feat(workflow): add risk-based release gates

2026-07-27 10:38:24 +08:00
parent c88623855f
commit dfab78c75a
17 changed files with 794 additions and 69 deletions
@@ -6,6 +6,7 @@ import {
  createGateReport,
  validateGateReport,
 } from './report.mjs';
+import { selectImpactScenarios } from './impact.mjs';

 const COMMIT = 'a'.repeat(40);
 const ARTIFACT = 'b'.repeat(64);
@@ -110,3 +111,81 @@ test('expired report or artifact mismatch is rejected', async () => {
  assert.match(result.errors.join('\n'), /artifact_sha256 does not match/);
  assert.match(result.errors.join('\n'), /report has expired/);
 });
+
+test('impact report accepts only the selected core and affected scenarios', async () => {
+  const catalog = await loadScenarioCatalog();
+  const selection = {
+    ...selectImpactScenarios({
+      catalog,
+      changedPaths: ['memory-v2-lifecycle.mjs'],
+    }),
+    base_commit: 'c'.repeat(40),
+  };
+  const selected = new Set(selection.selected_ids);
+  const report = createGateReport({
+    commitSha: COMMIT,
+    branch: 'main',
+    artifactSha256: ARTIFACT,
+    artifact: { path: '.runtime/portal', kind: 'directory-tree' },
+    mode: 'impact',
+    selection,
+    scenarios: catalog
+      .filter((scenario) => selected.has(scenario.id))
+      .map((scenario) => ({
+        id: scenario.id,
+        name: scenario.name,
+        status: 'passed',
+        cleanup_status: 'not_required',
+        evidence: ['fixture'],
+      })),
+    completedAt: new Date('2026-07-26T10:00:00.000Z'),
+  });
+  const result = validateGateReport(report, {
+    expectedCommit: COMMIT,
+    expectedArtifactSha256: ARTIFACT,
+    now: new Date('2026-07-26T11:00:00.000Z'),
+  });
+  assert.deepEqual(result, { valid: true, errors: [] });
+  assert.ok(report.summary.required < catalog.length);
+});
+
+test('impact report rejects missing core coverage and unmapped non-full paths', async () => {
+  const catalog = await loadScenarioCatalog();
+  const selection = {
+    ...selectImpactScenarios({
+      catalog,
+      changedPaths: ['docs/local-dev.md'],
+    }),
+    base_commit: 'c'.repeat(40),
+  };
+  selection.unmapped_paths = ['unknown-runtime.mjs'];
+  selection.selected_ids = selection.selected_ids.filter((id) => id !== 'AUTH-05');
+  selection.selected_total = selection.selected_ids.length;
+  const selected = new Set(selection.selected_ids);
+  const report = createGateReport({
+    commitSha: COMMIT,
+    branch: 'main',
+    artifactSha256: ARTIFACT,
+    artifact: { path: '.runtime/portal', kind: 'directory-tree' },
+    mode: 'impact',
+    selection,
+    scenarios: catalog
+      .filter((scenario) => selected.has(scenario.id))
+      .map((scenario) => ({
+        id: scenario.id,
+        name: scenario.name,
+        status: 'passed',
+        cleanup_status: 'not_required',
+        evidence: ['fixture'],
+      })),
+    completedAt: new Date('2026-07-26T10:00:00.000Z'),
+  });
+  const result = validateGateReport(report, {
+    expectedCommit: COMMIT,
+    expectedArtifactSha256: ARTIFACT,
+    now: new Date('2026-07-26T11:00:00.000Z'),
+  });
+  assert.equal(result.valid, false);
+  assert.match(result.errors.join('\n'), /missing core scenarios: AUTH-05/);
+  assert.match(result.errors.join('\n'), /unmapped runtime paths require a full Gate/);
+});