Gobernanza basada en compuertas

# .github/workflows/agent-gates.yml
name: Agent Output Gates

on:
  pull_request:
    branches: [main]
    # Only run on PRs labeled as agent-generated
    types: [labeled]

jobs:
  automated-gates:
    if: contains(github.event.pull_request.labels.*.name, 'agent-generated')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Gate 1 — Lint and Format
        run: |
          npm run lint
          npm run format:check

      - name: Gate 2 — Type Check
        run: npm run typecheck

      - name: Gate 3 — Unit Tests
        run: npm run test:unit -- --coverage

      - name: Gate 4 — Security Scan
        run: |
          npm audit --audit-level=high
          npx semgrep --config p/typescript src/

      - name: Gate 5 — Architecture Conformance
        run: node scripts/check-architecture.js

  hitl-gate-triage:
    needs: automated-gates
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check HITL triggers
        id: hitl
        run: |
          node scripts/check-hitl-triggers.js \
            --pr=${{ github.event.pull_request.number }}

      - name: Request human review
        if: steps.hitl.outputs.required == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.pulls.requestReviewers({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: ${{ github.event.pull_request.number }},
              reviewers: ${{ steps.hitl.outputs.reviewers }}
            });

// scripts/check-architecture.ts
import { readFileSync, readdirSync } from "fs";
import { join } from "path";

interface ConformanceRule {
  name: string;
  check: (filePath: string, content: string) => string | null;
}

const rules: ConformanceRule[] = [
  {
    name: "no-direct-db-access-in-components",
    check: (filePath, content) => {
      if (filePath.includes("/components/") && content.includes("prisma")) {
        return `Components must not access the database directly. Use a service layer. Found in ${filePath}`;
      }
      return null;
    },
  },
  {
    name: "no-circular-imports",
    check: (filePath, content) => {
      if (
        filePath.includes("/services/") &&
        content.includes("from '../components/")
      ) {
        return `Services must not import from components. Found in ${filePath}`;
      }
      return null;
    },
  },
  {
    name: "test-co-location",
    check: (filePath, content) => {
      if (
        filePath.endsWith(".tsx") &&
        !filePath.endsWith(".test.tsx") &&
        filePath.includes("/components/")
      ) {
        const testPath = filePath.replace(".tsx", ".test.tsx");
        try {
          readFileSync(testPath);
        } catch {
          return `Missing co-located test file for ${filePath}`;
        }
      }
      return null;
    },
  },
];

function checkConformance(directory: string): string[] {
  const violations: string[] = [];

  function walk(dir: string) {
    for (const entry of readdirSync(dir, { withFileTypes: true })) {
      const fullPath = join(dir, entry.name);
      if (entry.isDirectory() && entry.name !== "node_modules") {
        walk(fullPath);
      } else if (entry.name.endsWith(".ts") || entry.name.endsWith(".tsx")) {
        const content = readFileSync(fullPath, "utf-8");
        for (const rule of rules) {
          const violation = rule.check(fullPath, content);
          if (violation) violations.push(`[${rule.name}] ${violation}`);
        }
      }
    }
  }

  walk(directory);
  return violations;
}

const violations = checkConformance("src/");
if (violations.length > 0) {
  console.error("Architectural conformance violations found:");
  violations.forEach((v) => console.error(`  - ${v}`));
  process.exit(1);
} else {
  console.log("All architectural conformance checks passed.");
}

// scripts/check-hitl-triggers.ts
interface HITLTrigger {
  condition: string;
  reason: string;
  reviewer: string;
}

const triggers: HITLTrigger[] = [
  {
    condition: "auth",
    reason: "Security-critical path modified",
    reviewer: "security-lead",
  },
  {
    condition: "migration",
    reason: "Database migration detected",
    reviewer: "dba-team",
  },
  {
    condition: "package.json",
    reason: "Dependencies modified",
    reviewer: "tech-lead",
  },
];

function evaluateTriggers(changedFiles: string[]): HITLTrigger[] {
  return triggers.filter((trigger) =>
    changedFiles.some((file) => file.includes(trigger.condition))
  );
}