qa360 2.1.7 → 2.2.0

package/core/src/pack/migrator.ts

@@ -0,0 +1,353 @@
+/**
+ * QA360 Pack Migrator
+ * Migrates legacy pack configurations to v1 format
+ */
+
+import { PackConfigV1, LegacyPackConfig, PackMigrationResult, PackMigrationChange, QualityGate } from '../types/pack-v1.js';
+
+export class PackMigrator {
+  
+  /**
+   * Migrate legacy pack to v1 format
+   */
+  migrate(legacyPack: LegacyPackConfig): PackMigrationResult {
+    const changes: PackMigrationChange[] = [];
+    const warnings: string[] = [];
+    
+    try {
+      const v1Pack: PackConfigV1 = {
+        version: 1,
+        name: this.migrateName(legacyPack.name, changes),
+        gates: this.migrateGates(legacyPack, changes, warnings),
+      };
+
+      // Optional fields
+      if (legacyPack.description) {
+        v1Pack.description = legacyPack.description;
+      }
+
+      // Migrate targets from adapters and tests
+      const targets = this.migrateTargets(legacyPack, changes, warnings);
+      if (Object.keys(targets).length > 0) {
+        v1Pack.targets = targets;
+      }
+
+      // Migrate environment
+      if (legacyPack.environment) {
+        v1Pack.environment = this.migrateEnvironment(legacyPack.environment, changes, warnings);
+      }
+
+      // Migrate hooks
+      if (legacyPack.hooks) {
+        v1Pack.hooks = this.migrateHooks(legacyPack.hooks, changes);
+      }
+
+      // Add default execution settings
+      v1Pack.execution = {
+        retry_on: ['ECONNRESET', '502'],
+        max_retries: 1,
+        fail_on_readiness: true,
+        timeout: 30000
+      };
+      changes.push({
+        type: 'added',
+        path: 'execution',
+        newValue: v1Pack.execution,
+        reason: 'Added default execution configuration for v1'
+      });
+
+      // Add default observability
+      v1Pack.observability = {
+        metrics: true,
+        trace: 'basic'
+      };
+      changes.push({
+        type: 'added',
+        path: 'observability',
+        newValue: v1Pack.observability,
+        reason: 'Added default observability configuration for v1'
+      });
+
+      return {
+        success: true,
+        fromVersion: legacyPack.version || '0.9.x',
+        toVersion: '1',
+        changes,
+        warnings
+      };
+
+    } catch (error) {
+      return {
+        success: false,
+        fromVersion: legacyPack.version || '0.9.x',
+        toVersion: '1',
+        changes,
+        warnings: [...warnings, `Migration failed: ${error instanceof Error ? error.message : 'Unknown error'}`]
+      };
+    }
+  }
+
+  /**
+   * Migrate pack name to v1 format
+   */
+  private migrateName(name: string, changes: PackMigrationChange[]): string {
+    // Sanitize name for v1 requirements (alphanumeric, underscore, hyphen only)
+    const sanitized = name.replace(/[^a-zA-Z0-9_-]/g, '_');
+    
+    if (sanitized !== name) {
+      changes.push({
+        type: 'modified',
+        path: 'name',
+        oldValue: name,
+        newValue: sanitized,
+        reason: 'Sanitized name to match v1 pattern requirements'
+      });
+    }
+
+    return sanitized;
+  }
+
+  /**
+   * Migrate adapters and tests to quality gates
+   */
+  private migrateGates(legacyPack: LegacyPackConfig, changes: PackMigrationChange[], warnings: string[]): QualityGate[] {
+    const gates: Set<QualityGate> = new Set();
+
+    // Map adapters to gates
+    if (legacyPack.adapters) {
+      for (const adapter of legacyPack.adapters) {
+        const mappedGates = this.mapAdapterToGates(adapter);
+        mappedGates.forEach(gate => gates.add(gate));
+      }
+    }
+
+    // Map tests to gates
+    if (legacyPack.tests) {
+      for (const test of legacyPack.tests) {
+        const mappedGates = this.mapAdapterToGates(test.adapter);
+        mappedGates.forEach(gate => gates.add(gate));
+      }
+    }
+
+    // Default to api_smoke if no gates detected
