Implements the MVP cutline from the planning artifact: - Phase A: skeleton + CLI dispatch + provider interface + stub model doctor - Phase B: scanner + git probe + 12 static analyzers + reporters + pipeline - Phase B fixtures: clean-repo, insecure-repo, degraded-repo 12 static analyzers per PROMPT.md "Suggested Static Checks For MVP": hardcoded_paths, shell_execution, raw_sql_interpolation, broad_cors, secret_patterns, large_files, todo_comments, missing_tests, env_file_committed, unsafe_file_io, exposed_mutation_endpoint, hardcoded_local_ip. Acceptance gates passing: - B1 (intake produces accurate counts) ✓ - B2 (insecure fixture fires ≥8 distinct check_ids — actually 11/12) ✓ - B3 (clean fixture produces 0 confirmed findings — no false positives) ✓ - B4 (scrum mode produces all 6 required markdown + JSON reports) ✓ - B5 (receipts.json marks degraded phases honestly) ✓ - F (self-review on this repo runs without crashing) ✓ — exit 66 (degraded because Phase C LLM review is hardcoded skipped) Phases C (LLM review), D (validation cross-check), E (memory + diff + rules subcommands) deferred per the cutline. The MVP delivers the evidence-first path; LLM is purely additive. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
183 lines
6.3 KiB
Go
183 lines
6.3 KiB
Go
// Package pipeline orchestrates the per-phase execution. Each phase
|
|
// produces JSON / markdown artifacts and a per-phase Receipt entry.
|
|
// Degraded mode propagates: if Phase C (LLM review) can't run, the
|
|
// pipeline still ships the static-scan deliverables and marks the
|
|
// LLM phase degraded — never silently skipped.
|
|
package pipeline
|
|
|
|
import (
|
|
"context"
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"path/filepath"
|
|
"time"
|
|
|
|
"local-review-harness/internal/analyzers"
|
|
"local-review-harness/internal/config"
|
|
"local-review-harness/internal/git"
|
|
"local-review-harness/internal/reporters"
|
|
"local-review-harness/internal/scanner"
|
|
)
|
|
|
|
// Inputs is the bag the CLI passes to the pipeline.
|
|
type Inputs struct {
|
|
RepoPath string
|
|
ReviewProfile config.ReviewProfile
|
|
ModelProfile config.ModelProfile
|
|
OutputDir string
|
|
EmitScrum bool // true → also emit scrum-test/risk-register/sprint-backlog/acceptance-gates markdown
|
|
}
|
|
|
|
// Result is what the CLI shows the operator.
|
|
type Result struct {
|
|
OutputFiles []string
|
|
ExitCode int // 0=ok, 66=degraded, 65=runtime
|
|
}
|
|
|
|
// RunRepo executes Phase 0 (intake), Phase 1 (static), Phase 4 (report).
|
|
// Phases 2 (LLM) + 3 (validate) + 5 (memory) ship later — every phase
|
|
// not run lands in receipts as "skipped" or "degraded".
|
|
func RunRepo(ctx context.Context, in Inputs) (*Result, error) {
|
|
startedAt := time.Now().UTC()
|
|
runID := newRunID(startedAt)
|
|
res := &Result{ExitCode: 0}
|
|
receipt := reporters.Receipt{
|
|
RunID: runID,
|
|
RepoPath: in.RepoPath,
|
|
StartedAt: startedAt.Format(time.RFC3339Nano),
|
|
}
|
|
|
|
// --- Phase 0: repo intake ---
|
|
scan, err := scanner.Walk(in.RepoPath, true)
|
|
scanPhase := reporters.PhaseReceipt{Name: "repo_intake", Status: "ok"}
|
|
if err != nil {
|
|
scanPhase.Status = "failed"
|
|
scanPhase.Errors = append(scanPhase.Errors, err.Error())
|
|
receipt.Phases = append(receipt.Phases, scanPhase)
|
|
res.ExitCode = 65
|
|
// Even on scan failure, write the receipt so operators can
|
|
// see what blew up.
