qaify-playwright-reporter 0.7.0 → 0.9.0

package/dist/fix.js

@@ -5,27 +5,28 @@
 //   fix-context / autofix-context: ambil konteks + token clone read-only, clone repo di commit sumber, cabut token,
 //                tulis prompt untuk Claude.
 //   claude -p mengubah kode di repo/ (tanpa commit).
-//   fix-diff:    stage perubahan → changes.patch (lockfile & .env dibuang) → artefak.
+//   fix-deps:    pengganti Claude untuk advisory dependensi (model qaify-deps): composer/npm update lockfile saja,
+//                tanpa AI, hasilnya ditulis dalam bentuk keluaran claude -p.
+//   fix-diff:    stage perubahan → changes.patch (lockfile & .env dibuang, kecuali lockfile mode deps) → artefak.
 // Job "submit" (VM bersih, kode hasil Claude tidak pernah dijalankan di sini):
 //   fix-submit / autofix-submit: guard patch → token push (contents:write, satu repo) → clone ulang → git apply
 //                → commit → push → cabut token → hasil ke Qaify (backend membuka PR).
-import { appendFile, mkdir, writeFile } from 'node:fs/promises';
+import { appendFile, mkdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { defaultExec, gitAuthEnv, revokeTokens } from './audit.js';
 import { parseClaudeUsage, readClaudeUsage } from './usage.js';
 /** Model untuk --model Claude Code: alias atau ID versi; selain itu ditolak (nilainya masuk ke shell workflow). */
 const MODEL_PATTERN = /^[a-z0-9][a-z0-9.-]{0,63}$/;
+/** "Model" perbaikan advisory dependensi tanpa AI; cermin config qafactory.audit_fix.deps_model. */
+export const DEPS_MODEL = 'qaify-deps';
 /** Berkas yang tidak boleh diubah perbaikan: workflow (bisa membaca secret repo), rahasia, lockfile. */
 const BLOCKED = [/^\.github\//, /(^|\/)\.env(\.(?!example$)[^/]*)?$/];
+const LOCKFILE = /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|composer\.lock|bun\.lockb?)$/;
 /**
  * Ikut berubah tanpa sengaja saat Claude menjalankan npm / composer install atau Playwright (laporan & trace bila
  * repo tidak meng-ignore-nya): dibuang dari patch, bukan menggagalkan.
  */
-const INCIDENTAL = [
-    /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|composer\.lock|bun\.lockb?)$/,
-    /(^|\/)\.env(\.(?!example$)[^/]*)?$/,
-    /^(test-results|playwright-report|blob-report)\//,
-];
+const INCIDENTAL = [LOCKFILE, /(^|\/)\.env(\.(?!example$)[^/]*)?$/, /^(test-results|playwright-report|blob-report)\//];
 export const FIX_SCHEMA = {
     type: 'object',
     properties: {
@@ -137,12 +138,13 @@ export async function fixContext(client, fixId, dir, opts = {}) {
     const ctx = (await client.get(`${FIX_BASE[kind]}/${encodeURIComponent(fixId)}/context${query}`));
     if (!ctx?.repo?.token) {
         log('qa-factory: konteks perbaikan tidak bisa diambil (perbaikan tidak dikenal / sudah selesai / token runner salah)');
-        return { ok: false, model: null };
+        return { ok: false, model: null, mode: 'claude' };
     }
+    const deps = kind === 'audit' && ctx.deps && /^[@\w][\w./@-]*$/.test(ctx.deps.package) && ['composer', 'npm'].includes(ctx.deps.manager) ? ctx.deps : null;
     if (!MODEL_PATTERN.test(ctx.model)) {
         log(`qa-factory: model "${ctx.model}" tidak valid`);
         await revokeTokens([ctx.repo.token], opts.fetch);
-        return { ok: false, model: null };
+        return { ok: false, model: null, mode: 'claude' };
     }
     if (process.env.GITHUB_ACTIONS === 'true')
         console.log(`::add-mask::${ctx.repo.token}`);
@@ -157,26 +159,120 @@ export async function fixContext(client, fixId, dir, opts = {}) {
     catch (e) {
         log(`qa-factory: clone gagal: ${e.message.split('\n')[0]}`);
         await revokeTokens([ctx.repo.token], opts.fetch);
-        return { ok: false, model: null };
+        return { ok: false, model: null, mode: 'claude' };
     }
     await revokeTokens([ctx.repo.token], opts.fetch);
     const { token: _token, ...repo } = ctx.repo;
     await mkdir(join(dir, '.qaify'), { recursive: true });