+    if (gates.size === 0) {
+      gates.add('api_smoke');
+      warnings.push('No recognizable adapters found, defaulting to api_smoke gate');
+    }
+
+    const gateArray = Array.from(gates);
+    
+    changes.push({
+      type: 'added',
+      path: 'gates',
+      newValue: gateArray,
+      reason: `Mapped adapters [${legacyPack.adapters?.join(', ') || 'none'}] to quality gates`
+    });
+
+    return gateArray;
+  }
+
+  /**
+   * Map legacy adapter names to quality gates
+   */
+  private mapAdapterToGates(adapter: string): QualityGate[] {
+    const mapping: Record<string, QualityGate[]> = {
+      'playwright': ['api_smoke', 'ui'],
+      'k6': ['perf'],
+      'lighthouse': ['perf', 'a11y'],
+      'semgrep': ['sast'],
+      'zap': ['dast'],
+      'axe': ['a11y'],
+      'jest': ['api_smoke'],
+      'cypress': ['ui'],
+      'puppeteer': ['ui']
+    };
+
+    return mapping[adapter.toLowerCase()] || ['api_smoke'];
+  }
+
+  /**
+   * Migrate targets from legacy configuration
+   */
+  private migrateTargets(legacyPack: LegacyPackConfig, changes: PackMigrationChange[], warnings: string[]) {
+    const targets: any = {};
+
+    // Try to extract API target from environment or tests
+    const apiUrl = this.extractApiUrl(legacyPack);
+    if (apiUrl) {
+      targets.api = {
+        baseUrl: apiUrl,
+        smoke: ['GET /health -> 200'] // Default smoke test
+      };
+      
+      changes.push({
+        type: 'added',
+        path: 'targets.api',
+        newValue: targets.api,
+        reason: `Extracted API target from configuration`
+      });
+    }
+
+    // Try to extract Web target
+    const webUrl = this.extractWebUrl(legacyPack);
+    if (webUrl && webUrl !== apiUrl) {
+      targets.web = {
+        baseUrl: webUrl,
+        pages: ['/'] // Default to homepage
+      };
+      
+      changes.push({
+        type: 'added',
+        path: 'targets.web',
+        newValue: targets.web,
+        reason: `Extracted web target from configuration`
+      });
+    }
+
+    return targets;
+  }
+
+  /**
+   * Extract API URL from legacy configuration
+   */
+  private extractApiUrl(legacyPack: LegacyPackConfig): string | null {
+    // Check environment variables
+    if (legacyPack.environment) {
+      const candidates = ['API_URL', 'BASE_URL', 'TARGET_URL', 'SERVER_URL'];
+      for (const candidate of candidates) {
+        const url = legacyPack.environment[candidate];
+        if (url && this.isValidUrl(url)) {
+          return url;
+        }
+      }
+    }
+
+    // Check test configurations
+    if (legacyPack.tests) {
+      for (const test of legacyPack.tests) {
+        if (test.config?.baseURL && this.isValidUrl(test.config.baseURL)) {
+          return test.config.baseURL;
+        }
+        if (test.config?.url && this.isValidUrl(test.config.url)) {
+          return test.config.url;
+        }
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Extract Web URL from legacy configuration
+   */
+  private extractWebUrl(legacyPack: LegacyPackConfig): string | null {
+    // Similar logic to API URL but looking for web-specific patterns
+    if (legacyPack.environment) {
+      const candidates = ['WEB_URL', 'FRONTEND_URL', 'UI_URL', 'APP_URL'];
+      for (const candidate of candidates) {
+        const url = legacyPack.environment[candidate];
+        if (url && this.isValidUrl(url)) {
+          return url;
+        }
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Validate URL format
+   */
+  private isValidUrl(url: string): boolean {
+    try {
+      new URL(url);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  /**
+   * Migrate environment variables
+   */
+  private migrateEnvironment(env: Record<string, string>, changes: PackMigrationChange[], warnings: string[]): Record<string, string> {
+    const migratedEnv: Record<string, string> = {};
+    
+    for (const [key, value] of Object.entries(env)) {
