tribunal-kit 6.0.0 → 7.0.0

package/.agent/scripts/checklist.js

@@ -17,11 +17,11 @@
  *   node .agent/scripts/checklist.js . --skip security,seo
  */
 
-"use strict";
+'use strict';
 
-const fs = require("fs");
-const path = require("path");
-const { execFileSync } = require("child_process");
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
 
 const {
   RED,
@@ -37,30 +37,30 @@ const {
   timer,
   formatMs,
   fail,
-} = require("./_colors");
+} = require('./_colors');
 
-const { walkDir } = require("./_utils");
+const { walkDir } = require('./_utils');
 
 // ── Results Tracking ────────────────────────────────────────────────────────
 
 const RESULTS = [];
 
 function trackOk(label, ms) {
-  const timing = ms != null ? `${DIM}(${formatMs(ms)})${RESET}` : "";
+  const timing = ms != null ? `${DIM}(${formatMs(ms)})${RESET}` : '';
   console.log(`  ${GREEN}✅ ${label}${RESET} ${timing}`);
-  RESULTS.push({ name: label, status: "pass", ms });
+  RESULTS.push({ name: label, status: 'pass', ms });
 }
 
 function trackFail(label, ms, note) {
-  const timing = ms != null ? `${DIM}(${formatMs(ms)})${RESET}` : "";
+  const timing = ms != null ? `${DIM}(${formatMs(ms)})${RESET}` : '';
   console.log(`  ${RED}❌ ${label}${RESET} ${timing}`);
   if (note) console.log(`    ${note.slice(0, 500)}`);
-  RESULTS.push({ name: label, status: "fail", ms });
+  RESULTS.push({ name: label, status: 'fail', ms });
 }
 
 function trackSkip(label, reason) {
   console.log(`  ${YELLOW}⏭️  ${label} — ${reason}${RESET}`);
-  RESULTS.push({ name: label, status: "skip" });
+  RESULTS.push({ name: label, status: 'skip' });
 }
 
 /**
@@ -75,25 +75,25 @@ function runCheck(label, cmd, cwd) {
   try {
     execFileSync(cmd[0], cmd.slice(1), {
       cwd,
-      stdio: "pipe",
+      stdio: 'pipe',
       timeout: 60000,
-      encoding: "utf8",
-      shell: process.platform === "win32",
+      encoding: 'utf8',
+      shell: process.platform === 'win32',
     });
     trackOk(`${label} passed`, elapsed());
     return true;
   } catch (err) {
     const ms = elapsed();
-    if (err.code === "ENOENT") {
-      trackSkip(label, "command not found (tool not installed)");
+    if (err.code === 'ENOENT') {
+      trackSkip(label, 'command not found (tool not installed)');
       return true; // Don't block on tools that aren't installed
     }
     if (err.killed) {
-      trackFail(label, ms, "timed out after 60s");
+      trackFail(label, ms, 'timed out after 60s');
       return false;
     }
-    const output = ((err.stdout || "") + (err.stderr || "")).trim();
-    trackFail(`${label} failed`, ms, output || "non-zero exit code");
+    const output = ((err.stdout || '') + (err.stderr || '')).trim();
+    trackFail(`${label} failed`, ms, output || 'non-zero exit code');
     return false;
   }
 }
@@ -107,38 +107,36 @@ function runCheck(label, cmd, cwd) {
 function checkSecrets(projectRoot) {
   const elapsed = timer();
   const dangerousPatterns = [
-    "password=",
-    "secret=",
-    "api_key=",
-    "apikey=",
-    "auth_token=",
-    "private_key=",
+    'password=',
+    'secret=',
+    'api_key=',
+    'apikey=',
+    'auth_token=',
+    'private_key=',
   ];
   let foundIssues = false;
-  const sourceExtensions = new Set([".ts", ".tsx", ".js", ".jsx", ".py"]);
+  const sourceExtensions = new Set(['.ts', '.tsx', '.js', '.jsx', '.py']);
 
   const files = walkDir(projectRoot, { extensions: sourceExtensions });
 
   for (const fullPath of files) {
     // Skip .env files — they are allowed to contain secrets
-    if (path.basename(fullPath).startsWith(".env")) continue;
+    if (path.basename(fullPath).startsWith('.env')) continue;
 
     let content;
     try {
-      content = fs.readFileSync(fullPath, "utf8");
+      content = fs.readFileSync(fullPath, 'utf8');
     } catch {
       continue;
     }
 
