
|
covers core and extended rules only. Add `--strict` when you want the
|
|
72
72
|
advisory layer too.
|
|
73
73
|
|
|
@@ -95,6 +95,18 @@ registry, never typed by hand. The same picture as a poster:
|
|
|
95
95
|
|
|
96
96
|
<br />
|
|
97
97
|
|
|
98
|
+
## Release status
|
|
99
|
+
|
|
100
|
+
The published line is `3.0.0`; this working tree is the `4.0.0-rc.1`
|
|
101
|
+
candidate. `3.0.0` must not be republished or retagged. The M26–M50 program is
|
|
102
|
+
tracked in
|
|
103
|
+
[`docs/ROADMAP.yaml`](docs/ROADMAP.yaml); provisional capability contracts
|
|
104
|
+
are not automatically enabled or certified. Repository-owned checks pass, but
|
|
105
|
+
Trust certification remains `NOT_CERTIFIED` until the protected holdout,
|
|
106
|
+
real-world, platform/consumer, remote-workflow, support-matrix, and corpus
|
|
107
|
+
evidence gates pass. Run `npm run m26:readiness` before treating any candidate
|
|
108
|
+
as releasable. This document does not publish a tag or authorize a release.
|
|
109
|
+
|
|
98
110
|
## See it work
|
|
99
111
|
|
|
100
112
|
A real scan of [`examples/demo-repo`](examples/demo-repo), a small
|
|
@@ -115,7 +127,7 @@ CI. The full `--verbose` report of the same scan is
|
|
|
115
127
|
|
|
116
128
|
<p align="center">
|
|
117
129
|
<a href="assets/video/mjolnir-demo.mp4">
|
|
118
|
-
<img src="assets/video/mjolnir-demo-poster.png" alt="A frame of the demo recording: npx mjolnir-qa@
|
|
130
|
+
<img src="assets/video/mjolnir-demo-poster.png" alt="A frame of the demo recording: npx mjolnir-qa@4.0.0 scanning the demo repository in a terminal window" width="900" />
|
|
119
131
|
</a>
|
|
120
132
|
</p>
|
|
121
133
|
|
|
@@ -199,13 +211,13 @@ That is the unit of value: one place where CI reports a pass it did not earn.
|
|
|
199
211
|
## Quickstart
|
|
200
212
|
|
|
201
213
|
```bash
|
|
202
|
-
npx mjolnir-qa@
|
|
214
|
+
npx mjolnir-qa@4.0.0
|
|
203
215
|
```
|
|
204
216
|
|
|
205
217
|
Three steps to trust your release pipeline:
|
|
206
218
|
|
|
207
|
-
1. **Scan** — `npx mjolnir-qa@
|
|
208
|
-
2. **Block in CI** — `npx mjolnir-qa@
|
|
219
|
+
1. **Scan** — `npx mjolnir-qa@4.0.0` — scans the current directory, prints the Trust Report, exits `1` if findings at the gate
|
|
220
|
+
2. **Block in CI** — `npx mjolnir-qa@4.0.0 --scope changed` — scans only changed lines, blocks PRs with error findings
|
|
209
221
|
3. **Fix and re-verify** — `mjolnir fix` applies safe auto-fixes, then re-scans to prove each one landed
|
|
210
222
|
|
|
211
223
|
Install the advisory PR workflow first, so existing trust debt cannot break
|
|
@@ -221,22 +233,38 @@ After reviewing the findings or baselining existing debt, opt into blocking:
|
|
|
221
233
|
mjolnir ci install --gate error
|
|
222
234
|
```
|
|
223
235
|
|
|
224
|
-
| Command
|
|
225
|
-
|
|
|
226
|
-
| `mjolnir`
|
|
227
|
-
| `mjolnir --scope changed`
|
|
228
|
-
| `mjolnir --blocking error`
|
|
229
|
-
| `mjolnir ci install`
|
|
230
|
-
| `mjolnir ci install --gate error`
|
|
231
|
-
| `mjolnir business-case`
|
|
232
|
-
| `mjolnir
|
|
233
|
-
| `mjolnir
|
|
234
|
-
| `mjolnir
|
|
235
|
-
| `mjolnir
|
|
236
|
-
| `mjolnir
|
|
237
|
