mirror of
https://github.com/affaan-m/ECC.git
synced 2026-09-18 07:37:59 +02:00
754b8dd76c
* fix: make the installer runtime pass strict supply-chain vetting
Remediate the four enterprise supply-chain vetting blockers from
affaan-m/ECC#2502 so the installer runtime (package.json + manifests +
scripts/lib/**) passes strict exact-pin evidence policy:
1. Remove the package.json `postinstall` lifecycle script (it only echoed a
post-install banner) and move that banner to an explicit opt-in
`npm run welcome` command. No install-time lifecycle script remains.
2. Exact-pin every dependency in package.json (dependencies + devDependencies)
to the versions already resolved in package-lock.json; no ^/~ ranges.
3. Replace non-ASCII characters on the installer runtime script/config surface:
em-dashes (U+2014) in scripts/lib/{path-safety,install-executor,
install/link-rewrite}.js comments and the two "Itô" (U+00F4) occurrences in
manifests/{install-components,install-modules}.json descriptions become
ASCII, so strict-surface Unicode scanners are clean.
4. Drop the bare `require("ajv")` from scripts/lib/install-state.js; the file
already carries a complete hand-rolled validator enforcing the same
schemas/install-state.schema.json (ecc.install.v1) constraints, so the
installer closure is dependency-free (zero non-builtin bare requires).
Refs affaan-m/ECC#2502
* fix: avoid unpinned welcome invocations
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: validate translated skill frontmatter
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: repair skill frontmatter YAML
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
* fix: add MIT license to core skill manifests; pin verification-loop tsc invocation
* fix: preserve tsc/pyright exit status in verification-loop type-check (set -o pipefail)
* chore(deps): sync lockfiles with exact-pinned package.json
Regenerate package-lock.json and yarn.lock so the pinned dependency
specs are reflected in both lockfiles. npm ci and Yarn's --immutable
install now pass the sync check. The resolution tree is unchanged
(231 yarn resolutions, byte-identical set; zero npm transitive drift);
only the root descriptor strings move from ranges to the versions
already resolved in the committed lockfiles.
Addresses the Codex P1 on #2503.
---------
Signed-off-by: Samar Tomar <samar_tomar@hotmail.com>
Co-authored-by: Samarjeet Singh Tomar <samartomar@gmail.com>
101 lines
2.5 KiB
Markdown
101 lines
2.5 KiB
Markdown
---
|
||
name: springboot-verification
|
||
description: "Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR."
|
||
---
|
||
|
||
# Spring Boot 検証ループ
|
||
|
||
PR前、大きな変更後、デプロイ前に実行します。
|
||
|
||
## フェーズ1: ビルド
|
||
|
||
```bash
|
||
mvn -T 4 clean verify -DskipTests
|
||
# または
|
||
./gradlew clean assemble -x test
|
||
```
|
||
|
||
ビルドが失敗した場合は、停止して修正します。
|
||
|
||
## フェーズ2: 静的解析
|
||
|
||
Maven（一般的なプラグイン）:
|
||
```bash
|
||
mvn -T 4 spotbugs:check pmd:check checkstyle:check
|
||
```
|
||
|
||
Gradle（設定されている場合）:
|
||
```bash
|
||
./gradlew checkstyleMain pmdMain spotbugsMain
|
||
```
|
||
|
||
## フェーズ3: テスト + カバレッジ
|
||
|
||
```bash
|
||
mvn -T 4 test
|
||
mvn jacoco:report # 80%以上のカバレッジを確認
|
||
# または
|
||
./gradlew test jacocoTestReport
|
||
```
|
||
|
||
レポート:
|
||
- 総テスト数、合格/失敗
|
||
- カバレッジ%（行/分岐）
|
||
|
||
## フェーズ4: セキュリティスキャン
|
||
|
||
```bash
|
||
# 依存関係のCVE
|
||
mvn org.owasp:dependency-check-maven:check
|
||
# または
|
||
./gradlew dependencyCheckAnalyze
|
||
|
||
# シークレット（git）
|
||
git secrets --scan # 設定されている場合
|
||
```
|
||
|
||
## フェーズ5: Lint/Format（オプションゲート）
|
||
|
||
```bash
|
||
mvn spotless:apply # Spotlessプラグインを使用している場合
|
||
./gradlew spotlessApply
|
||
```
|
||
|
||
## フェーズ6: 差分レビュー
|
||
|
||
```bash
|
||
git diff --stat
|
||
git diff
|
||
```
|
||
|
||
チェックリスト:
|
||
- デバッグログが残っていない（`System.out`、ガードなしの `log.debug`）
|
||
- 意味のあるエラーとHTTPステータス
|
||
- 必要な場所にトランザクションと検証がある
|
||
- 設定変更が文書化されている
|
||
|
||
## 出力テンプレート
|
||
|
||
```
|
||
検証レポート
|
||
===================
|
||
ビルド: [合格/不合格]
|
||
静的解析: [合格/不合格] (spotbugs/pmd/checkstyle)
|
||
テスト: [合格/不合格] (X/Y 合格, Z% カバレッジ)
|
||
セキュリティ: [合格/不合格] (CVE発見: N)
|
||
差分: [X ファイル変更]
|
||
|
||
全体: [準備完了 / 未完了]
|
||
|
||
修正が必要な問題:
|
||
1. ...
|
||
2. ...
|
||
```
|
||
|
||
## 継続モード
|
||
|
||
- 大きな変更があった場合、または長いセッションで30〜60分ごとにフェーズを再実行
|
||
- 短いループを維持: `mvn -T 4 test` + spotbugs で迅速なフィードバック
|
||
|
||
**注意**: 迅速なフィードバックは遅い驚きに勝ります。ゲートを厳格に保ち、本番システムでは警告を欠陥として扱います。
|