-    const lines = content.split("\n");
+    const lines = content.split('\n');
     for (let i = 0; i < lines.length; i++) {
       const lineLower = lines[i].toLowerCase().trim();
-      const hasPattern = dangerousPatterns.some((p) => lineLower.includes(p));
-      if (hasPattern && lineLower.includes("=") && !lineLower.startsWith("#")) {
+      const hasPattern = dangerousPatterns.some(p => lineLower.includes(p));
+      if (hasPattern && lineLower.includes('=') && !lineLower.startsWith('#')) {
         const rel = path.relative(projectRoot, fullPath);
-        fail(
-          `Possible secret: ${rel}:${i + 1} → ${lines[i].trim().slice(0, 80)}`,
-        );
+        fail(`Possible secret: ${rel}:${i + 1} → ${lines[i].trim().slice(0, 80)}`);
         foundIssues = true;
       }
     }
@@ -148,7 +146,7 @@ function checkSecrets(projectRoot) {
   if (!foundIssues) {
     trackOk(`Secret scan — ${files.length} files clean`, ms);
   } else {
-    trackFail("Secret scan — hardcoded credentials detected", ms);
+    trackFail('Secret scan — hardcoded credentials detected', ms);
   }
   return !foundIssues;
 }
@@ -166,76 +164,61 @@ function runAll(projectRoot, url, skipTiers) {
   const totalTimer = timer();
 
   // Priority 1 — Security
-  if (!skipTiers.includes("security")) {
-    console.log(sectionHeader("Security — Secret Scan", 1));
+  if (!skipTiers.includes('security')) {
+    console.log(sectionHeader('Security — Secret Scan', 1));
     if (!checkSecrets(projectRoot)) failures++;
   } else {
-    trackSkip("Security", "skipped by flag");
+    trackSkip('Security', 'skipped by flag');
   }
 
   // Priority 2 — Lint
-  if (!skipTiers.includes("lint")) {
-    console.log(sectionHeader("Lint", 2));
-    if (
-      !runCheck(
-        "ESLint",
-        ["npx", "eslint", ".", "--max-warnings=0"],
-        projectRoot,
-      )
-    )
-      failures++;
-    if (!runCheck("TypeScript", ["npx", "tsc", "--noEmit"], projectRoot))
-      failures++;
+  if (!skipTiers.includes('lint')) {
+    console.log(sectionHeader('Lint', 2));
+    if (!runCheck('ESLint', ['npx', 'eslint', '.', '--max-warnings=0'], projectRoot)) failures++;
+    if (!runCheck('TypeScript', ['npx', 'tsc', '--noEmit'], projectRoot)) failures++;
   } else {
-    trackSkip("Lint", "skipped by flag");
+    trackSkip('Lint', 'skipped by flag');
   }
 
   // Priority 3 — Schema
-  if (!skipTiers.includes("schema")) {
-    console.log(sectionHeader("Schema Validation", 3));
-    trackSkip("Schema", "run manually if you have DB migrations");
+  if (!skipTiers.includes('schema')) {
+    console.log(sectionHeader('Schema Validation', 3));
+    trackSkip('Schema', 'run manually if you have DB migrations');
   } else {
-    trackSkip("Schema", "skipped by flag");
+    trackSkip('Schema', 'skipped by flag');
   }
 