+    if (deps) {
+        await writeFile(join(dir, '.qaify', 'deps.json'), JSON.stringify(deps));
+        log(`qa-factory: ${ctx.repo.full_name}@${ref.slice(0, 12)} → repo/ (update ${deps.manager} ${deps.package} tanpa AI, percobaan ke-${ctx.attempt_no})`);
+        return { ok: true, model: ctx.model, mode: 'deps' };
+    }
     await writeFile(join(dir, '.qaify', 'prompt.txt'), kind === 'test' ? testFixPrompt({ ...ctx, repo }) : fixPrompt({ ...ctx, repo }));
     const detail = kind === 'test' ? ctx.failure.category : ctx.complexity;
     log(`qa-factory: ${ctx.repo.full_name}@${ref.slice(0, 12)} → repo/ (model ${ctx.model}, ${detail}, percobaan ke-${ctx.attempt_no})`);
-    return { ok: true, model: ctx.model };
+    return { ok: true, model: ctx.model, mode: 'claude' };
+}
+/**
+ * Advisory dependensi tanpa AI: update paket di lockfile saja (tanpa install / script), cek ulang dengan audit, lalu
+ * tulis hasilnya ke <dir>/.qaify/claude.json dalam bentuk keluaran `claude -p` (model qaify-deps, token 0) agar
+ * fix-diff / fix-submit tidak berubah. npm: npm update dulu, npm audit fix bila paket masih rentan.
+ */
+export async function fixDeps(dir, exec = defaultExec) {
+    const started = Date.now();
+    const target = JSON.parse(await readFile(join(dir, '.qaify', 'deps.json'), 'utf8'));
+    const repo = join(dir, 'repo');
+    const pkg = target.package;
+    // composer/npm audit keluar non-0 bila masih ada kerentanan: laporannya tetap di stdout
+    const report = (file, args) => exec(file, args).catch((e) => (typeof e?.stdout === 'string' ? e.stdout : ''));
+    const composer = target.manager === 'composer';
+    const manifest = composer ? 'composer.json' : 'package.json';
+    const auditCmd = composer ? 'composer audit --locked' : 'npm audit --package-lock-only';
+    const steps = [];
+    let vulnerable;
+    try {
+        if (composer) {
+            steps.push(`composer update ${pkg} --with-all-dependencies --no-install`);
+            await exec('composer', ['update', pkg, '--with-all-dependencies', '--no-install', '--no-scripts', '--no-interaction', '--no-progress', `--working-dir=${repo}`]);
+            vulnerable = stillVulnerable(await report('composer', ['audit', '--locked', '--format=json', '--no-interaction', `--working-dir=${repo}`]), 'composer', pkg);
+        }
+        else {
+            steps.push(`npm update ${pkg} --package-lock-only`);
+            await exec('npm', ['update', pkg, '--package-lock-only', '--no-fund', '--no-audit', '--prefix', repo]);
+            const audit = () => report('npm', ['audit', '--json', '--package-lock-only', '--prefix', repo]);
+            vulnerable = stillVulnerable(await audit(), 'npm', pkg);
+            if (vulnerable) {
+                steps.push('npm audit fix --package-lock-only');
+                await exec('npm', ['audit', 'fix', '--package-lock-only', '--no-fund', '--prefix', repo]).catch(() => '');
+                vulnerable = stillVulnerable(await audit(), 'npm', pkg);
+            }
+        }
+    }
+    catch (e) {
+        const message = String(e.stderr || e.message).trim().split('\n').slice(-3).join(' ');
+        return writeDeps(dir, started, { fixed: false, summary: `Gagal memperbarui ${pkg}.`, reason: `${steps.at(-1)} gagal: ${message}`.slice(0, 1000) });
+    }
+    const changed = (await exec('git', ['-C', repo, 'status', '--porcelain'])).split('\n').map((l) => l.slice(3).trim()).filter(Boolean);
+    if (vulnerable) {
+        return writeDeps(dir, started, {
+            fixed: false,
+            summary: `${pkg} masih rentan setelah ${steps.join(' lalu ')}.`,
+            reason: `Versi ${pkg} yang sudah diperbaiki berada di luar constraint ${manifest} (kemungkinan perlu naik versi major). Naikkan constraint ${pkg} di ${manifest} secara manual lalu uji aplikasinya.`,
+        });
+    }
+    if (!changed.length) {
