qa360 2.1.7 → 2.2.0

package/docs/budgets-advanced.md

@@ -0,0 +1,308 @@
+# QA360 Phase 4 - Budgets Avancés & Trust Score
+
+Guide complet des budgets granulaires et du système de Trust Score pondéré.
+
+## 📊 Schéma Budgets Avancés
+
+### Structure Complète
+
+```yaml
+version: 1
+name: "enterprise-app"
+gates: ["ui", "api", "perf", "a11y", "sast", "deps", "secrets", "dast"]
+
+budgets:
+  perf:
+    p95_ms: 800          # P95 response time budget
+    p90_ms: 600          # P90 response time budget  
+    p50_ms: 300          # P50 response time budget
+    max_errors_rate: 0.1 # 10% max error rate
+  
+  a11y:
+    min_score: 90        # Minimum accessibility score
+    max_violations:
+      critical: 0        # Zero critical violations
+      serious: 2         # Max 2 serious violations
+      moderate: 5        # Max 5 moderate violations
+      minor: 10          # Max 10 minor violations
+
+security:
+  sast:                  # Static Application Security Testing
+    max_high: 0          # Zero high severity findings
+    max_critical: 0      # Zero critical findings
+    max_medium: 3        # Max 3 medium findings
+  
+  deps:                  # Dependency vulnerabilities
+    max_high: 0          # Zero high severity vulns
+    max_critical: 0      # Zero critical vulns
+    max_medium: 2        # Max 2 medium vulns
+  
+  secrets:               # Secret detection
+    max_findings: 0      # Zero secrets in code
+  
+  dast:                  # Dynamic Application Security Testing
+    max_high: 0          # Zero high severity alerts
+    max_critical: 0      # Zero critical alerts
+    max_medium: 1        # Max 1 medium alert
+    timeout_ms: 300000   # 5 minutes ZAP scan timeout
+
+execution:
+  on_failure: "continue" # continue | stop
+  mode: "strict"         # strict | soft
+```
+
+### Modes d'Exécution
+
+#### Mode Strict (Défaut)
+```yaml
+execution:
+  mode: "strict"
+```
+- Échec immédiat si budget dépassé
+- Exit code 1 pour CI/CD
+- Blocage du pipeline
+
+#### Mode Soft
+```yaml
+execution:
+  mode: "soft"
+```
+- Transformation en warnings
+- Dégradation du Trust Score
+- Pipeline continue
+
+## 🎯 Trust Score Pondéré
+
+### Pondération Par Défaut
+
+```typescript
+const DEFAULT_WEIGHTS = {
+  ui: 20,      // Tests UI/UX
+  api: 20,     // Tests API
+  perf: 15,    // Performance
+  a11y: 10,    // Accessibilité
+  sast: 15,    // Sécurité statique
+  deps: 10,    // Vulnérabilités dépendances
+  secrets: 5,  // Détection secrets
+  dast: 5      // Sécurité dynamique
+};
+```
+
+### Personnalisation Weights
+
+```bash
+# Via CLI
+qa360 run --url <url> --weights "ui:25,api:25,perf:20,sast:20,dast:10"
+
+# Via pack.yml
+weights:
+  ui: 25
+  api: 25
+  perf: 20
+  sast: 20
+  dast: 10
+```
+
+### Calcul Trust Score
+
+```
+Trust Score = Σ(Gate Score × Weight) / 100
+
+Exemple:
+- UI: 85% × 20% = 17.0
+- API: 90% × 20% = 18.0  
+- Perf: 75% × 15% = 11.25
+- A11y: 95% × 10% = 9.5
+- SAST: 100% × 15% = 15.0
+- Deps: 100% × 10% = 10.0
+- Secrets: 100% × 5% = 5.0
+- DAST: 90% × 5% = 4.5
+
+Trust Score = 90.25%
+```
+
+## 🔧 Exemples par Secteur
+
+### E-commerce
+```yaml
+budgets:
+  perf:
+    p95_ms: 500    # Performance critique
+    max_errors_rate: 0.01
+  a11y:
+    min_score: 95  # Accessibilité légale
+security:
+  sast:
+    max_high: 0    # Sécurité paiements
+  dast:
+    max_high: 0
+
+weights:
+  perf: 30       # Performance prioritaire
+  ui: 25
+  sast: 20       # Sécurité critique