   // Priority 4 — Tests
-  if (!skipTiers.includes("tests")) {
-    console.log(sectionHeader("Tests", 4));
-    if (
-      !runCheck(
-        "Test suite",
-        ["npm", "test", "--", "--passWithNoTests"],
-        projectRoot,
-      )
-    )
+  if (!skipTiers.includes('tests')) {
+    console.log(sectionHeader('Tests', 4));
+    if (!runCheck('Test suite', ['npm', 'test', '--', '--passWithNoTests'], projectRoot))
       failures++;
   } else {
-    trackSkip("Tests", "skipped by flag");
+    trackSkip('Tests', 'skipped by flag');
   }
 
   // Priority 5 — UX
-  if (!skipTiers.includes("ux")) {
-    console.log(sectionHeader("UX / Accessibility", 5));
-    trackSkip("UX audit", "run /preview start then check with Lighthouse");
+  if (!skipTiers.includes('ux')) {
+    console.log(sectionHeader('UX / Accessibility', 5));
+    trackSkip('UX audit', 'run /preview start then check with Lighthouse');
   } else {
-    trackSkip("UX", "skipped by flag");
+    trackSkip('UX', 'skipped by flag');
   }
 
   // Priority 6 — SEO
-  if (!skipTiers.includes("seo")) {
-    console.log(sectionHeader("SEO", 6));
-    trackSkip("SEO check", "use /ui-ux-pro-max for SEO-sensitive pages");
+  if (!skipTiers.includes('seo')) {
+    console.log(sectionHeader('SEO', 6));
+    trackSkip('SEO check', 'use /ui-ux-pro-max for SEO-sensitive pages');
   } else {
-    trackSkip("SEO", "skipped by flag");
+    trackSkip('SEO', 'skipped by flag');
   }
 
   // Priority 7 — Lighthouse / E2E
-  if (url && !skipTiers.includes("e2e")) {
-    console.log(sectionHeader("Lighthouse / E2E", 7));
-    if (!runCheck("Playwright E2E", ["npx", "playwright", "test"], projectRoot))
-      failures++;
+  if (url && !skipTiers.includes('e2e')) {
+    console.log(sectionHeader('Lighthouse / E2E', 7));
+    if (!runCheck('Playwright E2E', ['npx', 'playwright', 'test'], projectRoot)) failures++;
   } else if (!url) {
-    trackSkip("E2E / Lighthouse", "pass --url to enable");
+    trackSkip('E2E / Lighthouse', 'pass --url to enable');
   }
 
   // ━━━ Summary ━━━
@@ -243,22 +226,18 @@ function runAll(projectRoot, url, skipTiers) {
   console.log(`\n${BOLD}${CYAN}━━━ Checklist Summary ━━━${RESET}`);
   summaryTable(RESULTS);
 
-  const passCount = RESULTS.filter((r) => r.status === "pass").length;
-  const failCount = RESULTS.filter((r) => r.status === "fail").length;
-  const skipCount = RESULTS.filter((r) => r.status === "skip").length;
+  const passCount = RESULTS.filter(r => r.status === 'pass').length;
+  const failCount = RESULTS.filter(r => r.status === 'fail').length;
+  const skipCount = RESULTS.filter(r => r.status === 'skip').length;
 
+  console.log(`\n  ${DIM}Total: ${RESULTS.length} checks in ${formatMs(totalMs)}${RESET}`);
   console.log(
-    `\n  ${DIM}Total: ${RESULTS.length} checks in ${formatMs(totalMs)}${RESET}`,
-  );
-  console.log(
-    `  ${GREEN}${passCount} passed${RESET}  ${failCount > 0 ? `${RED}${failCount} failed${RESET}  ` : ""}${skipCount > 0 ? `${YELLOW}${skipCount} skipped${RESET}` : ""}`,
+    `  ${GREEN}${passCount} passed${RESET}  ${failCount > 0 ? `${RED}${failCount} failed${RESET}  ` : ''}${skipCount > 0 ? `${YELLOW}${skipCount} skipped${RESET}` : ''}`,
   );
 