-
| `mjolnir
|
|
238
|
-
| `mjolnir
|
|
239
|
-
| `mjolnir
|
|
236
|
+
| Command | What it does |
|
|
237
|
+
| --------------------------------------------- | ------------------------------------------------------------ |
|
|
238
|
+
| `mjolnir` | Trust Report: verdict, confidence, next action |
|
|
239
|
+
| `mjolnir --scope changed` | Only what your branch introduced (CI form) |
|
|
240
|
+
| `mjolnir --blocking error` | Exit 1 on error findings — gate releases |
|
|
241
|
+
| `mjolnir ci install` | Write the advisory PR workflow (default) |
|
|
242
|
+
| `mjolnir ci install --gate error` | Opt into the blocking PR workflow |
|
|
243
|
+
| `mjolnir business-case` | Measured FP rates; a cost figure only with `--incident-cost` |
|
|
244
|
+
| `mjolnir release-report` | Release readiness: GO, CONDITIONAL GO, or NO-GO |
|
|
245
|
+
| `mjolnir release-trust` | 12-dimension release assurance verdict |
|
|
246
|
+
| `mjolnir report` | Findings in a Playwright-shaped file (no test outcomes) |
|
|
247
|
+
| `mjolnir diff` | What changed against the stored baseline, by fingerprint |
|
|
248
|
+
| `mjolnir verify` | Digest of what a change resolved and what it introduced |
|
|
249
|
+
| `mjolnir trend` | Record, show, or diff local quality snapshots |
|
|
250
|
+
| `mjolnir policy` | Initialize, validate, or check policy gates |
|
|
251
|
+
| `mjolnir quarantine` | Review deterministic proposals (prototype) |
|
|
252
|
+
| `mjolnir analyze --cross-file` | Bounded cross-file analysis |
|
|
253
|
+
| `mjolnir ci-adapter github .` | Generate CI templates for supported providers |
|
|
254
|
+
| `mjolnir dashboard` | Generate a self-contained quality dashboard |
|
|
255
|
+
| `mjolnir exec-report` | Executive KPIs and recommendations (advisory) |
|
|
256
|
+
| `mjolnir enterprise` | Self-hosted templates (prototype) |
|
|
257
|
+
| `mjolnir maturity` | Assess maturity or display maturity levels |
|
|
258
|
+
| `mjolnir mutation tests/mutation-report.json` | Analyze mutation reports; never promotes trust |
|
|
259
|
+
| `mjolnir mcp` | Read-only MCP tools over stdio |
|
|
260
|
+
| `mjolnir explain QA-CI-001` | What, why and fix, plus measured/unmeasured state |
|
|
261
|
+
| `mjolnir why src/a.spec.ts:42` | Why this exact line was flagged. Never gates. |
|
|
262
|
+
| `mjolnir forensics ./test-results/` | Runtime evidence from a real run |
|
|
263
|
+
| `mjolnir trust-report` | Self-contained Trust Artifact (md + json) |
|
|
264
|
+
| `mjolnir handoff` | Remediation plan for a coding agent |
|
|
265
|
+
| `mjolnir --json` / `--format sarif` | Machine-readable output, GitHub Code Scanning |
|
|
266
|
+
| `mjolnir --format codequality` | GitLab Code Quality report (MR widget artifact) |
|
|
267
|
+
| `mjolnir --strict` | Also run quarantine-tier rules (higher FP risk) |
|
|
240
268
|
|
|
241
269
|
<details>
|
|
242
270
|
<summary><strong>Every other command</strong> — flake triage, reporting, governance</summary>
|
|
@@ -508,17 +536,17 @@ Promotion, demotion and per-language maturity:
|
|
|
508
536
|
Linters tell you whether code follows rules. Mjölnir tells you whether your
|
|
509
537
|
verification can be trusted.
