ruv d09a0e4cbd fix(ci): 5 CI failures — Build V3, Static guards, ADR-112, witness verify, supply-chain audit ...

Stacked fixes to clear the remaining red CI checks on \`main\` that pre-dated
the #2412 lockfile-cascade fix. Each one verified locally before commit.

1. **Build V3 (ubuntu/macos/windows)** — \`graph-edge-writer.ts\` did a static
   \`await import('better-sqlite3')\` which forces tsc to resolve the package's
   types at build time. \`better-sqlite3\` is in \`optionalDependencies\` (so
   CI doesn't install it) — type resolution failed with TS2307 on every
   platform. Routed the module name through a variable so the static analyzer
   stops trying to resolve it; runtime presence is still gated by the
   existing try/catch.

2. **Static regression guards (#2267)** — \`scripts/smoke-workflows-yaml.mjs\`
   crashed with \`SyntaxError: The requested module 'js-yaml' does not provide
   an export named 'default'\` after js-yaml dropped the synthetic default
   from its package exports. Switched to \`import * as yaml from 'js-yaml'\`.

3. **Tool description discoverability (ADR-112)** — two MCP tools regressed
   the no-guidance baseline (count went from 0 → 2):
     - \`metaharness_bench\` had no Use-when / Prefer / Pair-with hint
     - \`testgen_tdd_repair\` had \"Use when …\" in a *later* string
       fragment of a concatenated description, which the audit regex
       (single-quoted-literal-only) misses
   Added explicit \"Use when …\" guidance to the first fragment of each.
   Audit now reports 340/340 tools with guidance.

4. **witness verify precondition smoke (#1880)** — Root \`package-lock.json\`
   drifted: \`agentdb@3.0.0-alpha.16\` in lock vs \`^3.0.0-alpha.17\` in
   package.json (same root cause as #2412 but for the npm lockfile, not the
   pnpm one fixed last release). Every job that runs \`npm ci\` was failing
   at install. Regenerated via \`npm install --package-lock-only\`. Verified:
   \`npm ci --dry-run --legacy-peer-deps\` now exits 0.

5. **Supply-chain audit (#2046)** — \`plugins/ruflo-graph-intelligence\` had
   1 HIGH/CRITICAL unaccepted direct-dep finding:
     - \`ws@8.20.1\` pulled by \`sublinear-time-solver\` (GHSA-96hv-2xvq-fx4p,
       memory exhaustion DoS) — bumped root override \`ws >=8.18.4\` →
       \`>=8.21.0\` and added the same override to the plugin's own
       package.json so it propagates through the plugin's own npm install
     - \`@claude-flow/cli\` peerDep surfaces every HIGH transitive in cli's
       own tree inside the plugin's audit report — added a tracked,
       expiring accepted-finding (cli ships its own audit pipeline on
       every publish; the plugin doesn't redistribute cli's tree).
   Audit now reports \`OK: no hard-fail findings\`.

Verified locally:
  - \`npm run build\` in v3/@claude-flow/cli: clean
  - \`node scripts/smoke-workflows-yaml.mjs\`: exit 0, 53 workflows parsed
  - \`node scripts/audit-tool-descriptions.mjs\`: 340/340 with guidance, OK
  - \`npm ci --dry-run --legacy-peer-deps\` at repo root: exit 0
  - \`node scripts/audit-supply-chain.mjs\`: OK, no hard-fail findings

Co-Authored-By: RuFlo <ruv@ruv.net>

2026-06-25 18:18:19 -04:00

540 KiB

Raw Permalink Blame History

View Raw