+        return writeDeps(dir, started, { fixed: false, summary: `Lockfile tidak berubah.`, reason: `Advisory ${pkg} sudah tidak muncul di ${auditCmd} commit ini; temuan mungkin sudah diperbaiki.` });
+    }
+    return writeDeps(dir, started, {
+        fixed: true,
+        summary: `- ${pkg} diperbarui dengan ${steps.join(', lalu ')} (tanpa AI).\n- ${auditCmd} tidak lagi melaporkan ${pkg}.`,
+        files_changed: changed,
+        tests_run: `${auditCmd}: ${pkg} bersih. Test aplikasi dijalankan CI repo pada PR ini.`,
+    });
+}
+/** Masih ada advisory untuk paket ini? npm: hanya high / critical (sama dengan temuan audit-static). */
+export function stillVulnerable(output, manager, pkg) {
+    const start = output.search(/[[{]/);
+    let data = null;
+    try {
+        data = start < 0 ? null : JSON.parse(output.slice(start));
+    }
+    catch {
+        // laporan tidak terbaca: dianggap masih rentan, jangan buka PR yang belum terbukti
+    }
+    if (!data)
+        return true;
+    if (manager === 'composer') {
+        const list = data.advisories?.[pkg];
+        return Array.isArray(list) ? list.length > 0 : !!list && Object.keys(list).length > 0;
+    }
+    const vuln = data.vulnerabilities?.[pkg];
+    return vuln?.severity === 'high' || vuln?.severity === 'critical';
+}
+async function writeDeps(dir, started, result) {
+    await writeFile(join(dir, '.qaify', 'claude.json'), JSON.stringify({
+        type: 'result',
+        subtype: 'success',
+        duration_ms: Date.now() - started,
+        structured_output: result,
+        usage: { input_tokens: 0, output_tokens: 0 },
+        modelUsage: { [DEPS_MODEL]: { outputTokens: 0 } },
+    }));
+    return result;
 }
 /**
  * Perubahan Claude di <dir>/repo → <out>/changes.patch (git diff --binary). Lockfile & .env yang ikut berubah saat
- * menjalankan aplikasi dibuang dari patch. Job ini tidak memegang token, jadi aman menjalankan git di repo hasil Claude.
+ * menjalankan aplikasi dibuang dari patch, kecuali lockfile pada mode deps (.qaify/deps.json) yang memang hasilnya.
+ * Job ini tidak memegang token, jadi aman menjalankan git di repo hasil Claude.
  */
 export async function fixDiff(dir, out, exec = defaultExec) {
     const repo = join(dir, 'repo');
     await mkdir(out, { recursive: true });
     await exec('git', ['-C', repo, 'add', '-A']);
+    const deps = await stat(join(dir, '.qaify', 'deps.json')).then(() => true, () => false);
     const staged = (await exec('git', ['-C', repo, 'diff', '--cached', '--name-only'])).split('\n').filter(Boolean);
-    const dropped = staged.filter((f) => INCIDENTAL.some((re) => re.test(f)));
+    const dropped = staged.filter((f) => INCIDENTAL.some((re) => re.test(f)) && !(deps && LOCKFILE.test(f)));
     if (dropped.length)
         await exec('git', ['-C', repo, 'reset', '-q', '--', ...dropped]);
     await writeFile(join(out, 'changes.patch'), await exec('git', ['-C', repo, 'diff', '--cached', '--binary']));
@@ -189,6 +285,7 @@ export function patchStats(patch) {
     const paths = new Set();
     let unreadable = 0;
     let changedLines = 0;
+    let lockfile = false;
     for (const line of patch.split('\n')) {
         if (line.startsWith('diff --git ')) {
             const header = /^diff --git "?a\/(.+?)"? "?b\/(.+?)"?$/.exec(line);
@@ -199,8 +296,9 @@ export function patchStats(patch) {
             paths.add(header[1]);
             paths.add(header[2]);
             files.add(header[2]);
+            lockfile = LOCKFILE.test(header[2]);
         }
-        else if (/^(\+(?!\+\+ )|-(?!-- ))/.test(line)) {
+        else if (!lockfile && /^(\+(?!\+\+ )|-(?!-- ))/.test(line)) {
             changedLines++;
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qaify-playwright-reporter",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Reporter Playwright untuk QA Factory (Qaify): kirim hasil test dan artefak ke /api/ingest, tanpa pernah menggagalkan test.",
   "license": "MIT",
   "author": "ahmdkenz",