|
|
510
538
|
|
|
511
|
-
|
|
|
512
|
-
|
|
|
513
|
-
| Scores the **verification system**, not the product code
|
|
514
|
-
| CI workflow integrity (`continue-on-error`, `\|\| true`)
|
|
515
|
-
| Grades Playwright locator resilience (Selector Health)
|
|
516
|
-
| Reads real run data for `TRUE-FLAKE` verdicts
|
|
517
|
-
| Publishes
|
|
518
|
-
| Flags tests with no assertions
|
|
519
|
-
| Catches hard sleeps (`waitForTimeout`, `time.sleep`)
|
|
520
|
-
| Deterministic (same input, same output)
|
|
521
|
-
| Cost per scan
|
|
539
|
+
| | Linters (ESLint, SonarQube) | Coverage tools | AI code review | **Mjölnir** |
|
|
540
|
+
| -------------------------------------------------------------------- | :-------------------------: | :------------: | :------------: | :--------------: |
|
|
541
|
+
| Scores the **verification system**, not the product code | No | No | No | Yes |
|
|
542
|
+
| CI workflow integrity (`continue-on-error`, `\|\| true`) | No | No | only the diff | Yes |
|
|
543
|
+
| Grades Playwright locator resilience (Selector Health) | No | No | No | Yes |
|
|
544
|
+
| Reads real run data for `TRUE-FLAKE` verdicts | No | No | No | Yes |
|
|
545
|
+
| Publishes measured false-positive rates where corpus evidence exists | No | No | No | Yes |
|
|
546
|
+
| Flags tests with no assertions | Yes\* | No | sometimes | Yes |
|
|
547
|
+
| Catches hard sleeps (`waitForTimeout`, `time.sleep`) | Yes\* | No | sometimes | Yes |
|
|
548
|
+
| Deterministic (same input, same output) | Yes | Yes | No | Yes |
|
|
549
|
+
| Cost per scan | free | free | tokens | **zero** (local) |
|
|
522
550
|
|
|
523
551
|
<sub>\*Covered by `eslint-plugin-jest` and `eslint-plugin-playwright`
|
|
524
552
|
(`expect-expect`, `no-wait-for-timeout`) and by SonarQube's own assertion
|
|
@@ -577,6 +605,10 @@ and is pinned to this version, so adopting it cannot change gate semantics:
|
|
|
577
605
|
mjolnir ci install
|
|
578
606
|
```
|
|
579
607
|
|
|
608
|
+
The generated workflow is advisory by default. A direct
|
|
609
|
+
`uses: Sergey-Bar/Mjolnir@...` composite Action is blocking by default; set
|
|
610
|
+
`fail-on` explicitly when its policy differs.
|
|
611
|
+
|
|
580
612
|
After reviewing existing debt, opt into an enforcing gate:
|
|
581
613
|
|
|
582
614
|
```bash
|
|
@@ -595,14 +627,14 @@ In your existing workflow, pin the action and explicitly opt into an error gate:
|
|
|
595
627
|
The `--blocking error` flag does the same in any CI pipeline:
|
|
596
628
|
|
|
597
629
|
```bash
|
|
598
|
-
npx mjolnir-qa@
|
|
630
|
+
npx mjolnir-qa@4.0.0 --scope changed --blocking error
|
|
599
631
|
```
|
|
600
632
|
|
|
601
633
|
To put findings in GitHub Code Scanning, upload SARIF (requires
|
|
602
634
|
`security-events: write` at workflow or job scope):
|
|
603
635
|
|
|
604
636
|
```yaml
|
|
605
|
-
- run: npx mjolnir-qa@
|
|
637
|
+
- run: npx mjolnir-qa@4.0.0 --format sarif > mjolnir.sarif
|
|
606
638
|
continue-on-error: true
|
|
607
639
|
- uses: github/codeql-action/upload-sarif@v3
|
|
608
640
|
if: ${{ !cancelled() }}
|
|
@@ -617,7 +649,7 @@ Editor and pipeline setup: [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md
|
|
|
617
649
|
### Changed-scope attribution
|
|
618
650
|
|
|
619
651
|
```bash
|
|
620
|
-
npx mjolnir-qa@
|
|
652
|
+
npx mjolnir-qa@4.0.0 --scope changed
|
|
621
653
|
```
|
|
622
654
|
|
|
623
655
|
Findings are attributed to the lines your branch added, measured against
|
|
@@ -655,7 +687,7 @@ re-scan, never from the agent's own report of success.
|
|
|
655
687
|
Add it to a client that ships its own CLI:
|
|
656
688
|
|
|
657
689
|
```bash
|
|
658
|
-
claude mcp add mjolnir -- npx -y mjolnir-qa@
|
|
690
|
+
claude mcp add mjolnir -- npx -y mjolnir-qa@4.0.0 mcp
|
|
659
691
|
```
|
|
660
692
|
|
|
661
693
|
Or to any client that takes an `mcpServers` block:
|
|
@@ -663,7 +695,10 @@ Or to any client that takes an `mcpServers` block:
|
|
|
663
695
|
```json
|
|
664
696
|
{
|
|
665
697
|
"mcpServers": {
|
|
666
|
-
"mjolnir": {
|
|
698
|
+
"mjolnir": {
|
|
699
|
+
"command": "npx",
|
|
700
|
+
"args": ["-y", "mjolnir-qa@4.0.0", "mcp"]
|
|
701
|
+
}
|
|
667
702
|
}
|
|
668
703
|
}
|
|
669
704
|
```
|
|
@@ -753,26 +788,30 @@ Rule IDs (`QA-<FAMILY>-NNN`) are immutable once shipped and never reused.
