mirror of
https://github.com/proffesor-for-testing/agentic-qe.git
synced 2026-09-19 08:45:47 +08:00
9d3b514ee2
Security (M-01): - src/cli/commands/learning.ts: replace execSync shell-interpolation of the user-controlled --file path with execFileSync + file-descriptor redirect (dump) and stdin input (import). Closes the command-injection vector where a crafted --file="x.db\"; rm -rf ~; \"" would escape shell quoting. Build / supply chain: - Move @claude-flow/guidance from dependencies to optionalDependencies alongside @claude-flow/browser. No stable successor exists on npm; usage is already guarded by try/await-import/catch fallbacks so demotion is safe. Documented in the follow-up research memo. - Lazy-load @faker-js/faker via dynamic import in test-data-generator.ts and mark it external in build-cli.mjs / build-mcp.mjs. Faker is a devDep that previously got statically bundled into shipped artefacts because of a top-level import. Tarball drops 11.5 MB → 9.6 MB. MCP API contracts: - Add required:true to semantically load-bearing first parameters on agent_metrics (agentId), coverage_analyze_sublinear (target), accessibility_test (url), defect_predict (target), code_index (target). Verified via live MCP tools/list handshake — required arrays now match the intent documented in each tool's description. CI hygiene: - Rewrite the "Commit telemetry data" step in qcsd-production-trigger.yml to push to a bot branch and open a PR instead of `git push` direct to protected main. That push failed 8/10 runs on the last audit cycle because of branch protection. Artifact upload (already present) continues to preserve the raw payload for 90 days regardless of whether the PR lands. Verification: - npm audit --omit=dev: 0 critical, 0 high (1 moderate in @mapbox/node-pre-gyp — extraneous, pre-existing, unrelated). - npm run typecheck: clean. - CLI + MCP bundles rebuild successfully. - 253/253 test-generation unit tests pass. - Live MCP protocol smoke: new required flags visible on tools/list; advisor_consult guard from v3.9.14 round 1 still fires. Memory note: see feedback_cli_is_aqe.md — CLAUDE.md ruflo refs were audited. Only 2 lines (204, 260-261) are stale AQE-product refs; the other 11 swarm/memory/daemon ruflo commands are legitimate orchestration-layer invocations and are intentionally retained. Deferred to a dedicated docs PR so the user can review each. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
233 lines
9.0 KiB
YAML
233 lines
9.0 KiB
YAML
name: QCSD Production Telemetry Collection
|
|
|
|
on:
|
|
# After npm publish workflow succeeds
|
|
workflow_run:
|
|
workflows: ["Publish to npm"]
|
|
types: [completed]
|
|
|
|
# Weekly health check - Monday 6 AM UTC — disabled: collect-production-telemetry.sh
|
|
# fails (missing dependencies or config). Re-enable once script is fixed. See #350.
|
|
# schedule:
|
|
# - cron: '0 6 * * 1'
|
|
|
|
# Manual trigger
|
|
workflow_dispatch:
|
|
inputs:
|
|
release_id:
|
|
description: 'Release version (e.g., v3.6.9). Leave empty for latest.'