+      // Convert to uppercase with underscores (v1 requirement)
+      const normalizedKey = key.toUpperCase().replace(/[^A-Z0-9_]/g, '_');
+      
+      if (normalizedKey !== key) {
+        changes.push({
+          type: 'renamed',
+          path: `environment.${key}`,
+          oldValue: key,
+          newValue: normalizedKey,
+          reason: 'Normalized environment variable name for v1 requirements'
+        });
+      }
+
+      // Check for potential secrets
+      if (this.looksLikeSecret(value)) {
+        warnings.push(`Environment variable ${normalizedKey} appears to contain a secret. Consider using: \${{ secrets.${normalizedKey} }}`);
+      }
+
+      migratedEnv[normalizedKey] = value;
+    }
+
+    return migratedEnv;
+  }
+
+  /**
+   * Migrate hooks from legacy format
+   */
+  private migrateHooks(hooks: any, changes: PackMigrationChange[]) {
+    const migratedHooks: any = {};
+
+    if (hooks.beforeAll) {
+      migratedHooks.beforeAll = hooks.beforeAll.map((cmd: string) => ({
+        run: cmd,
+        timeout: 30000
+      }));
+      
+      changes.push({
+        type: 'modified',
+        path: 'hooks.beforeAll',
+        oldValue: hooks.beforeAll,
+        newValue: migratedHooks.beforeAll,
+        reason: 'Converted string commands to v1 hook object format'
+      });
+    }
+
+    if (hooks.afterAll) {
+      migratedHooks.afterAll = hooks.afterAll.map((cmd: string) => ({
+        run: cmd,
+        timeout: 30000
+      }));
+      
+      changes.push({
+        type: 'modified',
+        path: 'hooks.afterAll',
+        oldValue: hooks.afterAll,
+        newValue: migratedHooks.afterAll,
+        reason: 'Converted string commands to v1 hook object format'
+      });
+    }
+
+    return migratedHooks;
+  }
+
+  /**
+   * Check if a value looks like a secret
+   */
+  private looksLikeSecret(value: string): boolean {
+    const secretPatterns = [
+      /^[A-Za-z0-9+/]{20,}={0,2}$/, // Base64-like
+      /^[a-f0-9]{32,}$/i,           // Hex tokens
+      /^sk-[a-zA-Z0-9]{32,}$/,      // API keys
+      /^ghp_[a-zA-Z0-9]{36}$/,      // GitHub tokens
+    ];
+
+    return secretPatterns.some(pattern => pattern.test(value));
+  }
+}

package/core/src/pack/validator.ts

@@ -0,0 +1,359 @@
+/**
+ * QA360 Pack v1 Validator
+ * Validates pack.yml files against the official schema
+ */
+
+import Ajv, { JSONSchemaType } from 'ajv';
+import addFormats from 'ajv-formats';
+import { readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { fileURLToPath } from 'url';
+import { PackConfigV1, PackValidationResult, PackValidationError, PackValidationWarning } from '../types/pack-v1.js';
+
+export class PackValidator {
+  private ajv: Ajv;
+  private schema: any;
+
+  constructor() {
+    this.ajv = new Ajv({
+      allErrors: true,
+      verbose: true,
+      strict: false
+    });
+    addFormats(this.ajv);
+
+    // Load schema (ES modules compatible)
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = dirname(__filename);
+    const schemaPath = join(__dirname, '../../schemas/pack.schema.json');
+    this.schema = JSON.parse(readFileSync(schemaPath, 'utf8'));
+    this.ajv.addSchema(this.schema, 'pack-v1');
+  }
+
+  /**
+   * Validate a pack configuration
+   */
+  validate(pack: any): PackValidationResult {
+    const errors: PackValidationError[] = [];
+    const warnings: PackValidationWarning[] = [];
+
+    // Check version first to determine which schema to use
+    const version = pack.version;
+
+    if (version === 2) {
+      // Version 2 uses a different structure (object gates)
+      // For now, return a helpful message that v2 is not fully supported
+      errors.push({
+        code: 'QP200',
+        path: 'version',
+        message: 'Pack version 2 is not yet supported in this release',
+        suggestion: 'Use version: 1 with the v1 format. See docs for v1 format examples.'
