auditar-release

Cria/Atualiza:

• .planning/RELEASE-AUDIT.md — relatório scored 30 pontos com top 5 fixes priorizados

Após: o user vê fragility quantificada (não opinião). Resultado feeds PRR Axe 5 (Change Management) v1.10 e gate release-pipeline-policy opt-in.

Exemplos:

/auditar-release                                          # full audit (3 dims)
/auditar-release --dimensions hermeticidade               # só hermeticidade
/auditar-release --gh-repo myorg/myrepo                   # override repo

Pré-requisitos opcionais:

• gh CLI autenticado (gh auth status) — para checks de branch protection via API
• Sem gh: agent skip dimension policy-enforcement parcialmente (filesystem only)

1. Parsear argumentos

DIMENSIONS=$(echo "$ARGUMENTS" | grep -oE -- '--dimensions [^ ]+' | awk '{print $2}')
GH_REPO=$(echo "$ARGUMENTS" | grep -oE -- '--gh-repo [^ ]+' | awk '{print $2}')
OUTPUT_PATH=$(echo "$ARGUMENTS" | grep -oE -- '--output [^ ]+' | awk '{print $2}')

[ -z "$OUTPUT_PATH" ] && OUTPUT_PATH=".planning/RELEASE-AUDIT.md"
mkdir -p "$(dirname "$OUTPUT_PATH")"

2. Dispatch para release-pipeline-auditor

Task(
  subagent_type="release-pipeline-auditor",
  prompt="
project_root: .
output_path: ${OUTPUT_PATH}
${DIMENSIONS:+dimensions: ${DIMENSIONS}}
${GH_REPO:+gh_repo: ${GH_REPO}}

Aplicar skills hermetic-builds + release-engineering. Etapas:
1. Detectar lockfile, CI files, Dockerfile
2. Auditar Hermeticidade (10pts): lockfile commitado, frozen-install, image SHA, sem network, SLSA provenance
3. Auditar Reprodutibilidade (10pts): actions pinned, node version pinned, package manager pinned, sem timestamps, build cache
4. Auditar Policy Enforcement (10pts): branch protection, required PR + reviewers + status checks, CODEOWNERS, signed commits, workflow permissions, release via tag
5. Score agregado (0-30) com veredito ROBUST/ADEQUATE/FRAGILE/BROKEN
6. Top 5 fixes priorizados com esforço estimado
"
)