|
|
|
753
788
|
|
|
754
789
|
The full docs site is at <https://sergey-bar.github.io/Mjolnir/>.
|
|
755
790
|
|
|
756
|
-
| Document
|
|
757
|
-
|
|
|
758
|
-
| [docs/EXECUTIVE-ROI.md](docs/EXECUTIVE-ROI.md)
|
|
759
|
-
| [docs/SCORING.md](docs/SCORING.md)
|
|
760
|
-
| [docs/TERMINOLOGY.md](docs/TERMINOLOGY.md)
|
|
761
|
-
| [docs/FP-AUDIT.md](docs/FP-AUDIT.md)
|
|
762
|
-
| [docs/RULE-LIFECYCLE.md](docs/RULE-LIFECYCLE.md)
|
|
763
|
-
| [docs/VERSIONING.md](docs/VERSIONING.md)
|
|
764
|
-
| [docs/machine-contract.md](docs/machine-contract.md)
|
|
765
|
-
| [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md)
|
|
766
|
-
| [docs/GITLAB-CI.md](docs/GITLAB-CI.md)
|
|
767
|
-
| [docs/rules/](docs/rules/)
|
|
768
|
-
| [CONTRIBUTING.md](CONTRIBUTING.md)
|
|
769
|
-
| [SUPPORT.md](SUPPORT.md)
|
|
770
|
-
| [SECURITY.md](SECURITY.md)
|
|
771
|
-
| [
|
|
791
|
+
| Document | What's in it |
|
|
792
|
+
| ------------------------------------------------------------------ | --------------------------------------------------------- |
|
|
793
|
+
| [docs/EXECUTIVE-ROI.md](docs/EXECUTIVE-ROI.md) | Business case for decision-makers |
|
|
794
|
+
| [docs/SCORING.md](docs/SCORING.md) | Score normalization and evidence weighting |
|
|
795
|
+
| [docs/TERMINOLOGY.md](docs/TERMINOLOGY.md) | Canonical vocabulary: one word per concept |
|
|
796
|
+
| [docs/FP-AUDIT.md](docs/FP-AUDIT.md) | Measured false-positive rates and the method |
|
|
797
|
+
| [docs/RULE-LIFECYCLE.md](docs/RULE-LIFECYCLE.md) | Rule states, tiers, suppression, deprecation |
|
|
798
|
+
| [docs/VERSIONING.md](docs/VERSIONING.md) | Semver policy, frozen surfaces, deprecation cycle |
|
|
799
|
+
| [docs/machine-contract.md](docs/machine-contract.md) | The canonical machine-readable result |
|
|
800
|
+
| [docs/SARIF-INTEGRATION.md](docs/SARIF-INTEGRATION.md) | SARIF output and editor or CI setup |
|
|
801
|
+
| [docs/GITLAB-CI.md](docs/GITLAB-CI.md) | GitLab: Code Quality report, MR recipe, gate |
|
|
802
|
+
| [docs/rules/](docs/rules/) | Generated per-rule catalog |
|
|
803
|
+
| [CONTRIBUTING.md](CONTRIBUTING.md) | Dev setup and contribution workflow |
|
|
804
|
+
| [SUPPORT.md](SUPPORT.md) | Where to ask, report and get help |
|
|
805
|
+
| [SECURITY.md](SECURITY.md) | Vulnerability reporting |
|
|
806
|
+
| [docs/MIGRATION-3.0.0.md](docs/MIGRATION-3.0.0.md) | 3.0.0 migration checklist |
|
|
807
|
+
| [docs/INSTALLATION-3.0.0.md](docs/INSTALLATION-3.0.0.md) | Reproducible CLI, Action, and MCP installation |
|
|
808
|
+
| [docs/ROLLBACK-3.0.0.md](docs/ROLLBACK-3.0.0.md) | Rollback and corrective-release procedure |
|
|
809
|
+
| [docs/RELEASE-3.0.0-READINESS.md](docs/RELEASE-3.0.0-READINESS.md) | 3.0.0 release gates, migration, QA, and rollout checklist |
|
|
810
|
+
| [CHANGELOG.md](CHANGELOG.md) | Release history |
|
|
772
811
|
|
|
773
812
|
### Status
|
|
774
813
|
|
|
775
|
-
**Version
|
|
814
|
+
**Version 3.0.0.** The JSON schema and the exit codes are frozen contracts.
|
|
776
815
|
TypeScript and Python have the broadest measured coverage. Java and C# are
|
|
777
816
|
newer; read them through the
|
|
778
817
|
[maturity table](https://sergey-bar.github.io/Mjolnir/reference/rule-lifecycle).