package/templates/qaify-audit.yml

@@ -3,13 +3,14 @@
 # Butuh di repo runner ini (Settings → Secrets and variables → Actions):
 #   secret   QA_FACTORY_TOKEN         token reporter repo runner (Pengaturan → Token Reporter)
 #   variable QA_FACTORY_URL           URL API Qaify
-#   secret   CLAUDE_CODE_OAUTH_TOKEN  opsional: audit dengan Claude (langganan Claude Pro/Max Anda, `claude setup-token`)
-#   variable QA_FACTORY_AUDIT_MODE    opsional, `static` atau `claude` (default: claude bila secret di atas ada)
+#   secret   CLAUDE_CODE_OAUTH_TOKEN  opsional: perbaikan temuan & audit mode claude (langganan Claude Pro/Max, `claude setup-token`)
+#   variable QA_FACTORY_AUDIT_MODE    opsional, `static` / `claude`; hanya dipakai bila Qaify tidak mengirim mode
 #   variable QA_FACTORY_AI_MODEL      opsional, default sonnet
 #   variable QA_FACTORY_MCP_VERSION   opsional, versi @playwright/mcp (default latest)
 # GitHub App Qaify harus terpasang di repo ini dan di repo FE + BE. Nama file harus tetap qaify-audit.yml.
+# Mode audit dipilih di Qaify (setelan aplikasi, bisa diganti per audit); mode claude tanpa secret jatuh ke static.
 # Mode static (tanpa AI): build, test, composer/npm audit, dan smoke test Playwright; cepat, tanpa kuota AI,
-# tetapi tanpa analisis logika bisnis / kontrak API dari kode.
+# tetapi tanpa analisis logika bisnis / kontrak API dari kode. Temuannya tetap bisa diperbaiki Claude (qaify-fix.yml).
 # Mode claude: satu sesi Claude yang panjang; kuota langganan dipakai bersama pemakaian pribadi.
 name: Qaify audit
 run-name: audit ${{ inputs.audit_id }}
@@ -42,9 +43,8 @@ jobs:
         env: { POSTGRES_PASSWORD: postgres, POSTGRES_DB: app }
         ports: ['5432:5432']
         options: --health-cmd="pg_isready -U postgres" --health-interval=10s --health-timeout=5s --health-retries=10
-    # context runner tidak tersedia di env level job; WORK diisi lewat GITHUB_ENV di step pertama
-    env:
-      AUDIT_MODE: ${{ vars.QA_FACTORY_AUDIT_MODE || (secrets.CLAUDE_CODE_OAUTH_TOKEN != '' && 'claude' || 'static') }}
+    # context runner tidak tersedia di env level job; WORK diisi lewat GITHUB_ENV di step pertama,
+    # AUDIT_MODE di step "Tentukan mode audit" (mode baru diketahui dari konteks audit)
     steps:
       - name: Siapkan direktori kerja
         run: echo "WORK=$RUNNER_TEMP/qaify" >> "$GITHUB_ENV"
@@ -58,9 +58,7 @@ jobs:
           tools: composer
 
       - name: Pasang Qaify CLI
-        run: |
-          npm install -g qaify-playwright-reporter@0.5 playwright-core@1
-          if [ "$AUDIT_MODE" = claude ]; then npm install -g @anthropic-ai/claude-code; fi
+        run: npm install -g qaify-playwright-reporter@0.9 playwright-core@1
 
       # token clone sekali pakai (read-only, hanya repo FE + BE) dicabut sebelum auditor berjalan
       - name: Ambil konteks & clone repo FE + BE
@@ -70,6 +68,25 @@ jobs:
           QA_FACTORY_TOKEN: ${{ secrets.QA_FACTORY_TOKEN }}
         run: qaify audit-context --audit "${{ inputs.audit_id }}" --dir "$WORK"
 