+      });
+      return {
+        valid: false,
+        errors,
+        warnings
+      };
+    }
+
+    if (version > 2 || version < 1) {
+      errors.push({
+        code: 'QP201',
+        path: 'version',
+        message: `Unsupported pack version: ${version}`,
+        suggestion: 'Use version: 1 (current) or version: 2 (coming soon)'
+      });
+      return {
+        valid: false,
+        errors,
+        warnings
+      };
+    }
+
+    // Schema validation for v1
+    const valid = this.ajv.validate('pack-v1', pack);
+
+    if (!valid && this.ajv.errors) {
+      for (const error of this.ajv.errors) {
+        errors.push({
+          code: this.getErrorCode(error),
+          path: error.instancePath || error.schemaPath || 'root',
+          message: this.formatErrorMessage(error),
+          suggestion: this.getSuggestion(error)
+        });
+      }
+    }
+
+    // Custom business logic validation
+    if (valid) {
+      const businessRules = this.validateBusinessRules(pack as PackConfigV1);
+      errors.push(...businessRules.errors);
+      warnings.push(...businessRules.warnings);
+    }
+
+    return {
+      valid: errors.length === 0,
+      errors,
+      warnings
+    };
+  }
+
+  /**
+   * Validate business rules beyond schema
+   */
+  private validateBusinessRules(pack: PackConfigV1): { errors: PackValidationError[]; warnings: PackValidationWarning[] } {
+    const errors: PackValidationError[] = [];
+    const warnings: PackValidationWarning[] = [];
+
+    // Check gate-target consistency (only for non-minimal packs)
+    if (pack.gates.includes('api_smoke') && !pack.targets?.api) {
+      // For minimal smoke packs, this is a warning, not an error
+      if (pack.gates.length === 1 && pack.gates[0] === 'api_smoke') {
+        warnings.push({
+          code: 'QP001',
+          path: 'targets.api',
+          message: 'API smoke gate without api target - using default configuration',
+          suggestion: 'Add targets.api with baseUrl for better control'
+        });
+      } else {
+        errors.push({
+          code: 'QP001',
+          path: 'targets.api',
+          message: 'API smoke gate requires api target configuration',
+          suggestion: 'Add targets.api with baseUrl'
+        });
+      }
+    }
+
+    if (pack.gates.includes('ui') && !pack.targets?.web) {
+      errors.push({
+        code: 'QP002',
+        path: 'targets.web',
+        message: 'UI gate requires web target configuration',
+        suggestion: 'Add targets.web with baseUrl'
+      });
+    }
+
+    // Check budget recommendations
+    if (pack.gates.includes('perf') && !pack.budgets?.perf_p95_ms) {
+      warnings.push({
+        code: 'QP003',
+        path: 'budgets.perf_p95_ms',
+        message: 'Performance gate without budget may not fail appropriately',
+        suggestion: 'Add budgets.perf_p95_ms (recommended: 800-2000ms)'
+      });
+    }
+
+    if (pack.gates.includes('a11y') && !pack.budgets?.a11y_min) {
+      warnings.push({
+        code: 'QP004',
+        path: 'budgets.a11y_min',
+        message: 'Accessibility gate without budget may not fail appropriately',
+        suggestion: 'Add budgets.a11y_min (recommended: 90-95%)'
+      });
+    }
+
+    // Check security configuration
+    if ((pack.gates.includes('sast') || pack.gates.includes('dast')) && !pack.security) {
+      warnings.push({
+        code: 'QP005',
+        path: 'security',
+        message: 'Security gates without security configuration',
+        suggestion: 'Add security section with sast_max_high and secrets_leak settings'
+      });
+    }
+
+    // Check for potential secrets in plain text (ignore secret references)
+    if (pack.environment) {
+      const SECRET_REF = /\$\{\{\s*secrets\.[A-Z0-9_]+\s*\}\}/g;
+      
+      for (const [key, value] of Object.entries(pack.environment)) {
+        if (typeof value === 'string' && !SECRET_REF.test(value) && this.looksLikeSecret(value)) {
+          errors.push({
+            code: 'QP006',
+            path: `environment.${key}`,
+            message: 'Potential secret detected in plain text',
+            suggestion: `Use secret reference: \${{ secrets.${key.toUpperCase()} }}`
+          });
+        }
+      }
+    }
+
+    // Check for dangerous hook commands
+    if (pack.hooks) {
+      const dangerousCommands = ['rm -rf', 'sudo rm', 'del /f', 'format', 'mkfs', 'dd if='];
+      
+      ['beforeAll', 'beforeEach', 'afterEach', 'afterAll'].forEach(hookType => {
+        const hooks = pack.hooks![hookType as keyof typeof pack.hooks];
+        if (hooks) {
+          hooks.forEach((hook, index) => {
+            const command = typeof hook === 'string' ? hook : 
+              ('run' in hook ? hook.run : 
+               'compose' in hook ? `compose ${hook.compose}` :
+               'wait_on' in hook ? `wait_on ${hook.wait_on}` : '');
+            if (command && dangerousCommands.some(dangerous => command.toLowerCase().includes(dangerous))) {
+              warnings.push({
+                code: 'QP007',