|
|
@@ -800,7 +839,7 @@ fixture-firewall laws are in [CONTRIBUTING.md](CONTRIBUTING.md).
|
|
|
800
839
|
<img src="assets/readme/closing.svg" alt="Run it on your repo." width="100%" />
|
|
801
840
|
|
|
802
841
|
```bash
|
|
803
|
-
npx mjolnir-qa@
|
|
842
|
+
npx mjolnir-qa@4.0.0
|
|
804
843
|
```
|
|
805
844
|
|
|
806
845
|
[Read the guide](https://sergey-bar.github.io/Mjolnir/guide/getting-started) · [Docs site](https://sergey-bar.github.io/Mjolnir/) · [npm](https://www.npmjs.com/package/mjolnir-qa)
|
package/README.no.md
CHANGED
|
@@ -18,7 +18,7 @@ og vurderer deretter hvor langt resultatet er til å stole på, med beviset for
|
|
|
18
18
|
[](https://nodejs.org)
|
|
19
19
|
|
|
20
20
|
```bash
|
|
21
|
-
npx mjolnir-qa@
|
|
21
|
+
npx mjolnir-qa@3.0.0
|
|
22
22
|
```
|
|
23
23
|
|
|
24
24
|
[Se det i aksjon](#se-det-i-aksjon) · [Kom raskt i gang](#kom-raskt-i-gang) · [Hva det finner](#hva-mjölnir-finner) · [Score](#worthiness-scoren) · [Evidens](#evidensmodellen) · [Kjøringsanalyse](#kjøringsanalyse) · [CI](#ci-integritet) · [Agenter](#ai-agenter) · [Sikkerhet](#tillit-og-sikkerhet) · [Begrensninger](#hva-mjölnir-ikke-kan-fortelle-deg) · [Dokumentasjon](#dokumentasjon)
|
|
@@ -28,9 +28,9 @@ npx mjolnir-qa@latest
|
|
|
28
28
|
|
|
29
29
|
[English](README.md) | [简体中文](README.zh.md) | [繁體中文](README.zht.md) | [한국어](README.ko.md) | [Deutsch](README.de.md) | [Español](README.es.md) | [Français](README.fr.md) | [Italiano](README.it.md) | [Dansk](README.da.md) | [日本語](README.ja.md) | [Polski](README.pl.md) | [Русский](README.ru.md) | Norsk | [Português (Brasil)](README.br.md) | [ไทย](README.th.md) | [Türkçe](README.tr.md) | [Українська](README.uk.md) | [বাংলা](README.bn.md) | [Ελληνικά](README.gr.md) | [Tiếng Việt](README.vi.md) | [עברית](README.he.md) | [العربية](README.ar.md) | [Bosanski](README.bs.md)
|
|
30
30
|
|
|
31
|
-
> 🤖 Machine-assisted translation. The [English README](README.md) is canonical. Last synced: 2026-09-
|
|
31
|
+
> 🤖 Machine-assisted translation. The [English README](README.md) is canonical. Last synced: 2026-09-26.
|
|
32
32
|
|
|
33
|
-
<!-- Source hash:
|
|
33
|
+
<!-- Source hash: `de04dfb1677b` -->
|
|
34
34
|
|
|
35
35
|
</details>
|
|
36
36
|
|
|
@@ -38,6 +38,20 @@ npx mjolnir-qa@latest
|
|
|
38
38
|
|
|
39
39
|
<br />
|
|
40
40
|
|
|
41
|
+
## Release status (English canonical)
|
|
42
|
+
|
|
43
|
+
The published line is `3.0.0`; this working tree is the `4.0.0-rc.1`
|
|
44
|
+
candidate. `3.0.0` must not be republished or retagged. The M26–M50 program is
|
|
45
|
+
tracked in
|
|
46
|
+
[`docs/ROADMAP.yaml`](docs/ROADMAP.yaml); provisional capability contracts
|
|
47
|
+
are not automatically enabled or certified. Repository-owned checks pass, but
|
|
48
|
+
Trust certification remains `NOT_CERTIFIED` until the protected holdout,
|
|
49
|
+
real-world, platform/consumer, remote-workflow, support-matrix, and corpus
|
|
50
|
+
evidence gates pass. Run `npm run m26:readiness` before treating any candidate
|
|
51
|
+
as releasable. This document does not publish a tag or authorize a release.