+  api: 15
+  dast: 10
+```
+
+### SaaS B2B
+```yaml
+budgets:
+  perf:
+    p95_ms: 1000   # Tolérance plus élevée
+  a11y:
+    min_score: 85  # Standard business
+security:
+  sast:
+    max_high: 1    # Tolérance limitée
+  secrets:
+    max_findings: 0 # Zero secret
+
+weights:
+  api: 30        # API-first
+  ui: 25
+  sast: 20
+  perf: 15
+  deps: 10
+```
+
+### Application Interne
+```yaml
+budgets:
+  perf:
+    p95_ms: 2000   # Réseau interne
+  a11y:
+    min_score: 70  # Standard interne
+security:
+  sast:
+    max_high: 3    # Plus permissif
+  dast:
+    max_medium: 5
+
+weights:
+  ui: 40         # UX prioritaire
+  api: 30
+  perf: 20
+  sast: 10
+```
+
+## 📈 Recommandations Trust Score
+
+### Excellent (90-100%)
+- ✅ Prêt pour production
+- ✅ Qualité enterprise
+- ✅ Sécurité optimale
+
+### Good (80-89%)
+- ✅ Production acceptable
+- ⚠️ Améliorations mineures
+- ✅ Sécurité correcte
+
+### Acceptable (70-79%)
+- ⚠️ Production conditionnelle
+- 🔧 Améliorations requises
+- ⚠️ Révision sécurité
+
+### Needs Improvement (50-69%)
+- ❌ Production non recommandée
+- 🔧 Corrections majeures
+- 🔍 Audit sécurité
+
+### Critical (<50%)
+- 🚨 Blocage production
+- 🔧 Refactoring requis
+- 🚨 Failles critiques
+
+## 🛠️ Intégration CI/CD
+
+### GitHub Actions
+```yaml
+- name: QA360 Quality Gate
+  run: |
+    qa360 run --url ${{ env.STAGING_URL }} \
+      --mode strict \
+      --weights "perf:25,sast:25,ui:20,api:20,dast:10" \
+      --report-format json
+    
+    # Vérifier Trust Score
+    TRUST_SCORE=$(jq '.trustScore.weightedScore' qa360-report.json)
+    if [ $TRUST_SCORE -lt 80 ]; then
+      echo "Trust Score too low: $TRUST_SCORE%"
+      exit 1
+    fi
+```
+
+### GitLab CI
+```yaml
+qa360_quality_gate:
+  script:
+    - qa360 run --url $STAGING_URL --mode strict
+    - qa360 report --format badge --output trust-score.svg
+  artifacts:
+    reports:
+      junit: qa360-junit.xml
+    paths:
+      - trust-score.svg
+```
+
+## 🎨 Badges & Rapports
+
+### Badge Trust Score
+```markdown
+![Trust Score](https://img.shields.io/badge/Trust%20Score-85%25-green)
+```
+
+### Rapport Exécutif
+```bash
+qa360 report --format executive --output executive-report.pdf
+```
+
+### Dashboard Multi-Projets
+```bash
+qa360 dashboard --input "./projects/**/qa360-report.json" \
+  --output dashboard.html \
+  --weights "perf:30,sast:25,ui:25,api:20"
+```
+
+## 🔍 Monitoring & Alertes
+
+### Métriques Prometheus
+```
+qa360_trust_score{project="app",environment="prod"} 85
+qa360_gate_score{gate="perf",project="app"} 78
+qa360_budget_exceeded{gate="sast",severity="high"} 1
+```
+
+### Alertes Slack
+```yaml
+alerts:
+  trust_score_threshold: 80
+  webhook_url: "https://hooks.slack.com/..."
+  channels:
+    critical: "#security-alerts"
+    warning: "#qa-team"
+```
+
+## 📚 Bonnes Pratiques
+
+### 1. Définition Budgets
+- Commencer permissif, durcir progressivement
+- Adapter selon criticité métier
+- Réviser trimestriellement
+
+### 2. Pondération Weights
+- Aligner sur priorités business
+- Ajuster selon phase projet
+- Documenter les choix
+
+### 3. Monitoring Continu
+- Tracking évolution Trust Score
+- Alertes sur régressions
+- Rapports réguliers stakeholders
+
+### 4. Amélioration Continue
+- Analyse tendances
+- Identification goulots
+- Formation équipes
+
+Ce système de budgets avancés et Trust Score pondéré transforme QA360 en véritable plateforme de gouvernance qualité enterprise.