   console.log();
   if (failures === 0) {
-    console.log(
-      `${GREEN}${BOLD}  ✔ All checks passed — ready to proceed.${RESET}`,
-    );
+    console.log(`${GREEN}${BOLD}  ✔ All checks passed — ready to proceed.${RESET}`);
   } else {
     console.log(
       `${RED}${BOLD}  ✖ ${failures} tier(s) failed — fix critical issues before proceeding.${RESET}`,
@@ -277,14 +256,14 @@ function parseArgs(argv) {
   const raw = argv.slice(2);
 
   for (let i = 0; i < raw.length; i++) {
-    if (raw[i] === "--url" && raw[i + 1]) {
+    if (raw[i] === '--url' && raw[i + 1]) {
       args.url = raw[++i];
-    } else if (raw[i] === "--skip" && raw[i + 1]) {
+    } else if (raw[i] === '--skip' && raw[i + 1]) {
       args.skip = raw[++i]
-        .split(",")
-        .map((s) => s.trim().toLowerCase())
+        .split(',')
+        .map(s => s.trim().toLowerCase())
         .filter(Boolean);
-    } else if (!raw[i].startsWith("--") && !args.path) {
+    } else if (!raw[i].startsWith('--') && !args.path) {
       args.path = raw[i];
     }
   }
@@ -307,7 +286,7 @@ function main() {
     process.exit(1);
   }
 
-  console.log(banner("checklist.js", { Project: projectRoot }));
+  console.log(banner('checklist.js', { Project: projectRoot }));
 
   const failures = runAll(projectRoot, args.url, args.skip);
   process.exit(failures > 0 ? 1 : 0);

