qa360 2.2.1 → 2.2.13

package/docs/budgets-advanced.md

@@ -1,308 +0,0 @@
-# QA360 Phase 4 - Budgets Avancés & Trust Score
-
-Guide complet des budgets granulaires et du système de Trust Score pondéré.
-
-## 📊 Schéma Budgets Avancés
-
-### Structure Complète
-
-```yaml
-version: 1
-name: "enterprise-app"
-gates: ["ui", "api", "perf", "a11y", "sast", "deps", "secrets", "dast"]
-
-budgets:
-  perf:
-    p95_ms: 800          # P95 response time budget
-    p90_ms: 600          # P90 response time budget  
-    p50_ms: 300          # P50 response time budget
-    max_errors_rate: 0.1 # 10% max error rate
-  
-  a11y:
-    min_score: 90        # Minimum accessibility score
-    max_violations:
-      critical: 0        # Zero critical violations
-      serious: 2         # Max 2 serious violations
-      moderate: 5        # Max 5 moderate violations
-      minor: 10          # Max 10 minor violations
-
-security:
-  sast:                  # Static Application Security Testing
-    max_high: 0          # Zero high severity findings
-    max_critical: 0      # Zero critical findings
-    max_medium: 3        # Max 3 medium findings
-  
-  deps:                  # Dependency vulnerabilities
-    max_high: 0          # Zero high severity vulns
-    max_critical: 0      # Zero critical vulns
-    max_medium: 2        # Max 2 medium vulns
-  
-  secrets:               # Secret detection
-    max_findings: 0      # Zero secrets in code
-  
-  dast:                  # Dynamic Application Security Testing
-    max_high: 0          # Zero high severity alerts
-    max_critical: 0      # Zero critical alerts
-    max_medium: 1        # Max 1 medium alert
-    timeout_ms: 300000   # 5 minutes ZAP scan timeout
-
-execution:
-  on_failure: "continue" # continue | stop
-  mode: "strict"         # strict | soft
-```
-
-### Modes d'Exécution
-
-#### Mode Strict (Défaut)
-```yaml
-execution:
-  mode: "strict"
-```
-- Échec immédiat si budget dépassé
-- Exit code 1 pour CI/CD
-- Blocage du pipeline
-
-#### Mode Soft
-```yaml
-execution:
-  mode: "soft"
-```
-- Transformation en warnings
-- Dégradation du Trust Score
-- Pipeline continue
-
-## 🎯 Trust Score Pondéré
-
-### Pondération Par Défaut
-
-```typescript
-const DEFAULT_WEIGHTS = {
-  ui: 20,      // Tests UI/UX
-  api: 20,     // Tests API
-  perf: 15,    // Performance
-  a11y: 10,    // Accessibilité
-  sast: 15,    // Sécurité statique
-  deps: 10,    // Vulnérabilités dépendances
-  secrets: 5,  // Détection secrets
-  dast: 5      // Sécurité dynamique
-};
-```
-
-### Personnalisation Weights
-
-```bash
-# Via CLI
-qa360 run --url <url> --weights "ui:25,api:25,perf:20,sast:20,dast:10"
-
-# Via pack.yml
-weights:
-  ui: 25
-  api: 25
-  perf: 20
-  sast: 20
-  dast: 10
-```
-
-### Calcul Trust Score
-
-```
-Trust Score = Σ(Gate Score × Weight) / 100
-
-Exemple:
-- UI: 85% × 20% = 17.0
-- API: 90% × 20% = 18.0  
-- Perf: 75% × 15% = 11.25
-- A11y: 95% × 10% = 9.5
-- SAST: 100% × 15% = 15.0
-- Deps: 100% × 10% = 10.0
-- Secrets: 100% × 5% = 5.0
-- DAST: 90% × 5% = 4.5
-
-Trust Score = 90.25%
-```
-
-## 🔧 Exemples par Secteur
-
-### E-commerce
-```yaml
-budgets:
-  perf:
-    p95_ms: 500    # Performance critique
-    max_errors_rate: 0.01
-  a11y:
-    min_score: 95  # Accessibilité légale
-security:
-  sast:
-    max_high: 0    # Sécurité paiements
-  dast:
-    max_high: 0
-
-weights:
-  perf: 30       # Performance prioritaire
-  ui: 25
-  sast: 20       # Sécurité critique