+                path: `hooks.${hookType}[${index}]`,
+                message: 'Potentially dangerous command detected',
+                suggestion: 'Review command for safety'
+              });
+            }
+          });
+        }
+      });
+    }
+
+    return { errors, warnings };
+  }
+
+  /**
+   * Check if a value looks like a secret
+   */
+  private looksLikeSecret(value: string): boolean {
+    const secretPatterns = [
+      /^[A-Za-z0-9+/]{20,}={0,2}$/, // Base64-like
+      /^[a-f0-9]{32,}$/i,           // Hex tokens
+      /^sk-[a-zA-Z0-9]{32,}$/,      // API keys
+      /^ghp_[a-zA-Z0-9]{36}$/,      // GitHub tokens
+      /^xoxb-[a-zA-Z0-9-]+$/,       // Slack tokens
+    ];
+
+    return secretPatterns.some(pattern => pattern.test(value));
+  }
+
+  /**
+   * Check if a value is a secret reference
+   */
+  private isSecretReference(value: string): boolean {
+    return /^\$\{\{\s*secrets\.[A-Z_][A-Z0-9_]*\s*\}\}$/.test(value);
+  }
+
+  /**
+   * Validate hook commands for security issues
+   */
+  private validateHookSecurity(hooks: any[], basePath: string, warnings: PackValidationWarning[]) {
+    for (let i = 0; i < hooks.length; i++) {
+      const hook = hooks[i];
+      if (typeof hook.run === 'string') {
+        // Check for dangerous commands
+        const dangerousPatterns = [
+          /rm\s+-rf\s+\//, // rm -rf /
+          /sudo\s+/,       // sudo commands
+          /curl.*\|\s*sh/, // curl | sh
+          /wget.*\|\s*sh/, // wget | sh
+        ];
+
+        for (const pattern of dangerousPatterns) {
+          if (pattern.test(hook.run)) {
+            warnings.push({
+              code: 'QP007',
+              path: `${basePath}[${i}].run`,
+              message: 'Potentially dangerous command detected',
+              suggestion: 'Review command for security implications'
+            });
+            break;
+          }
+        }
+      }
+    }
+  }
+
+  /**
+   * Get error code from AJV error
+   */
+  private getErrorCode(error: any): string {
+    const codeMap: Record<string, string> = {
+      'required': 'QP100',
+      'type': 'QP101',
+      'format': 'QP102',
+      'pattern': 'QP103',
+      'enum': 'QP104',
+      'const': 'QP105',
+      'minimum': 'QP106',
+      'maximum': 'QP107',
+      'minLength': 'QP108',
+      'maxLength': 'QP109',
+      'minItems': 'QP110',
+      'uniqueItems': 'QP111',
+      'additionalProperties': 'QP112'
+    };
+
+    return codeMap[error.keyword] || 'QP999';
+  }
+
+  /**
+   * Format error message for better UX
+   */
+  private formatErrorMessage(error: any): string {
+    const path = error.instancePath || 'root';
+    
+    switch (error.keyword) {
+      case 'required':
+        return `Missing required field: ${error.params.missingProperty}`;
+      case 'type':
+        return `Expected ${error.params.type}, got ${typeof error.data}`;
+      case 'format':
+        return `Invalid ${error.params.format} format`;
+      case 'pattern':
+        return `Value does not match required pattern`;
+      case 'enum':
+        return `Value must be one of: ${error.params.allowedValues.join(', ')}`;
+      case 'const':
+        return `Value must be exactly: ${error.params.allowedValue}`;
+      case 'minimum':
+        return `Value must be >= ${error.params.limit}`;
+      case 'maximum':
+        return `Value must be <= ${error.params.limit}`;
+      case 'minLength':
+        return `Value must be at least ${error.params.limit} characters`;
+      case 'maxLength':
+        return `Value must be at most ${error.params.limit} characters`;
+      case 'minItems':
+        return `Array must have at least ${error.params.limit} items`;
+      case 'uniqueItems':
+        return `Array items must be unique`;
+      case 'additionalProperties':
+        return `Unknown property: ${error.params.additionalProperty}`;
+      default:
+        return error.message || 'Validation error';
+    }
+  }
+
+  /**
+   * Get suggestion for fixing error
+   */
+  private getSuggestion(error: any): string | undefined {
+    switch (error.keyword) {
+      case 'required':
+        const field = error.params.missingProperty;
+        const suggestions: Record<string, string> = {
+          'version': 'Add: version: 1',
+          'name': 'Add: name: "my-pack"',
+          'gates': 'Add: gates: ["api_smoke"]',
+          'baseUrl': 'Add: baseUrl: "https://api.example.com"'
+        };
+        return suggestions[field];
+      
+      case 'enum':
+        return `Use one of: ${error.params.allowedValues.join(', ')}`;
+      
+      case 'format':
+        if (error.params.format === 'uri') {
+          return 'Use full URL with protocol: https://example.com';
+        }
+        break;
+      
+      case 'pattern':
+        if (error.instancePath.includes('name')) {
+          return 'Use only letters, numbers, underscore, and hyphen';
+        }
+        if (error.instancePath.includes('smoke')) {
+          return 'Format: "GET /path -> 200"';
+        }
+        break;
+    }
+    
+    return undefined;
+  }
+}