|
|
52
|
+
|
|
53
|
+
> Machine-assisted canonical text. Translate this block before treating it as localized copy.
|
|
54
|
+
|
|
41
55
|
## En grønn hake er en påstand, ikke et bevis
|
|
42
56
|
|
|
43
57
|
En grønn hake betyr at pipelinen ikke feilet. Den betyr ikke at testene kjørte, eller at de kunne ha feilet. Hver eneste av disse går grønt gjennom:
|
|
@@ -58,7 +72,7 @@ Ingen av dem gjør pipelinen rød, og hver av dem ser tilsiktet ut i review. Der
|
|
|
58
72
|
|
|
59
73
|
<sub>Hvert funn demoskanningen rapporterte for denne workflowen, på linjen det ble rapportert. Generert av `npm run docs:readme-brand` fra [`demo-report.json`](assets/readme/demo-report.json) og låst mot avvik i CI.</sub>
|
|
60
74
|
|
|
61
|
-
**Streng modus.** De mest aggressive deteksjonene — `.only`, `continue-on-error`, tomme tester, misbruk av omkjøringer — lever i karantenenivået. De kjører bare under `--strict` og er begrenset til `info`-alvorlighetsgrad: de flagger, de blokkerer aldri. Standardskanningen (`npx mjolnir-qa@
|
|
75
|
+
**Streng modus.** De mest aggressive deteksjonene — `.only`, `continue-on-error`, tomme tester, misbruk av omkjøringer — lever i karantenenivået. De kjører bare under `--strict` og er begrenset til `info`-alvorlighetsgrad: de flagger, de blokkerer aldri. Standardskanningen (`npx mjolnir-qa@3.0.0` uten `--strict`) dekker bare kjerne- og utvidede regler. Legg til `--strict` når du også vil ha rådgivningslaget.
|
|
62
76
|
|
|
63
77
|
Mjölnir leser testsuiten, CI-workflowene og, hvis du har en, rapporten fra en ekte kjøring. Det kjører ikke testene dine, installerer ikke avhengighetene dine og kjører ikke koden det skanner. Og når det mangler evidens, sier det det i stedet for å finne på tillit:
|
|
64
78
|
|
|
@@ -93,7 +107,7 @@ En ekte skanning av [`examples/demo-repo`](examples/demo-repo), en liten Playwri
|
|
|
93
107
|
|
|
94
108
|
<p align="center">
|
|
95
109
|
<a href="assets/video/mjolnir-demo.mp4">
|
|
96
|
-
<img src="assets/video/mjolnir-demo-poster.png" alt="Et bilde fra demoopptaket: npx mjolnir-qa@
|
|
110
|
+
<img src="assets/video/mjolnir-demo-poster.png" alt="Et bilde fra demoopptaket: npx mjolnir-qa@3.0.0 skanner demo-repositoriet i et terminalvindu" width="900" />
|
|
97
111
|
</a>
|
|
98
112
|
</p>
|
|
99
113
|
|
|
@@ -162,7 +176,7 @@ Det er verdienheten: ett sted der CI rapporterer en bestått den ikke har gjort
|
|
|
162
176
|
## Kom raskt i gang
|
|
163
177
|
|
|
164
178
|
```bash
|
|
165
|
-
npx mjolnir-qa@
|
|
179
|
+
npx mjolnir-qa@3.0.0
|
|
166
180
|
```
|
|
167
181
|
|
|
168
182
|
Det skanner gjeldende mappe og skriver ut Trust Report: hva det fant, hvor langt du kan stole på det, hvorfor, og hva du bør gjøre videre. Det avslutter med `0` når ingenting på eller over gaten ble funnet.