package/.agent/scripts/cicd_validator.js

@@ -0,0 +1,305 @@
+#!/usr/bin/env node
+/**
+ * cicd_validator.js — Deterministic CI/CD & GitHub Actions Validator for Tribunal Kit.
+ *
+ * Scans .github/workflows/*.yml, .gitlab-ci.yml, and Dockerfiles for:
+ *   - Deprecated Action versions (v1-v3)
+ *   - Security vulnerabilities (pull_request_target injection, script injection)
+ *   - Concurrency race conditions
+ *   - Excessive permissions (permissions: write-all)
+ *   - Non-deterministic lockfile usage (npm install vs npm ci)
+ *   - Static credential patterns
+ *
+ * Usage:
+ *   node .agent/scripts/cicd_validator.js [target-directory]
+ *   node .agent/scripts/cicd_validator.js . --json
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const {
+  RED,
+  GREEN,
+  YELLOW,
+  BOLD,
+  RESET,
+  banner,
+  sectionHeader,
+  summaryTable,
+  timer,
+  formatMs,
+  ok,
+  fail,
+  warn,
+  skip,
+} = require('./_colors');
+
+const DEPRECATED_ACTIONS = [
+  { pattern: /actions\/checkout@(v[123]|master)/i, name: 'actions/checkout', recommended: '@v4' },
+  {
+    pattern: /actions\/setup-node@(v[123]|master)/i,
+    name: 'actions/setup-node',
+    recommended: '@v4',
+  },
+  {
+    pattern: /actions\/setup-python@(v[1234]|master)/i,
+    name: 'actions/setup-python',
+    recommended: '@v5',
+  },
+  {
+    pattern: /actions\/upload-artifact@(v[123]|master)/i,
+    name: 'actions/upload-artifact',
+    recommended: '@v4',
+  },
+  {
+    pattern: /actions\/download-artifact@(v[123]|master)/i,
+    name: 'actions/download-artifact',
+    recommended: '@v4',
+  },
+  {
+    pattern: /docker\/build-push-action@(v[1234]|master)/i,
+    name: 'docker/build-push-action',
+    recommended: '@v5',
+  },
+  {
+    pattern: /aws-actions\/configure-aws-credentials@(v[123]|master)/i,
+    name: 'aws-actions/configure-aws-credentials',
+    recommended: '@v4',
+  },
+];
+
+function findWorkflowFiles(dir) {
+  const files = [];
+  const githubWorkflows = path.join(dir, '.github', 'workflows');
+  if (fs.existsSync(githubWorkflows)) {
+    try {
+      const entries = fs.readdirSync(githubWorkflows);
+      for (const entry of entries) {
+        if (entry.endsWith('.yml') || entry.endsWith('.yaml')) {
+          files.push(path.join(githubWorkflows, entry));
+        }
+      }
+    } catch (_e) {}
+  }
+
+  const gitlabCi = path.join(dir, '.gitlab-ci.yml');
+  if (fs.existsSync(gitlabCi)) {
+    files.push(gitlabCi);
+  }
+
+  const dockerfile = path.join(dir, 'Dockerfile');
+  if (fs.existsSync(dockerfile)) {
+    files.push(dockerfile);
+  }
+
+  return files;
+}
+
+function auditWorkflowContent(filePath, content) {
+  const issues = [];
+  const lines = content.split('\n');
+  const isGithubWorkflow = filePath.includes('.github');
+
+  if (isGithubWorkflow) {
+    // Check for concurrency block
+    if (!content.includes('concurrency:')) {
+      const hasDeploy = /deploy|publish|release/i.test(content);
+      if (hasDeploy) {
+        issues.push({
+          level: 'WARN',
+          code: 'CI-03',
+          message:
+            "Deploy workflow is missing a top-level 'concurrency:' block to prevent race conditions.",
+        });
+      }
+    }
+
+    // Check for dangerous pull_request_target with head checkout
+    if (
+      content.includes('pull_request_target') &&
+      /github\.event\.pull_request\.head\.sha|github\.head_ref/i.test(content)
+    ) {
+      issues.push({
+        level: 'FAIL',
+        code: 'CI-02',
+        message:
+          "CRITICAL: 'pull_request_target' trigger with PR head checkout is vulnerable to pwn-request code execution.",
+      });
+    }
+
+    // Check for excessive permissions
+    if (/permissions:\s*write-all/i.test(content)) {
+      issues.push({
+        level: 'FAIL',
+        code: 'CI-04',
+        message: "'permissions: write-all' violates the principle of least privilege.",
+      });
+    }
+
+    // Check line by line
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const lineNum = i + 1;
+
+      // Deprecated actions
+      for (const dep of DEPRECATED_ACTIONS) {
+        if (dep.pattern.test(line)) {
+          issues.push({
+            level: 'FAIL',
+            code: 'CI-01',
+            line: lineNum,
+            message: `Deprecated action version '${dep.name}'. Upgrade to ${dep.recommended}.`,
+          });
+        }
+      }
+
+      // Script injection in run:
+      if (
