Skip to content

codebase-audit v0.4.0 — environment-tier-aware audits

Choose a tag to compare

View all tags
@aimfeld aimfeld released this 18 Apr 13:46
· 5 commits to main since this release
codebase-audit-v0.4.0
4a0a213
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[0.4.0] — 2026-04-18

Added

  • Environment-tier verdict from collect_stats.sh. The script now ends with a grep-able ENVIRONMENT_TIER: warm|partial|cold line plus per-signal flags (SIGNAL_LOC_TOOL, SIGNAL_TEST_RUNNER_DETECTED, SIGNAL_TEST_DEPS_INSTALLED) so the skill can tell whether the audit was run from a warm active-dev environment, a partially-equipped one, or a cold clone with no tooling — and branch accordingly.
  • Single install-or-skip decision (Step 2b.1a in SKILL.md). When the environment tier is partial, the skill asks once whether to install missing deps, run only what's already runnable, or skip Step 2b entirely — quoting commands from the repo's own docs (README, Makefile, package.json scripts) rather than guessing. Replaces what would previously have been N per-suite permission prompts.
  • Section-level assessability vocabulary in the report template. Method & Limitations block now distinguishes claim-level confidence (Verified / Likely / Inferred, unchanged) from section-level assessability (Measured / Inferred from artifacts / Not assessable without setup). Cold-clone reports degrade explicitly — §1 rows state what tooling would be needed to upgrade the row to Measured, and §5 caps the confidence of findings sourced from Not-assessable sections at Inferred.

Fixed

  • collect_stats.sh portability. Added a bash 4+ version guard (fails loudly with a macOS-specific brew install bash hint instead of emitting a cryptic syntax error under bash 3.2). Output path now respects $TMPDIR for sandboxed/containerized environments.
  • collect_stats.sh backup-evidence grep. Replaced the GNU-only grep -rlI --exclude-dir=… with a portable find -prune … -print0 | xargs -0 grep -lEi pipeline that works across GNU grep, BSD grep (macOS), and busybox.
  • collect_stats.sh test-LOC word-splitting. Rewrote for d in $(… | sort -u) as while IFS= read -r d; do …; done < <(…) so test-directory paths containing spaces are counted correctly instead of silently skipped.
  • collect_stats.sh gh run list error masking. Routed the gh run list call through a temp file and inspected its exit code via PIPESTATUS-equivalent pattern — previously tee masked gh failures behind its own success, silently producing an empty "no recent runs" result rather than telling the reader gh couldn't ask.

Full changelog: plugins/codebase-audit/CHANGELOG.md
PR: #8

Assets 2
Loading