clean-architecture-backend-template/docs/superpowers/plans/2026-07-25-harness-free-quality-security-ci.md

Harness-Free Quality and Security CI Implementation Plan

For agentic workers: REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task, superpowers:test-driven-development for executable drift controls, and superpowers:verification-before-completion before reporting. Git remains human-only: do not stage, commit, amend, or push.

Goal: Reconstruct a harness-free, repository-internal quality and dependency-security CI control plane that is truthful to the current Gradle build and main branch.

Architecture: Canonical workflows live only under .github/workflows. A small YAML gate matrix maps current controls to real Gradle tasks/plugins/tests and workflow jobs, while a portable Bash verifier rejects drift; vulnerability policy is enforced by a platform-neutral Trivy filesystem job with guarded GitHub-only complements.

Tech Stack: GitHub Actions-compatible YAML, Bash, Gradle 9 Groovy DSL, Java/Temurin 21, Trivy, jq, lychee.

---

Task 1: Capture missing-control RED

Files:

• Verify absent: .trivyignore.yaml

• Verify absent: .github/ci-gate-matrix.yml

• Verify absent: .github/scripts/verify-gate-matrix.sh

• Run cd src && ./gradlew verifyTrivyignore --console=plain.

• Confirm the failure names the missing repository-root .trivyignore.yaml.

• Confirm the matrix, verifier, and canonical workflows are absent.

Task 2: Add repository baselines

Files:

• Create: .tool-versions

• Create: .gitattributes

• Create: .trivyignore.yaml

• Pin java temurin-21.0.11+10, matching candidate evidence and the local Gradle launcher JDK.

• Normalize source, YAML, Markdown, Gradle, and shell text to LF; keep gradlew.bat CRLF and mark common binary formats -text.

• Add the four structured empty Trivy sections with suppression governance comments.

• Run cd src && ./gradlew verifyTrivyignore --console=plain and expect zero suppressions validated.

Task 3: Add quality governance and drift verification

Files:

• Create: .github/CODEOWNERS

• Create: .github/pull_request_template.md

• Create: .github/ci-gate-matrix.yml

• Create: .github/scripts/verify-gate-matrix.sh

• Create: .github/workflows/ci-quality-gates.yml

• Create: .github/workflows/link-check.yml

• Record only current Gradle/task/test/job mechanisms in the matrix.

• Implement repository-root-safe matrix parsing with schema, uniqueness, task/plugin/test, and workflow-job checks.

• Before Java/Gradle, fail unless docs/security/public-paths-snapshot.txt is committed and non-empty; do not let the Gradle task create a first-run CI baseline.

• Have a human track and commit the canonical snapshot; agents do not stage or commit, and CI's git ls-files precondition rejects an untracked worktree file.

• Add required quality-gates, sample-off, and gate-matrix-lint jobs plus the advisory quarantine job.

• Make release-gate depend exactly on the three required jobs and fail unless all succeeded.

• Add path-scoped link checking for PR and main push.

• Pin every workflow uses: reference to a verified full commit SHA and retain its immutable release label in an inline comment.

• Run Bash syntax and gate-matrix checks.

Task 4: Add dependency-vulnerability controls

Files:

• Create: .github/dependency-review-config.yml

• Create: .github/dependency-vulnerability-policy.md

• Create: .github/scripts/install-jq.sh

• Create: .github/workflows/dependency-vulnerability.yml

• Configure PR dependency review to block new High/Critical runtime vulnerabilities and forbidden strong/network-copyleft licenses without posting PR summary comments.

• Document High/Critical blocking, Medium/Low advisory, KEV fail-closed handling, suppression review, GitHub/Gitea differences, egress, and mirror requirements.

• Install checksum-pinned jq and version-pinned Trivy under ${RUNNER_TEMP}, adding them through ${GITHUB_PATH} without privileged writes.

• Guard GitHub-only review/submission and keep trivy-fs platform-neutral on all required triggers.

• Pass --ignorefile .trivyignore.yaml to every Trivy invocation.

• Reject KEV catalogs with blank metadata, non-positive/non-integral or mismatched counts, empty vulnerability arrays, invalid CVE identifiers, or duplicate identifiers before intersection.

• Reject malformed or empty Trivy JSON before extracting candidate vulnerability identifiers.

Task 5: Verify the reconstructed slice

Files:

• Verify: all files created by this plan

• Parse strict policy/matrix YAML with an available parser and document GitHub on parser limitations if applicable.

• Prove only main is an active branch trigger and no active master remains.

• Prove every Trivy scan consumes the root ignore file.

• Prove the release fan-in is exact and excludes quarantine.

• Prove the missing/empty/untracked snapshot precondition exits non-zero; the canonical /api/healthcheck snapshot now exists in the worktree but still requires a human commit.

• Exercise the KEV predicate with empty/malformed/count/CVE/duplicate failures and a valid synthetic catalog.

• Exercise the Trivy JSON predicate with malformed Results/Vulnerabilities/IDs and a realistic valid Results array.

• Prove no harness call or .gitea/workflows shadow was introduced.

• Run git diff --check and git status --short.

• Capture the work in the required LLM Wiki branch note, including evidence and external blockers, without claiming server Actions or full Phase A completion.