+        /run:\s*.*?\$\{\{\s*github\.event\.(issue\.title|issue\.body|comment\.body|pull_request\.title)\s*\}\}/i.test(
+          line,
+        )
+      ) {
+        issues.push({
+          level: 'FAIL',
+          code: 'CI-10',
+          line: lineNum,
+          message:
+            "Script injection risk: Untrusted GitHub event context embedded directly in 'run:' command. Use environment variables.",
+        });
+      }
+
+      // Non-deterministic npm install in CI
+      if (/\brun:\s*.*?\bnpm\s+install\b(?!.*--dry-run)/i.test(line) && !/npm\s+ci/i.test(line)) {
+        issues.push({
+          level: 'WARN',
+          code: 'CI-06',
+          line: lineNum,
+          message:
+            "Use 'npm ci' instead of 'npm install' in CI pipelines for deterministic builds.",
+        });
+      }
+
+      // Static secret hardcoding
+      if (/AKIA[0-9A-Z]{16}/.test(line)) {
+        issues.push({
+          level: 'FAIL',
+          code: 'CI-05',
+          line: lineNum,
+          message: 'Hardcoded AWS Access Key ID detected.',
+        });
+      }
+    }
+  }
+
+  return issues;
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const targetDir = args.find(a => !a.startsWith('-')) || process.cwd();
+  const jsonOutput = args.includes('--json');
+
+  const elapsed = timer();
+  const files = findWorkflowFiles(targetDir);
+
+  if (!jsonOutput) {
+    banner('TRIBUNAL CI/CD PIPELINE VALIDATOR');
+    sectionHeader(`Scanning workflows in: ${path.resolve(targetDir)}`);
+  }
+
+  if (files.length === 0) {
+    if (jsonOutput) {
+      console.log(JSON.stringify({ files: 0, passes: 0, failures: 0, warnings: 0, issues: [] }));
+    } else {
+      skip('No CI/CD workflow files (.github/workflows, .gitlab-ci.yml, Dockerfile) found.');
+    }
+    process.exit(0);
+  }
+
+  let totalFailures = 0;
+  let totalWarnings = 0;
+  const allIssues = [];
+  const resultsTable = [];
+
+  for (const file of files) {
+    const relPath = path.relative(targetDir, file);
+    try {
+      const content = fs.readFileSync(file, 'utf8');
+      const fileIssues = auditWorkflowContent(file, content);
+
+      const failures = fileIssues.filter(i => i.level === 'FAIL');
+      const warnings = fileIssues.filter(i => i.level === 'WARN');
+
+      totalFailures += failures.length;
+      totalWarnings += warnings.length;
+
+      if (!jsonOutput) {
+        if (failures.length === 0 && warnings.length === 0) {
+          ok(`${relPath} — clean`);
+          resultsTable.push({ name: relPath, status: 'pass' });
+        } else if (failures.length > 0) {
+          fail(`${relPath} — ${failures.length} errors, ${warnings.length} warnings`);
+          for (const issue of fileIssues) {
+            const loc = issue.line ? `Line ${issue.line}: ` : '';
+            const color = issue.level === 'FAIL' ? RED : YELLOW;
+            console.log(`    ${color}[${issue.code}]${RESET} ${loc}${issue.message}`);
+          }
+          resultsTable.push({ name: relPath, status: 'fail' });
+        } else {
+          warn(`${relPath} — ${warnings.length} warnings`);
+          for (const issue of fileIssues) {
+            const loc = issue.line ? `Line ${issue.line}: ` : '';
+            console.log(`    ${YELLOW}[${issue.code}]${RESET} ${loc}${issue.message}`);
+          }
+          resultsTable.push({ name: relPath, status: 'warn' });
+        }
+      }
+
+      for (const issue of fileIssues) {
+        allIssues.push({ file: relPath, ...issue });
+      }
+    } catch (err) {
+      totalFailures++;
+      if (!jsonOutput) {
+        fail(`${relPath} — failed to read/parse: ${err.message}`);
+        resultsTable.push({ name: relPath, status: 'fail' });
+      }
+    }
+  }
+
+  const ms = elapsed();
+
+  if (jsonOutput) {
+    console.log(
+      JSON.stringify(
+        {
+          files: files.length,
+          failures: totalFailures,
+          warnings: totalWarnings,
+          durationMs: ms,
+          issues: allIssues,
+        },
+        null,
+        2,
+      ),
+    );
+  } else {
+    sectionHeader('Summary');
+    summaryTable(resultsTable);
+    console.log(
+      `\n${BOLD}Result:${RESET} ${totalFailures > 0 ? RED + 'FAILED' : GREEN + 'PASSED'}${RESET} ` +
+        `(${files.length} files scanned, ${totalFailures} errors, ${totalWarnings} warnings in ${formatMs(ms)})\n`,
+    );
+  }
+
+  process.exit(totalFailures > 0 ? 1 : 0);
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { auditWorkflowContent, findWorkflowFiles };