-  api: 15
-  dast: 10
-```
-
-### SaaS B2B
-```yaml
-budgets:
-  perf:
-    p95_ms: 1000   # Tolérance plus élevée
-  a11y:
-    min_score: 85  # Standard business
-security:
-  sast:
-    max_high: 1    # Tolérance limitée
-  secrets:
-    max_findings: 0 # Zero secret
-
-weights:
-  api: 30        # API-first
-  ui: 25
-  sast: 20
-  perf: 15
-  deps: 10
-```
-
-### Application Interne
-```yaml
-budgets:
-  perf:
-    p95_ms: 2000   # Réseau interne
-  a11y:
-    min_score: 70  # Standard interne
-security:
-  sast:
-    max_high: 3    # Plus permissif
-  dast:
-    max_medium: 5
-
-weights:
-  ui: 40         # UX prioritaire
-  api: 30
-  perf: 20
-  sast: 10
-```
-
-## 📈 Recommandations Trust Score
-
-### Excellent (90-100%)
-- ✅ Prêt pour production
-- ✅ Qualité enterprise
-- ✅ Sécurité optimale
-
-### Good (80-89%)
-- ✅ Production acceptable
-- ⚠️ Améliorations mineures
-- ✅ Sécurité correcte
-
-### Acceptable (70-79%)
-- ⚠️ Production conditionnelle
-- 🔧 Améliorations requises
-- ⚠️ Révision sécurité
-
-### Needs Improvement (50-69%)
-- ❌ Production non recommandée
-- 🔧 Corrections majeures
-- 🔍 Audit sécurité
-
-### Critical (<50%)
-- 🚨 Blocage production
-- 🔧 Refactoring requis
-- 🚨 Failles critiques
-
-## 🛠️ Intégration CI/CD
-
-### GitHub Actions
-```yaml
-- name: QA360 Quality Gate
-  run: |
-    qa360 run --url ${{ env.STAGING_URL }} \
-      --mode strict \
-      --weights "perf:25,sast:25,ui:20,api:20,dast:10" \
-      --report-format json
-    
-    # Vérifier Trust Score
-    TRUST_SCORE=$(jq '.trustScore.weightedScore' qa360-report.json)
-    if [ $TRUST_SCORE -lt 80 ]; then
-      echo "Trust Score too low: $TRUST_SCORE%"
-      exit 1
-    fi
-```
-
-### GitLab CI
-```yaml
-qa360_quality_gate:
-  script:
-    - qa360 run --url $STAGING_URL --mode strict
-    - qa360 report --format badge --output trust-score.svg
-  artifacts:
-    reports:
-      junit: qa360-junit.xml
-    paths:
-      - trust-score.svg
-```
-
-## 🎨 Badges & Rapports
-
-### Badge Trust Score
-```markdown
-![Trust Score](https://img.shields.io/badge/Trust%20Score-85%25-green)
-```
-
-### Rapport Exécutif
-```bash
-qa360 report --format executive --output executive-report.pdf
-```
-
-### Dashboard Multi-Projets
-```bash
-qa360 dashboard --input "./projects/**/qa360-report.json" \
-  --output dashboard.html \
-  --weights "perf:30,sast:25,ui:25,api:20"
-```
-
-## 🔍 Monitoring & Alertes
-
-### Métriques Prometheus
-```
-qa360_trust_score{project="app",environment="prod"} 85
-qa360_gate_score{gate="perf",project="app"} 78
-qa360_budget_exceeded{gate="sast",severity="high"} 1
-```
-
-### Alertes Slack
-```yaml
-alerts:
-  trust_score_threshold: 80
-  webhook_url: "https://hooks.slack.com/..."
-  channels:
-    critical: "#security-alerts"
-    warning: "#qa-team"
-```
-
-## 📚 Bonnes Pratiques
-
-### 1. Définition Budgets
-- Commencer permissif, durcir progressivement
-- Adapter selon criticité métier
-- Réviser trimestriellement
-
-### 2. Pondération Weights
-- Aligner sur priorités business
-- Ajuster selon phase projet
-- Documenter les choix
-
-### 3. Monitoring Continu
-- Tracking évolution Trust Score
-- Alertes sur régressions
-- Rapports réguliers stakeholders
-
-### 4. Amélioration Continue
-- Analyse tendances
-- Identification goulots
-- Formation équipes
-
-Ce système de budgets avancés et Trust Score pondéré transforme QA360 en véritable plateforme de gouvernance qualité enterprise.