|
|
@@ -170,24 +184,39 @@ Det skanner gjeldende mappe og skriver ut Trust Report: hva det fant, hvor langt
|
|
|
170
184
|
I CI bør du bare skanne det grenen har introdusert, så en eldre testsuite ikke drukner din første pull request:
|
|
171
185
|
|
|
172
186
|
```bash
|
|
173
|
-
npx mjolnir-qa@
|
|
187
|
+
npx mjolnir-qa@3.0.0 --scope changed
|
|
174
188
|
```
|
|
175
189
|
|
|
176
|
-
`mjolnir ci install` skriver det som en GitHub Actions-workflow med [action-en](https://github.com/Sergey-Bar/Mjolnir#readme) festet til major-taggen `
|
|
177
|
-
|
|
178
|
-
| Kommando
|
|
179
|
-
|
|
|
180
|
-
| `mjolnir`
|
|
181
|
-
| `mjolnir --scope changed`
|
|
182
|
-
| `mjolnir ci install`
|
|
183
|
-
| `mjolnir
|
|
184
|
-
| `mjolnir
|
|
185
|
-
| `mjolnir
|
|
186
|
-
| `mjolnir
|
|
187
|
-
| `mjolnir
|
|
188
|
-
| `mjolnir
|
|
189
|
-
| `mjolnir
|
|
190
|
-
| `mjolnir --
|
|
190
|
+
`mjolnir ci install` skriver det som en GitHub Actions-workflow med [action-en](https://github.com/Sergey-Bar/Mjolnir#readme) festet til major-taggen `v3` (eller vanlig `npx` med `--no-action`). Den forblir rådgivende til du bestemmer at den skal blokkere.
|
|
191
|
+
|
|
192
|
+
| Kommando | Hva den gjør |
|
|
193
|
+
| --------------------------------------------- | ---------------------------------------------------------- |
|
|
194
|
+
| `mjolnir` | Trust Report: dom, sikkerhet, neste handling |
|
|
195
|
+
| `mjolnir --scope changed` | Bare det grenen din har introdusert (CI-formen) |
|
|
196
|
+
| `mjolnir ci install` | Generer den rådgivende PR-workflowen (action-basert) |
|
|
197
|
+
| `mjolnir business-case` | ROI estimate: projected savings per finding |
|
|
198
|
+
| `mjolnir release-report` | Release readiness: GO, CONDITIONAL GO, or NO-GO |
|
|
199
|
+
| `mjolnir release-trust` | 12-dimension release assurance verdict |
|
|
200
|
+
| `mjolnir report` | Generate a Playwright-compatible report |
|
|
201
|
+
| `mjolnir trend` | Record, show, or diff local quality snapshots |
|
|
202
|
+
| `mjolnir policy` | Initialize, validate, or check policy gates |
|
|
203
|
+
| `mjolnir quarantine` | Review deterministic proposals (prototype) |
|
|
204
|
+
| `mjolnir analyze --cross-file` | Bounded cross-file analysis |
|
|
205
|
+
| `mjolnir ci-adapter github .` | Generate CI templates for supported providers |
|
|
206
|
+
| `mjolnir dashboard` | Generate a self-contained quality dashboard |
|
|
207
|
+
| `mjolnir exec-report` | Executive KPIs and recommendations (advisory) |
|
|
208
|
+
| `mjolnir enterprise` | Self-hosted templates (prototype) |
|
|
209
|
+
| `mjolnir maturity` | Assess maturity or display maturity levels |
|
|
210
|
+
| `mjolnir mutation tests/mutation-report.json` | Analyze mutation reports; never promotes trust |
|
|
211
|
+
| `mjolnir mcp` | Read-only MCP tools over stdio |
|
|
212
|
+
| `mjolnir explain QA-CI-001` | Hva, hvorfor og rettelse, pluss den målte FP-raten |
|
|
213
|
+
| `mjolnir why src/a.spec.ts:42` | Hvorfor akkurat denne linjen ble markert. Blokkerer aldri. |
|
|
214
|
+
| `mjolnir forensics ./test-results/` | Kjøringsevidens fra en ekte kjøring |
|
|
215
|
+
| `mjolnir trust-report` | Selvstendig Trust-artefakt (md + json) |
|
|
216
|
+
| `mjolnir handoff` | Utbedringsplan for en kodeagent |
|
|
217
|
+
| `mjolnir --json` / `--format sarif` | Maskinlesbar utdata, GitHub Code Scanning |
|
|
218
|
+
| `mjolnir --format codequality` | GitLab Code Quality-rapport (MR-widget-artefakt) |
|
|
219
|
+
| `mjolnir --strict` | Kjør også regler på quarantine-nivå (høyere FP-risiko) |
|
|
191
220
|
|
|
192
221
|
<details>
|
|
193
222
|
<summary><strong>Alle andre kommandoer</strong> — triage av ustabile tester, rapportering, styring</summary>
|
|
@@ -452,18 +481,18 @@ mjolnir ci install
|
|
|
452
481
|
Eller legg Marketplace-action-en til en workflow du allerede har:
|
|
453
482
|
|
|
454
483
|
```yaml
|
|
455
|
-
- uses: Sergey-Bar/Mjolnir@
|
|
484
|
+
- uses: Sergey-Bar/Mjolnir@v3
|
|
456
485
|
with:
|
|
457
486
|
scope: changed
|
|
458
487
|
fail-on: error
|
|
459
488
|
```
|
|
460
489
|
|
|
461
|
-
Fest `@
|
|
490
|
+
Fest `@v3` for å følge major-linjen, eller en eksakt tagg (`@v0.5.32`) for en reproduserbar gate. [docs/DISTRIBUTION-KIT.md](docs/DISTRIBUTION-KIT.md) dekker Marketplace, Smithery og MCP-registrene.