|
|
required: false
|
|
type: string
|
|
lookback_days:
|
|
description: 'Days of history to analyze'
|
|
required: false
|
|
default: '30'
|
|
type: string
|
|
|
|
permissions:
|
|
contents: write
|
|
issues: write
|
|
actions: read
|
|
|
|
jobs:
|
|
collect-telemetry:
|
|
name: Collect Production Telemetry
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
# Skip if workflow_run triggered by a failed publish
|
|
if: >
|
|
github.event_name != 'workflow_run' ||
|
|
github.event.workflow_run.conclusion == 'success'
|
|
|
|
outputs:
|
|
release_id: ${{ steps.resolve.outputs.release_id }}
|
|
telemetry_file: ${{ steps.collect.outputs.telemetry_file }}
|
|
dora_summary: ${{ steps.collect.outputs.dora_summary }}
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Resolve release ID
|
|
id: resolve
|
|
run: |
|
|
if [ -n "${{ inputs.release_id }}" ]; then
|
|
RELEASE_ID="${{ inputs.release_id }}"
|
|
elif [ "${{ github.event_name }}" = "workflow_run" ]; then
|
|
# Get the release that triggered the publish workflow
|
|
RELEASE_ID=$(gh release view --json tagName -q '.tagName' 2>/dev/null || echo "unknown")
|
|
else
|
|
# Schedule or fallback: use latest release
|
|
RELEASE_ID=$(gh release view --json tagName -q '.tagName' 2>/dev/null || echo "unknown")
|
|
fi
|
|
echo "release_id=${RELEASE_ID}" >> "$GITHUB_OUTPUT"
|
|
echo "Resolved release ID: ${RELEASE_ID}"
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Determine trigger type
|
|
id: trigger
|
|
run: |
|
|
case "${{ github.event_name }}" in
|
|
workflow_run) echo "type=post-deploy" >> "$GITHUB_OUTPUT" ;;
|
|
schedule) echo "type=scheduled" >> "$GITHUB_OUTPUT" ;;
|
|
*) echo "type=manual" >> "$GITHUB_OUTPUT" ;;
|
|
esac
|
|
|
|
- name: Collect telemetry
|
|
id: collect
|
|
run: |
|
|
chmod +x scripts/collect-production-telemetry.sh
|
|
scripts/collect-production-telemetry.sh \
|
|
--release-id "${{ steps.resolve.outputs.release_id }}" \
|
|
--lookback "${{ inputs.lookback_days || '30' }}" \
|
|
--trigger-type "${{ steps.trigger.outputs.type }}"
|
|
|
|
TELEMETRY_FILE="docs/telemetry/production/latest.json"
|
|
echo "telemetry_file=${TELEMETRY_FILE}" >> "$GITHUB_OUTPUT"
|
|
|
|
# Extract summary for issue body
|
|
if [ -f "$TELEMETRY_FILE" ]; then
|
|
FREQ=$(jq -r '.dora.deploymentFrequency.value // "N/A"' "$TELEMETRY_FILE")
|
|
LEAD=$(jq -r '.dora.leadTime.value // "N/A"' "$TELEMETRY_FILE")
|
|
CFR=$(jq -r '.dora.changeFailureRate.value // "N/A"' "$TELEMETRY_FILE")
|
|
MTTR=$(jq -r '.dora.mttr.value // "N/A"' "$TELEMETRY_FILE")
|
|
BUGS=$(jq -r '.issues.openBugs // "N/A"' "$TELEMETRY_FILE")
|
|
SUMMARY="Freq: ${FREQ}/wk | Lead: ${LEAD}h | CFR: ${CFR}% | MTTR: ${MTTR}h | Bugs: ${BUGS}"
|
|
echo "dora_summary=${SUMMARY}" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Commit telemetry data via PR
|
|
# Telemetry must not be pushed directly to the protected main branch.
|
|
# Historically this step ran `git push` against main, which failed 8/10
|
|
# times because of branch protection. Instead we push to a bot branch
|
|
# and open a PR; a maintainer reviews/merges it on their own schedule.
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
git add docs/telemetry/production/
|
|
if git diff --cached --quiet; then
|
|
echo "No telemetry changes to commit"
|
|
exit 0
|
|
fi
|
|
RELEASE_ID="${{ steps.resolve.outputs.release_id }}"
|
|
BRANCH="telemetry/${RELEASE_ID}-$(date -u +%Y%m%d-%H%M%S)"
|
|
git checkout -b "$BRANCH"
|
|
git commit -m "chore(telemetry): production metrics for ${RELEASE_ID}"
|
|
git push --set-upstream origin "$BRANCH"
|
|
# Ensure labels exist (idempotent — signal-readiness job recreates these too)
|
|
gh label create "automated" --color "6C757D" --force 2>/dev/null || true
|
|
gh label create "qcsd-production-trigger" --color "0E8A16" --force 2>/dev/null || true
|
|
PR_BODY=$(cat <<PRBODY
|
|
Automated telemetry collection for release \`${RELEASE_ID}\`.
|
|
|
|
This PR adds the DORA snapshot under \`docs/telemetry/production/\`.
|
|
Opened by the \`qcsd-production-trigger\` workflow — merge at your
|
|
discretion. The artifact upload step on the parent workflow preserves
|
|
the raw payload for 90 days regardless of whether this PR lands.