package/docs/examples/history-export-gc.md

@@ -1,285 +0,0 @@
-# QA360 History Export & Garbage Collection Examples
-
-This guide demonstrates how to use the `export` and `gc` subcommands of `qa360 history`.
-
-## Table of Contents
-- [Exporting Proof Bundles](#exporting-proof-bundles)
-- [Garbage Collection](#garbage-collection)
-- [Workflow Examples](#workflow-examples)
-
-## Exporting Proof Bundles
-
-The `export` command packages a complete test run into a portable ZIP archive for sharing or archival.
-
-### Basic Export
-
-```bash
-# Export the latest run
-qa360 history list --limit 1      # Get the run ID
-qa360 history export abc123 --bundle my-proof.zip
-```
-
-### What's Inside the Bundle?
-
-The exported ZIP contains:
-
-```
-my-proof.zip
-├── abc123-proof.json           # Cryptographically signed proof
-├── abc123-report.pdf           # PDF report (if generated)
-├── abc123-run.json             # Complete run metadata
-├── artifacts/                  # All test artifacts
-│   ├── screenshot1.png
-│   ├── screenshot2.png
-│   └── trace.json
-└── VERIFICATION.json           # Instructions for verification
-```
-
-### Use Cases
-
-**1. Share proof with stakeholders:**
-```bash
-# Export critical production run
-qa360 history pin def456          # Pin to protect from GC
-qa360 history export def456 --bundle production-v1.2.0.zip
-
-# Send to stakeholders
-# Recipient can verify:
-unzip production-v1.2.0.zip
-qa360 verify def456-proof.json
-```
-
-**2. Archive important releases:**
-```bash
-# Export all pinned runs
-for run_id in $(qa360 history list --json | jq -r '.[] | select(.pinned == 1) | .id'); do
-  qa360 history export $run_id --bundle "archive-${run_id}.zip"
-done
-```
-
-**3. CI/CD artifact preservation:**
-```bash
-# In your CI pipeline
-qa360 run pack.yml
-LATEST_RUN=$(qa360 history list --json --limit 1 | jq -r '.[0].id')
-qa360 history export $LATEST_RUN --bundle build-${CI_COMMIT_SHA}.zip
-# Upload to artifact storage
-```
-
-## Garbage Collection
-
-The `gc` command removes old runs and orphaned artifacts to free disk space.
-
-### Basic Garbage Collection
-
-```bash
-# Preview what will be deleted (safe)
-qa360 history gc --dry-run
-
-# Actually delete (keeps last 10 unpinned runs)
-qa360 history gc
-
-# Keep more runs
-qa360 history gc --keep-last 50
-```
-
-### How GC Works
-
-1. **Identifies runs to delete**: All unpinned runs beyond `--keep-last` threshold
-2. **Protects pinned runs**: Pinned runs are NEVER deleted
-3. **Tracks artifact references**: Scans all kept runs to find referenced artifacts
-4. **Removes orphaned artifacts**: Deletes artifacts no longer referenced by any run
-5. **Reports space freed**: Shows how much disk space was reclaimed
-
-### Example Output
-
-```bash
-$ qa360 history gc --keep-last 10
-
-🧹 Starting garbage collection...
-
-📊 Total runs: 45
-📌 Pinned runs: 3
-📦 Unpinned runs: 42
-
-🗑️  Runs to delete: 32 (keeping last 10)
-🔗 Referenced artifacts: 127
-🗑️  Orphaned artifacts: 48 (342.5 MB)
-
-✅ Garbage collection completed!