package/docs/examples/history-export-gc.md

@@ -0,0 +1,285 @@
+# QA360 History Export & Garbage Collection Examples
+
+This guide demonstrates how to use the `export` and `gc` subcommands of `qa360 history`.
+
+## Table of Contents
+- [Exporting Proof Bundles](#exporting-proof-bundles)
+- [Garbage Collection](#garbage-collection)
+- [Workflow Examples](#workflow-examples)
+
+## Exporting Proof Bundles
+
+The `export` command packages a complete test run into a portable ZIP archive for sharing or archival.
+
+### Basic Export
+
+```bash
+# Export the latest run
+qa360 history list --limit 1      # Get the run ID
+qa360 history export abc123 --bundle my-proof.zip
+```
+
+### What's Inside the Bundle?
+
+The exported ZIP contains:
+
+```
+my-proof.zip
+├── abc123-proof.json           # Cryptographically signed proof
+├── abc123-report.pdf           # PDF report (if generated)
+├── abc123-run.json             # Complete run metadata
+├── artifacts/                  # All test artifacts
+│   ├── screenshot1.png
+│   ├── screenshot2.png
+│   └── trace.json
+└── VERIFICATION.json           # Instructions for verification
+```
+
+### Use Cases
+
+**1. Share proof with stakeholders:**
+```bash
+# Export critical production run
+qa360 history pin def456          # Pin to protect from GC
+qa360 history export def456 --bundle production-v1.2.0.zip
+
+# Send to stakeholders
+# Recipient can verify:
+unzip production-v1.2.0.zip
+qa360 verify def456-proof.json
+```
+
+**2. Archive important releases:**
+```bash
+# Export all pinned runs
+for run_id in $(qa360 history list --json | jq -r '.[] | select(.pinned == 1) | .id'); do
+  qa360 history export $run_id --bundle "archive-${run_id}.zip"
+done
+```
+
+**3. CI/CD artifact preservation:**
+```bash
+# In your CI pipeline
+qa360 run pack.yml
+LATEST_RUN=$(qa360 history list --json --limit 1 | jq -r '.[0].id')
+qa360 history export $LATEST_RUN --bundle build-${CI_COMMIT_SHA}.zip
+# Upload to artifact storage
+```
+
+## Garbage Collection
+
+The `gc` command removes old runs and orphaned artifacts to free disk space.
+
+### Basic Garbage Collection
+
+```bash
+# Preview what will be deleted (safe)
+qa360 history gc --dry-run
+
+# Actually delete (keeps last 10 unpinned runs)
+qa360 history gc
+
+# Keep more runs
+qa360 history gc --keep-last 50
+```
+
+### How GC Works
+
+1. **Identifies runs to delete**: All unpinned runs beyond `--keep-last` threshold
+2. **Protects pinned runs**: Pinned runs are NEVER deleted
+3. **Tracks artifact references**: Scans all kept runs to find referenced artifacts
+4. **Removes orphaned artifacts**: Deletes artifacts no longer referenced by any run
+5. **Reports space freed**: Shows how much disk space was reclaimed
+
+### Example Output
+
+```bash
+$ qa360 history gc --keep-last 10
+
+🧹 Starting garbage collection...
+
+📊 Total runs: 45
+📌 Pinned runs: 3
+📦 Unpinned runs: 42
+
+🗑️  Runs to delete: 32 (keeping last 10)
+🔗 Referenced artifacts: 127
+🗑️  Orphaned artifacts: 48 (342.5 MB)
+
+✅ Garbage collection completed!