|
|
PRBODY
|
|
)
|
|
gh pr create \
|
|
--base main \
|
|
--head "$BRANCH" \
|
|
--title "chore(telemetry): production metrics for ${RELEASE_ID}" \
|
|
--body "$PR_BODY" \
|
|
--label "automated,qcsd-production-trigger"
|
|
|
|
- name: Upload telemetry artifact
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: production-telemetry-${{ steps.resolve.outputs.release_id }}
|
|
path: docs/telemetry/production/
|
|
retention-days: 90
|
|
|
|
- name: Step summary
|
|
run: |
|
|
RELEASE_ID="${{ steps.resolve.outputs.release_id }}"
|
|
TRIGGER="${{ steps.trigger.outputs.type }}"
|
|
{
|
|
echo "## QCSD Production Telemetry Collected"
|
|
echo ""
|
|
echo "| Field | Value |"
|
|
echo "|-------|-------|"
|
|
echo "| Release | \`${RELEASE_ID}\` |"
|
|
echo "| Trigger | ${TRIGGER} |"
|
|
echo "| DORA | ${{ steps.collect.outputs.dora_summary }} |"
|
|
echo ""
|
|
echo "### Invoke Production Swarm"
|
|
echo "\`\`\`"
|
|
echo "/qcsd-production-swarm TELEMETRY_DATA=docs/telemetry/production/latest.json RELEASE_ID=${RELEASE_ID}"
|
|
echo "\`\`\`"
|
|
} >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
signal-readiness:
|
|
name: Signal Production Swarm Readiness
|
|
runs-on: ubuntu-latest
|
|
needs: collect-telemetry
|
|
timeout-minutes: 5
|
|
|
|
steps:
|
|
- name: Create or update trigger issue
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
RELEASE_ID="${{ needs.collect-telemetry.outputs.release_id }}"
|
|
DORA="${{ needs.collect-telemetry.outputs.dora_summary }}"
|
|
TRIGGER="${{ github.event_name }}"
|
|
TITLE="[QCSD] Production Health Check Ready - ${RELEASE_ID}"
|
|
|
|
BODY=$(cat <<'ISSUE_EOF'
|
|
## Production Telemetry Collected
|
|
|
|
**Release:** `RELEASE_PLACEHOLDER`
|
|
**Trigger:** TRIGGER_PLACEHOLDER
|
|
**DORA:** DORA_PLACEHOLDER
|
|
|
|
### Invoke Production Swarm
|
|
|
|
Run in Claude Code:
|
|
```
|
|
/qcsd-production-swarm TELEMETRY_DATA=docs/telemetry/production/latest.json RELEASE_ID=RELEASE_PLACEHOLDER
|
|
```
|
|
|
|
### What This Does
|
|
|
|
The QCSD Production Swarm will:
|
|
1. Load pre-collected DORA metrics from `docs/telemetry/production/latest.json`
|
|
2. Detect domain flags from production context
|
|
3. Spawn 3 core agents (DORA optimizer, defect predictor, root cause analyzer)
|
|
4. Spawn conditional agents based on flags
|
|
5. Produce a **HEALTHY / DEGRADED / CRITICAL** verdict
|
|
6. Feed learnings back to Ideation and Refinement phases
|
|
|
|
---
|
|
*Auto-generated by QCSD Production Telemetry workflow*
|
|
ISSUE_EOF
|
|
)
|
|
|
|
BODY="${BODY//RELEASE_PLACEHOLDER/$RELEASE_ID}"
|
|
BODY="${BODY//TRIGGER_PLACEHOLDER/$TRIGGER}"
|
|
BODY="${BODY//DORA_PLACEHOLDER/$DORA}"
|
|
|
|
# Ensure labels exist (gh issue create does not auto-create them)
|
|
gh label create "qcsd-production-trigger" --color "0E8A16" --force 2>/dev/null || true
|
|
gh label create "automated" --color "6C757D" --force 2>/dev/null || true
|
|
|
|
# Close any existing open trigger issues
|
|
EXISTING=$(gh issue list --label "qcsd-production-trigger" --state open --json number -q '.[].number' 2>/dev/null || echo "")
|
|
for ISSUE_NUM in $EXISTING; do
|
|
gh issue close "$ISSUE_NUM" --comment "Superseded by new telemetry collection for ${RELEASE_ID}"
|
|
done
|
|
|
|
# Create new issue
|
|
gh issue create \
|
|
--title "$TITLE" \
|
|
--body "$BODY" \
|
|
--label "qcsd-production-trigger,automated"
|