-   Deleted: 32 runs
-   Freed: 342.5 MB
-```
-
-### Dry Run Mode
-
-Always preview before deleting:
-
-```bash
-$ qa360 history gc --keep-last 5 --dry-run
-
-⚠️  DRY RUN MODE - No changes will be made
-
-📊 Total runs: 20
-📌 Pinned runs: 2
-📦 Unpinned runs: 18
-
-⚠️  DRY RUN - Would delete:
-   13 runs
-   25 orphaned artifacts (128.3 MB)
-```
-
-### Pinning Important Runs
-
-```bash
-# Pin production releases
-qa360 history list --limit 20
-qa360 history pin abc123          # v1.0.0 release
-qa360 history pin def456          # v1.1.0 release
-qa360 history pin ghi789          # v1.2.0 release
-
-# Now GC will never delete these
-qa360 history gc --keep-last 5
-
-# Unpin when no longer needed
-qa360 history unpin abc123
-```
-
-## Workflow Examples
-
-### Scenario 1: Regular Maintenance
-
-```bash
-# Weekly cleanup task
-qa360 history gc --keep-last 20
-
-# Before cleanup, export important runs
-qa360 history list --status passed --limit 5
-qa360 history export abc123 --bundle weekly-backup.zip
-```
-
-### Scenario 2: Release Management
-
-```bash
-# After deploying v2.0.0
-qa360 run production-pack.yml
-RELEASE_RUN=$(qa360 history list --limit 1 --json | jq -r '.[0].id')
-
-# Pin and export
-qa360 history pin $RELEASE_RUN
-qa360 history export $RELEASE_RUN --bundle release-v2.0.0.zip
-
-# Archive previous release
-qa360 history unpin <previous-release-id>
-
-# Clean up old runs
-qa360 history gc --keep-last 10
-```
-
-### Scenario 3: Compliance & Audit
-
-```bash
-# Export all passing runs from last month
-qa360 history list --status passed --since 2025-01-01 --json | \
-  jq -r '.[].id' | \
-  while read run_id; do
-    qa360 history export $run_id --bundle "compliance/${run_id}.zip"
-  done
-
-# Pin audit runs permanently
-qa360 history pin audit-2025-q1
-qa360 history pin audit-2025-q2
-```
-
-### Scenario 4: Disk Space Management
-
-```bash
-# Check vault size
-du -sh .qa360/
-
-# Preview GC impact
-qa360 history gc --dry-run --keep-last 5
-
-# Aggressive cleanup (keep only last 3 runs)
-qa360 history gc --keep-last 3
-
-# Check space freed
-du -sh .qa360/
-```
-
-## Best Practices
-
-### 1. Pin Before GC
-Always pin important runs before running garbage collection:
-```bash
-qa360 history pin <release-run-id>
-qa360 history gc
-```
-
-### 2. Export Before Cleanup
-For critical runs, export before aggressive cleanup:
-```bash
-qa360 history export <run-id> --bundle backup.zip
-qa360 history gc --keep-last 5
-```
-
-### 3. Use Dry Run First
-Always preview with `--dry-run` before actual deletion:
-```bash
-qa360 history gc --dry-run
-# Review output
-qa360 history gc
-```
-
-### 4. Automate with Cron
-```bash
-# Add to crontab (weekly cleanup)
-0 2 * * 0 cd /path/to/project && qa360 history gc --keep-last 20
-```
-
-### 5. CI/CD Integration
-```yaml
-# .github/workflows/qa360.yml
-- name: Export proof bundle
-  run: |
-    LATEST_RUN=$(qa360 history list --json --limit 1 | jq -r '.[0].id')
-    qa360 history export $LATEST_RUN --bundle proof-${{ github.sha }}.zip
-
-- name: Upload artifact
-  uses: actions/upload-artifact@v3
-  with:
-    name: qa360-proof
-    path: proof-${{ github.sha }}.zip
-```
-
-## Troubleshooting
-
-### Export Fails: Run Not Found
-```bash
-$ qa360 history export abc123 --bundle proof.zip
-❌ Run not found: abc123
-
-# Solution: Check run ID
-qa360 history list
-```
-
-### GC Deletes Too Much
-```bash
-# Solution: Increase --keep-last or pin important runs
-qa360 history gc --keep-last 50
-```
-
-### Bundle Too Large
-```bash
-# Solution: Artifacts are large, consider selective export
-# (Future feature: --exclude-artifacts flag)
-```
-
-## Summary
-
-- **Export**: Create portable ZIP bundles for sharing and archival
-- **GC**: Free disk space by removing old runs and orphaned artifacts
-- **Pin**: Protect important runs from garbage collection
-- **Dry Run**: Always preview before deletion with `--dry-run`
-
-For more information, see the [main documentation](../README.md).