|
|
462
491
|
|
|
463
492
|
For å få funn inn i GitHub Code Scanning, last opp SARIF (krever `security-events: write` på workflow- eller job-nivå):
|
|
464
493
|
|
|
465
494
|
```yaml
|
|
466
|
-
- run: npx mjolnir-qa@
|
|
495
|
+
- run: npx mjolnir-qa@3.0.0 --format sarif > mjolnir.sarif
|
|
467
496
|
continue-on-error: true
|
|
468
497
|
- uses: github/codeql-action/upload-sarif@v3
|
|
469
498
|
if: ${{ !cancelled() }}
|
|
@@ -476,7 +505,7 @@ På GitLab skriver `--format codequality` Code Quality-rapporten som MR-widgeten
|
|
|
476
505
|
### Tilordning i endret omfang
|
|
477
506
|
|
|
478
507
|
```bash
|
|
479
|
-
npx mjolnir-qa@
|
|
508
|
+
npx mjolnir-qa@3.0.0 --scope changed
|
|
480
509
|
```
|
|
481
510
|
|
|
482
511
|
Funn tilordnes linjene grenen din har lagt til, målt mot **merge-base**. Omfanget er det samme filsettet en full skanning finner (TS/JS-specs og adapterkonfigurasjoner, `test_*.py`, `*Test.java`, `*Tests.cs`, `.github/workflows/*.yml`), pluss ikke-committede og usporede endringer, så det fungerer før du committer. Basen løses i rekkefølgen `main → master → origin/main → origin/master → origin/HEAD`; overstyr den med `--base <ref>`.
|
|
@@ -504,7 +533,7 @@ SCAN → EVIDENCE → HANDOFF → AGENT → RE-SCAN → PROOF
|
|
|
504
533
|
Legg det til i en klient som har sin egen CLI:
|
|
505
534
|
|
|
506
535
|
```bash
|
|
507
|
-
claude mcp add mjolnir -- npx -y mjolnir-qa@
|
|
536
|
+
claude mcp add mjolnir -- npx -y mjolnir-qa@3.0.0 mcp
|
|
508
537
|
```
|
|
509
538
|
|
|
510
539
|
Eller i en hvilken som helst klient som tar en `mcpServers`-blokk:
|
|
@@ -512,7 +541,7 @@ Eller i en hvilken som helst klient som tar en `mcpServers`-blokk:
|
|
|
512
541
|
```json
|
|
513
542
|
{
|
|
514
543
|
"mcpServers": {
|
|
515
|
-
"mjolnir": { "command": "npx", "args": ["-y", "mjolnir-qa@
|
|
544
|
+
"mjolnir": { "command": "npx", "args": ["-y", "mjolnir-qa@3.0.0", "mcp"] }
|
|
516
545
|
}
|
|
517
546
|
}
|
|
518
547
|
```
|
|
@@ -603,7 +632,7 @@ Utviklingsmiljøet, kommandoene for de faste gatene og anti-creep- og fixture-br
|
|
|
603
632
|
<img src="assets/readme/closing.svg" alt="Kjør det på repoet ditt." width="100%" />
|
|
604
633
|
|
|
605
634
|
```bash
|
|
606
|
-
npx mjolnir-qa@
|
|
635
|
+
npx mjolnir-qa@3.0.0
|
|
607
636
|
```
|
|
608
637
|
|
|
609
638
|
[Les veiledningen](https://sergey-bar.github.io/Mjolnir/guide/getting-started) · [Dokumentasjonsnettsted](https://sergey-bar.github.io/Mjolnir/) · [npm](https://www.npmjs.com/package/mjolnir-qa)
|