+   Deleted: 32 runs
+   Freed: 342.5 MB
+```
+
+### Dry Run Mode
+
+Always preview before deleting:
+
+```bash
+$ qa360 history gc --keep-last 5 --dry-run
+
+⚠️  DRY RUN MODE - No changes will be made
+
+📊 Total runs: 20
+📌 Pinned runs: 2
+📦 Unpinned runs: 18
+
+⚠️  DRY RUN - Would delete:
+   13 runs
+   25 orphaned artifacts (128.3 MB)
+```
+
+### Pinning Important Runs
+
+```bash
+# Pin production releases
+qa360 history list --limit 20
+qa360 history pin abc123          # v1.0.0 release
+qa360 history pin def456          # v1.1.0 release
+qa360 history pin ghi789          # v1.2.0 release
+
+# Now GC will never delete these
+qa360 history gc --keep-last 5
+
+# Unpin when no longer needed
+qa360 history unpin abc123
+```
+
+## Workflow Examples
+
+### Scenario 1: Regular Maintenance
+
+```bash
+# Weekly cleanup task
+qa360 history gc --keep-last 20
+
+# Before cleanup, export important runs
+qa360 history list --status passed --limit 5
+qa360 history export abc123 --bundle weekly-backup.zip
+```
+
+### Scenario 2: Release Management
+
+```bash
+# After deploying v2.0.0
+qa360 run production-pack.yml
+RELEASE_RUN=$(qa360 history list --limit 1 --json | jq -r '.[0].id')
+
+# Pin and export
+qa360 history pin $RELEASE_RUN
+qa360 history export $RELEASE_RUN --bundle release-v2.0.0.zip
+
+# Archive previous release
+qa360 history unpin <previous-release-id>
+
+# Clean up old runs
+qa360 history gc --keep-last 10
+```
+
+### Scenario 3: Compliance & Audit
+
+```bash
+# Export all passing runs from last month
+qa360 history list --status passed --since 2025-01-01 --json | \
+  jq -r '.[].id' | \
+  while read run_id; do
+    qa360 history export $run_id --bundle "compliance/${run_id}.zip"
+  done
+
+# Pin audit runs permanently
+qa360 history pin audit-2025-q1
+qa360 history pin audit-2025-q2
+```
+
+### Scenario 4: Disk Space Management
+
+```bash
+# Check vault size
+du -sh .qa360/
+
+# Preview GC impact
+qa360 history gc --dry-run --keep-last 5
+
+# Aggressive cleanup (keep only last 3 runs)
+qa360 history gc --keep-last 3
+
+# Check space freed
+du -sh .qa360/
+```
+
+## Best Practices
+
+### 1. Pin Before GC
+Always pin important runs before running garbage collection:
+```bash
+qa360 history pin <release-run-id>
+qa360 history gc
+```
+
+### 2. Export Before Cleanup
+For critical runs, export before aggressive cleanup:
+```bash
+qa360 history export <run-id> --bundle backup.zip
+qa360 history gc --keep-last 5
+```
+
+### 3. Use Dry Run First
+Always preview with `--dry-run` before actual deletion:
+```bash
+qa360 history gc --dry-run
+# Review output
+qa360 history gc
+```
+
+### 4. Automate with Cron
+```bash
+# Add to crontab (weekly cleanup)
+0 2 * * 0 cd /path/to/project && qa360 history gc --keep-last 20
+```
+
+### 5. CI/CD Integration
+```yaml
+# .github/workflows/qa360.yml
+- name: Export proof bundle
+  run: |
+    LATEST_RUN=$(qa360 history list --json --limit 1 | jq -r '.[0].id')
+    qa360 history export $LATEST_RUN --bundle proof-${{ github.sha }}.zip
+
+- name: Upload artifact
+  uses: actions/upload-artifact@v3
+  with:
+    name: qa360-proof
+    path: proof-${{ github.sha }}.zip
+```
+
+## Troubleshooting
+
+### Export Fails: Run Not Found
+```bash
+$ qa360 history export abc123 --bundle proof.zip
+❌ Run not found: abc123
+
+# Solution: Check run ID
+qa360 history list
+```
+
+### GC Deletes Too Much
+```bash
+# Solution: Increase --keep-last or pin important runs
+qa360 history gc --keep-last 50
+```
+
+### Bundle Too Large
+```bash
+# Solution: Artifacts are large, consider selective export
+# (Future feature: --exclude-artifacts flag)
+```
+
+## Summary
+
+- **Export**: Create portable ZIP bundles for sharing and archival
+- **GC**: Free disk space by removing old runs and orphaned artifacts
+- **Pin**: Protect important runs from garbage collection
+- **Dry Run**: Always preview before deletion with `--dry-run`
+
+For more information, see the [main documentation](../README.md).