|
|
_ = writeReceipt(in.OutputDir, &receipt, startedAt, nil)
|
|
return res, err
|
|
}
|
|
gi := git.Inspect(ctx, in.RepoPath)
|
|
intake := reporters.BuildIntake(scan, gi)
|
|
intakePath := filepath.Join(in.OutputDir, "repo-intake.json")
|
|
if sha, err := reporters.WriteJSON(intakePath, intake); err != nil {
|
|
scanPhase.Status = "failed"
|
|
scanPhase.Errors = append(scanPhase.Errors, err.Error())
|
|
} else {
|
|
scanPhase.OutputFiles = []string{"repo-intake.json"}
|
|
scanPhase.OutputHash = sha
|
|
}
|
|
if !gi.HasGit {
|
|
scanPhase.Status = "degraded"
|
|
scanPhase.Errors = append(scanPhase.Errors, "no git metadata (not a git repo or git unavailable)")
|
|
if res.ExitCode == 0 {
|
|
res.ExitCode = 66
|
|
}
|
|
}
|
|
receipt.Phases = append(receipt.Phases, scanPhase)
|
|
res.OutputFiles = append(res.OutputFiles, "repo-intake.json")
|
|
|
|
// --- Phase 1: static scan ---
|
|
findings := analyzers.Run(scan, in.ReviewProfile)
|
|
staticOut := reporters.StaticFindings{
|
|
GeneratedAt: time.Now().UTC().Format(time.RFC3339Nano),
|
|
Findings: findings,
|
|
Summary: reporters.SummarizeFindings(findings),
|
|
}
|
|
staticPath := filepath.Join(in.OutputDir, "static-findings.json")
|
|
staticPhase := reporters.PhaseReceipt{Name: "static_scan", Status: "ok"}
|
|
if sha, err := reporters.WriteJSON(staticPath, staticOut); err != nil {
|
|
staticPhase.Status = "failed"
|
|
staticPhase.Errors = append(staticPhase.Errors, err.Error())
|
|
res.ExitCode = 65
|
|
} else {
|
|
staticPhase.OutputFiles = []string{"static-findings.json"}
|
|
staticPhase.OutputHash = sha
|
|
}
|
|
receipt.Phases = append(receipt.Phases, staticPhase)
|
|
res.OutputFiles = append(res.OutputFiles, "static-findings.json")
|
|
|
|
// --- Phase 2: LLM review (Phase C — not implemented in MVP) ---
|
|
receipt.Phases = append(receipt.Phases, reporters.PhaseReceipt{
|
|
Name: "llm_review", Status: "degraded",
|
|
Errors: []string{"Phase C not implemented in MVP — see PROMPT.md / docs/REVIEW_PIPELINE.md Phase 2"},
|
|
})
|
|
if res.ExitCode == 0 {
|
|
res.ExitCode = 66
|
|
}
|
|
llmDegraded := true
|
|
|
|
// --- Phase 3: validation (Phase D — also deferred) ---
|
|
receipt.Phases = append(receipt.Phases, reporters.PhaseReceipt{
|
|
Name: "validation", Status: "skipped",
|
|
Errors: []string{"Phase D not implemented in MVP — depends on Phase C"},
|
|
})
|
|
|
|
// --- Phase 4: report generation (markdown) ---
|
|
if in.EmitScrum {
|
|
reportPhase := reporters.PhaseReceipt{Name: "report_generation", Status: "ok"}
|
|
writers := []struct {
|
|
name string
|
|
fn func() error
|
|
}{
|
|
{"scrum-test.md", func() error {
|
|
return reporters.WriteScrumTest(filepath.Join(in.OutputDir, "scrum-test.md"), intake, findings, llmDegraded)
|
|
}},
|
|
{"risk-register.md", func() error {
|
|
return reporters.WriteRiskRegister(filepath.Join(in.OutputDir, "risk-register.md"), findings)
|
|
}},
|
|
{"claim-coverage-table.md", func() error {
|
|
return reporters.WriteClaimCoverage(filepath.Join(in.OutputDir, "claim-coverage-table.md"), findings)
|
|
}},
|
|
{"sprint-backlog.md", func() error {
|
|
return reporters.WriteSprintBacklog(filepath.Join(in.OutputDir, "sprint-backlog.md"), staticOut.Summary)
|
|
}},
|
|
{"acceptance-gates.md", func() error {
|
|
return reporters.WriteAcceptanceGates(filepath.Join(in.OutputDir, "acceptance-gates.md"), staticOut.Summary)
|
|
}},
|
|
}
|
|
for _, w := range writers {
|
|
if err := w.fn(); err != nil {
|
|
reportPhase.Status = "failed"
|
|
reportPhase.Errors = append(reportPhase.Errors, w.name+": "+err.Error())
|
|
res.ExitCode = 65
|
|
continue
|
|
}
|
|
reportPhase.OutputFiles = append(reportPhase.OutputFiles, w.name)
|
|
res.OutputFiles = append(res.OutputFiles, w.name)
|
|
}
|
|
receipt.Phases = append(receipt.Phases, reportPhase)
|
|
}
|
|
|
|
// --- Phase 5: memory (Phase E — deferred) ---
|
|
receipt.Phases = append(receipt.Phases, reporters.PhaseReceipt{
|
|
Name: "memory_update", Status: "skipped",
|
|
Errors: []string{"Phase E not implemented in MVP"},
|
|
})
|
|
|
|
// --- Receipt ---
|
|
receipt.Summary = staticOut.Summary
|
|
if err := writeReceipt(in.OutputDir, &receipt, startedAt, nil); err != nil {
|
|
return res, err
|
|
}
|
|
res.OutputFiles = append(res.OutputFiles, "receipts.json")
|
|
|
|
return res, nil
|
|
}
|
|
|
|
func writeReceipt(outputDir string, r *reporters.Receipt, startedAt time.Time, _ error) error {
|
|
r.FinishedAt = time.Now().UTC().Format(time.RFC3339Nano)
|
|
_ = startedAt // present for future timing fields
|
|
_, err := reporters.WriteJSON(filepath.Join(outputDir, "receipts.json"), r)
|
|
return err
|
|
}
|
|
|
|
func newRunID(t time.Time) string {
|
|
var rb [4]byte
|
|
_, _ = rand.Read(rb[:])
|
|
return t.UTC().Format("20060102T150405") + "-" + hex.EncodeToString(rb[:])
|
|
}
|