+      # pilihan Qaify → variable QA_FACTORY_AUDIT_MODE → claude bila secret ada; claude tanpa secret → static
+      - name: Tentukan mode audit
+        if: steps.ctx.outputs.ok == 'true'
+        env:
+          REQUESTED: ${{ steps.ctx.outputs.mode || vars.QA_FACTORY_AUDIT_MODE }}
+          HAS_CLAUDE: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }}
+        run: |
+          mode="${REQUESTED:-$([ "$HAS_CLAUDE" = true ] && echo claude || echo static)}"
+          if [ "$mode" != static ] && [ "$mode" != claude ]; then
+            echo "::warning::Mode audit tidak dikenal ($mode); memakai static."
+            mode=static
+          fi
+          if [ "$mode" = claude ] && [ "$HAS_CLAUDE" != true ]; then
+            echo "::warning::Mode claude diminta tetapi secret CLAUDE_CODE_OAUTH_TOKEN kosong; audit dijalankan tanpa AI."
+            mode=static
+          fi
+          echo "qa-factory: mode audit $mode"
+          echo "AUDIT_MODE=$mode" >> "$GITHUB_ENV"
+
       # tanpa secret apa pun: kode aplikasi (composer/npm script) berjalan di step ini
       - name: Audit tanpa AI (Playwright)
         if: steps.ctx.outputs.ok == 'true' && env.AUDIT_MODE == 'static'
@@ -80,6 +97,7 @@ jobs:
       - name: Siapkan instruksi & Playwright MCP
         if: steps.ctx.outputs.ok == 'true' && env.AUDIT_MODE == 'claude'
         run: |
+          npm install -g @anthropic-ai/claude-code
           mkdir -p "$WORK/.qaify"
           qaify audit-schema --out "$WORK/.qaify/schema.json" --instructions "$WORK/.qaify/instructions.txt"
           # Google Chrome sudah ada di runner ubuntu-latest

package/templates/qaify-fix.yml

@@ -6,6 +6,8 @@
 #   secret   CLAUDE_CODE_OAUTH_TOKEN  langganan Claude Pro/Max Anda (`claude setup-token`); wajib untuk perbaikan
 # GitHub App Qaify butuh izin Contents: Read and write dan Pull requests: Read and write di repo FE/BE.
 # Model (haiku / sonnet / opus atau versi tertentu) dipilih Qaify per temuan menurut kompleksitas atau pilihan Anda.
+# Advisory dependensi (composer.lock / package-lock.json) diperbaiki tanpa Claude: `qaify fix-deps` memperbarui
+# paketnya di lockfile (mode deps), tanpa memakai kuota.
 # Job "fix" menjalankan Claude tanpa token push; job "submit" (VM bersih) meng-clone ulang, menerapkan patch, lalu push.
 # Nama file harus tetap qaify-fix.yml.
 name: Qaify fix
@@ -54,7 +56,7 @@ jobs:
           tools: composer
 
       - name: Pasang Qaify CLI & Claude Code
-        run: npm install -g qaify-playwright-reporter@0.5 @anthropic-ai/claude-code
+        run: npm install -g qaify-playwright-reporter@0.9 @anthropic-ai/claude-code
 
       # token clone sekali pakai (read-only, hanya repo target) dicabut sebelum Claude berjalan
       - name: Ambil temuan & clone repo target
@@ -66,9 +68,16 @@ jobs:
           qaify fix-context --fix "${{ inputs.fix_id }}" --dir "$WORK"
           qaify fix-schema --out "$WORK/.qaify/schema.json" --instructions "$WORK/.qaify/instructions.txt"
 
+      # advisory dependensi: update lockfile tanpa AI, tidak ada token apa pun di step ini
+      - name: Perbarui dependensi (tanpa AI)
+        if: steps.ctx.outputs.ok == 'true' && steps.ctx.outputs.mode == 'deps'
+        continue-on-error: true
+        timeout-minutes: 15
+        run: qaify fix-deps --dir "$WORK"
+
       # hanya CLAUDE_CODE_OAUTH_TOKEN yang tersedia di step ini; tidak ada token Qaify maupun token push
       - name: Perbaiki dengan Claude Code (Claude Pro/Max)
-        if: steps.ctx.outputs.ok == 'true'
+        if: steps.ctx.outputs.ok == 'true' && steps.ctx.outputs.mode != 'deps'
         continue-on-error: true
         timeout-minutes: 45
         working-directory: ${{ runner.temp }}/qaify/repo
@@ -109,7 +118,7 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 22 }
       - name: Pasang Qaify CLI
-        run: npm install -g qaify-playwright-reporter@0.5
+        run: npm install -g qaify-playwright-reporter@0.9
       - uses: actions/download-artifact@v4
         continue-on-error: true
         with: