Files
Dragan Spiridonov 9d3b514ee2 fix(v3.9.14): second P0/P1 wave from QE audit follow-up
Security (M-01):
- src/cli/commands/learning.ts: replace execSync shell-interpolation of
  the user-controlled --file path with execFileSync + file-descriptor
  redirect (dump) and stdin input (import). Closes the command-injection
  vector where a crafted --file="x.db\"; rm -rf ~; \"" would escape
  shell quoting.

Build / supply chain:
- Move @claude-flow/guidance from dependencies to optionalDependencies
  alongside @claude-flow/browser. No stable successor exists on npm;
  usage is already guarded by try/await-import/catch fallbacks so
  demotion is safe. Documented in the follow-up research memo.
- Lazy-load @faker-js/faker via dynamic import in
  test-data-generator.ts and mark it external in build-cli.mjs /
  build-mcp.mjs. Faker is a devDep that previously got statically
  bundled into shipped artefacts because of a top-level import. Tarball
  drops 11.5 MB → 9.6 MB.

MCP API contracts:
- Add required:true to semantically load-bearing first parameters on
  agent_metrics (agentId), coverage_analyze_sublinear (target),
  accessibility_test (url), defect_predict (target), code_index
  (target). Verified via live MCP tools/list handshake — required
  arrays now match the intent documented in each tool's description.

CI hygiene:
- Rewrite the "Commit telemetry data" step in
  qcsd-production-trigger.yml to push to a bot branch and open a PR
  instead of `git push` direct to protected main. That push failed 8/10
  runs on the last audit cycle because of branch protection. Artifact
  upload (already present) continues to preserve the raw payload for 90
  days regardless of whether the PR lands.

Verification:
- npm audit --omit=dev: 0 critical, 0 high (1 moderate in
  @mapbox/node-pre-gyp — extraneous, pre-existing, unrelated).
- npm run typecheck: clean.
- CLI + MCP bundles rebuild successfully.
- 253/253 test-generation unit tests pass.
- Live MCP protocol smoke: new required flags visible on tools/list;
  advisor_consult guard from v3.9.14 round 1 still fires.

Memory note: see feedback_cli_is_aqe.md — CLAUDE.md ruflo refs were
audited. Only 2 lines (204, 260-261) are stale AQE-product refs; the
other 11 swarm/memory/daemon ruflo commands are legitimate
orchestration-layer invocations and are intentionally retained.
Deferred to a dedicated docs PR so the user can review each.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-20 12:47:06 +00:00

233 lines
9.0 KiB
YAML

name: QCSD Production Telemetry Collection
on:
# After npm publish workflow succeeds
workflow_run:
workflows: ["Publish to npm"]
types: [completed]
# Weekly health check - Monday 6 AM UTC — disabled: collect-production-telemetry.sh
# fails (missing dependencies or config). Re-enable once script is fixed. See #350.
# schedule:
# - cron: '0 6 * * 1'
# Manual trigger
workflow_dispatch:
inputs:
release_id:
description: 'Release version (e.g., v3.6.9). Leave empty for latest.'
required: false
type: string
lookback_days:
description: 'Days of history to analyze'
required: false
default: '30'
type: string
permissions:
contents: write
issues: write
actions: read
jobs:
collect-telemetry:
name: Collect Production Telemetry
runs-on: ubuntu-latest
timeout-minutes: 10
# Skip if workflow_run triggered by a failed publish
if: >
github.event_name != 'workflow_run' ||
github.event.workflow_run.conclusion == 'success'
outputs:
release_id: ${{ steps.resolve.outputs.release_id }}
telemetry_file: ${{ steps.collect.outputs.telemetry_file }}
dora_summary: ${{ steps.collect.outputs.dora_summary }}
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
token: ${{ secrets.GITHUB_TOKEN }}
- name: Resolve release ID
id: resolve
run: |
if [ -n "${{ inputs.release_id }}" ]; then
RELEASE_ID="${{ inputs.release_id }}"
elif [ "${{ github.event_name }}" = "workflow_run" ]; then
# Get the release that triggered the publish workflow
RELEASE_ID=$(gh release view --json tagName -q '.tagName' 2>/dev/null || echo "unknown")
else
# Schedule or fallback: use latest release
RELEASE_ID=$(gh release view --json tagName -q '.tagName' 2>/dev/null || echo "unknown")
fi
echo "release_id=${RELEASE_ID}" >> "$GITHUB_OUTPUT"
echo "Resolved release ID: ${RELEASE_ID}"
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Determine trigger type
id: trigger
run: |
case "${{ github.event_name }}" in
workflow_run) echo "type=post-deploy" >> "$GITHUB_OUTPUT" ;;
schedule) echo "type=scheduled" >> "$GITHUB_OUTPUT" ;;
*) echo "type=manual" >> "$GITHUB_OUTPUT" ;;
esac
- name: Collect telemetry
id: collect
run: |
chmod +x scripts/collect-production-telemetry.sh
scripts/collect-production-telemetry.sh \
--release-id "${{ steps.resolve.outputs.release_id }}" \
--lookback "${{ inputs.lookback_days || '30' }}" \
--trigger-type "${{ steps.trigger.outputs.type }}"
TELEMETRY_FILE="docs/telemetry/production/latest.json"
echo "telemetry_file=${TELEMETRY_FILE}" >> "$GITHUB_OUTPUT"
# Extract summary for issue body
if [ -f "$TELEMETRY_FILE" ]; then
FREQ=$(jq -r '.dora.deploymentFrequency.value // "N/A"' "$TELEMETRY_FILE")
LEAD=$(jq -r '.dora.leadTime.value // "N/A"' "$TELEMETRY_FILE")
CFR=$(jq -r '.dora.changeFailureRate.value // "N/A"' "$TELEMETRY_FILE")
MTTR=$(jq -r '.dora.mttr.value // "N/A"' "$TELEMETRY_FILE")
BUGS=$(jq -r '.issues.openBugs // "N/A"' "$TELEMETRY_FILE")
SUMMARY="Freq: ${FREQ}/wk | Lead: ${LEAD}h | CFR: ${CFR}% | MTTR: ${MTTR}h | Bugs: ${BUGS}"
echo "dora_summary=${SUMMARY}" >> "$GITHUB_OUTPUT"
fi
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Commit telemetry data via PR
# Telemetry must not be pushed directly to the protected main branch.
# Historically this step ran `git push` against main, which failed 8/10
# times because of branch protection. Instead we push to a bot branch
# and open a PR; a maintainer reviews/merges it on their own schedule.
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add docs/telemetry/production/
if git diff --cached --quiet; then
echo "No telemetry changes to commit"
exit 0
fi
RELEASE_ID="${{ steps.resolve.outputs.release_id }}"
BRANCH="telemetry/${RELEASE_ID}-$(date -u +%Y%m%d-%H%M%S)"
git checkout -b "$BRANCH"
git commit -m "chore(telemetry): production metrics for ${RELEASE_ID}"
git push --set-upstream origin "$BRANCH"
# Ensure labels exist (idempotent — signal-readiness job recreates these too)
gh label create "automated" --color "6C757D" --force 2>/dev/null || true
gh label create "qcsd-production-trigger" --color "0E8A16" --force 2>/dev/null || true
PR_BODY=$(cat <<PRBODY
Automated telemetry collection for release \`${RELEASE_ID}\`.
This PR adds the DORA snapshot under \`docs/telemetry/production/\`.
Opened by the \`qcsd-production-trigger\` workflow — merge at your
discretion. The artifact upload step on the parent workflow preserves
the raw payload for 90 days regardless of whether this PR lands.
PRBODY
)
gh pr create \
--base main \
--head "$BRANCH" \
--title "chore(telemetry): production metrics for ${RELEASE_ID}" \
--body "$PR_BODY" \
--label "automated,qcsd-production-trigger"
- name: Upload telemetry artifact
uses: actions/upload-artifact@v4
with:
name: production-telemetry-${{ steps.resolve.outputs.release_id }}
path: docs/telemetry/production/
retention-days: 90
- name: Step summary
run: |
RELEASE_ID="${{ steps.resolve.outputs.release_id }}"
TRIGGER="${{ steps.trigger.outputs.type }}"
{
echo "## QCSD Production Telemetry Collected"
echo ""
echo "| Field | Value |"
echo "|-------|-------|"
echo "| Release | \`${RELEASE_ID}\` |"
echo "| Trigger | ${TRIGGER} |"
echo "| DORA | ${{ steps.collect.outputs.dora_summary }} |"
echo ""
echo "### Invoke Production Swarm"
echo "\`\`\`"
echo "/qcsd-production-swarm TELEMETRY_DATA=docs/telemetry/production/latest.json RELEASE_ID=${RELEASE_ID}"
echo "\`\`\`"
} >> "$GITHUB_STEP_SUMMARY"
signal-readiness:
name: Signal Production Swarm Readiness
runs-on: ubuntu-latest
needs: collect-telemetry
timeout-minutes: 5
steps:
- name: Create or update trigger issue
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
RELEASE_ID="${{ needs.collect-telemetry.outputs.release_id }}"
DORA="${{ needs.collect-telemetry.outputs.dora_summary }}"
TRIGGER="${{ github.event_name }}"
TITLE="[QCSD] Production Health Check Ready - ${RELEASE_ID}"
BODY=$(cat <<'ISSUE_EOF'
## Production Telemetry Collected
**Release:** `RELEASE_PLACEHOLDER`
**Trigger:** TRIGGER_PLACEHOLDER
**DORA:** DORA_PLACEHOLDER
### Invoke Production Swarm
Run in Claude Code:
```
/qcsd-production-swarm TELEMETRY_DATA=docs/telemetry/production/latest.json RELEASE_ID=RELEASE_PLACEHOLDER
```
### What This Does
The QCSD Production Swarm will:
1. Load pre-collected DORA metrics from `docs/telemetry/production/latest.json`
2. Detect domain flags from production context
3. Spawn 3 core agents (DORA optimizer, defect predictor, root cause analyzer)
4. Spawn conditional agents based on flags
5. Produce a **HEALTHY / DEGRADED / CRITICAL** verdict
6. Feed learnings back to Ideation and Refinement phases
---
*Auto-generated by QCSD Production Telemetry workflow*
ISSUE_EOF
)
BODY="${BODY//RELEASE_PLACEHOLDER/$RELEASE_ID}"
BODY="${BODY//TRIGGER_PLACEHOLDER/$TRIGGER}"
BODY="${BODY//DORA_PLACEHOLDER/$DORA}"
# Ensure labels exist (gh issue create does not auto-create them)
gh label create "qcsd-production-trigger" --color "0E8A16" --force 2>/dev/null || true
gh label create "automated" --color "6C757D" --force 2>/dev/null || true
# Close any existing open trigger issues
EXISTING=$(gh issue list --label "qcsd-production-trigger" --state open --json number -q '.[].number' 2>/dev/null || echo "")
for ISSUE_NUM in $EXISTING; do
gh issue close "$ISSUE_NUM" --comment "Superseded by new telemetry collection for ${RELEASE_ID}"
done
# Create new issue
gh issue create \
--title "$TITLE" \
--body "$BODY" \
--label "qcsd-production-trigger,automated"