[PHASE 0] CI/CD Stabilization Sprint - Coordination Issue

[POWDER-RANGER]

🚀 PHASE 0: CI/CD Pipeline Foundation Stabilization

Sprint Duration: March 15-21, 2026
Status: 🟡 IN PROGRESS
Assignees: @POWDER-RANGER
Labels: ci-cd, bug, high-priority, phase-0

---

🎨 Executive Summary

CIVWATCH CI/CD pipeline has 3 critical blockers preventing reliable builds:

1. devskim.yml - Duplicate YAML keys = silent workflow skip (0s duration)
2. PSScriptAnalyzer - No PowerShell files to scan (low-priority)
3. Dependabot - 7 open security PRs needing staged merge strategy

Goal: Restore CI health to support standalone .exe build pipeline.

---

📊 Issues & Fixes

✅ RESOLVED: devskim.yml Duplicate Keys

PR: #98
Status: OPEN (awaiting merge)
Root Cause: Two workflow steps had duplicate uses: keys:

• Checkout: v6 tag + SHA pin
• Upload SARIF: v4 tag + SHA pin

GitHub YAML parser silently skips workflows with duplicate keys.

Fix: Remove non-SHA uses: lines, keep only immutable SHA versions.

Test Post-Merge:

gh workflow run devskim.yml --repo POWDER-RANGER/CIVWATCH
# Expected: Job completes in <2 minutes (not 0 seconds)

---

🟡 PENDING: PSScriptAnalyzer Configuration

Issue: psscriptanalyzer.yml fails but repo contains 0 PowerShell (.ps1) files.
Status: Low priority (no .ps1 files in codebase currently)
Options:

1. Disable job: Add if: false to save CI resources
2. Create stub scripts: Maintain workflow for future PS integration
3. Wait for roadmap: Only enable when PS modules are planned

Recommendation: Option 1 (disable) until PowerShell is integrated.
Action Owner: TBD

---

📋 PENDING: Dependabot Security PRs Merge Strategy

Open PRs: #91-97 (7 total)
Status: Staged merge planned

Priority Tiers:

Tier 1 - HIGH SECURITY (Merge ASAP)

• #92 - jsonwebtoken (JWT auth tokens)
• #93 - mongoose (schema validation)

Tier 2 - INFRASTRUCTURE (Merge Week 1)

• #94 - redis (caching)
• #97 - dotenv (config management)
• #96 - cors (headers)

Tier 3 - TOOLS (Merge Week 2)

• #95 - express (framework)
• #91 - pip (Python package manager)

Merge Process:

1. Merge Tier 1 individually, verify CI passes
2. If no conflicts, group Tier 2 (3-5 PRs together)
3. Follow with Tier 3
4. Check main branch CI health after each merge batch

---

✅ Verification Checklist

• PR [FIX] devskim.yml: remove duplicate 'uses:' keys (root cause of 0-job failure) #98 Created - devskim.yml fix
• PR [FIX] devskim.yml: remove duplicate 'uses:' keys (root cause of 0-job failure) #98 Merged - Verify devskim workflow runs (not 0s)
• PSScriptAnalyzer Disabled - Add if: false to psscriptanalyzer.yml
• Dependabot Tier 1 Merged - deps(npm)(deps): update axios requirement from ^1.7.2 to ^1.13.6 #92, deps(npm)(deps-dev): update vite requirement from ^5.2.12 to ^5.4.21 #93 security updates
• Dependabot Tier 2 Merged - deps(npm)(deps): update jsonwebtoken requirement from ^9.0.2 to ^9.0.3 #94, deps(npm)(deps): update dotenv requirement from ^16.4.5 to ^16.6.1 #97, deps(npm)(deps): update cors requirement from ^2.8.5 to ^2.8.6 #96 (batch or individual)
• Dependabot Tier 3 Merged - deps(npm)(deps-dev): update ts-jest requirement from ^29.1.4 to ^29.4.6 #95, deps(python)(deps): bump the python-minor-patch group with 6 updates #91
• All CI Workflows Green - No 0s durations, no failures
• Documentation Updated - CI_MAINTENANCE_LOG.md reflects final state

---

📚 Resources

• Diagnostics Doc: CI_MAINTENANCE_LOG.md
• GitHub YAML Spec: Workflow Syntax
• DevSkim Docs: Microsoft/DevSkim
• GitHub CLI: gh workflow run --help for manual workflow triggering

---

🏁 Success Criteria

Phase 0 Complete When:

1. ✅ All 3 CI blockers resolved
2. ✅ devskim.yml workflow completes successfully
3. ✅ All Dependabot PRs merged (staged approach)
4. ✅ CI health dashboard shows 100% green
5. ✅ No 0-second job durations
6. ✅ Documentation reflects current state

Expected Outcome: Stable CI/CD foundation ready for Phase 1 (standalone .exe build pipeline).

---

🗣️ Comments & Updates

Use this issue for coordination. Tag relevant PRs and workflows as they progress.

Timeline:

• Mar 17: Phase 0 issues identified, PR [FIX] devskim.yml: remove duplicate 'uses:' keys (root cause of 0-job failure) #98 created
• Mar 18-19: Merge security & infrastructure PRs
• Mar 20: Final verification and documentation
• Mar 21: Phase 0 complete, ready for Phase 1

---

Status Dashboard: CI Maintenance Log