phase a/audit baseline

[aksOps]

• chore(baseline): scaffold baseline dirs and gitignore
• chore(baseline): add seed-repo fetch script with pinned commits
• chore(baseline): add Maven verify + JaCoCo capture script
• chore(baseline): add flaky-test scan (N repeated runs)
• chore(baseline): add SpotBugs baseline capture
• chore(baseline): add dependency-tree + license snapshot capture
• chore(baseline): add frontend audit (npm audit + Vite + Playwright)
• chore(baseline): add index/enrich/serve-smoke pipeline capture
• chore(baseline): run pipeline on realworld-express
• chore(baseline): add OWASP dependency-check baseline capture (NVD sync needs retry)
• chore(baseline): add consolidator and publish first BASELINE.md

Summary by CodeRabbit

• Chores
  • Added baseline documentation system for capturing quality metrics, test results, and security audits
  • Added infrastructure scripts for running comprehensive quality checks including dependency scanning, code analysis, test execution, and frontend audits
  • Added reference repository management for testing purposes
  • Updated configuration to selectively manage documentation and artifact directories

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d02a7bb0-dd08-4fe3-ae96-f65e18666931

📥 Commits

Reviewing files that changed from the base of the PR and between e044268 and 4c0239e.

⛔ Files ignored due to path filters (1)

• scripts/seed-repos.lock is excluded by !**/*.lock

📒 Files selected for processing (13)

• .gitignore
• docs/superpowers/baselines/2026-04-17/BASELINE.md
• scripts/.gitkeep
• scripts/baseline/.gitkeep
• scripts/baseline/consolidate.sh
• scripts/baseline/flaky-scan.sh
• scripts/baseline/run-depcheck.sh
• scripts/baseline/run-deptree.sh
• scripts/baseline/run-frontend-audit.sh
• scripts/baseline/run-maven-tests.sh
• scripts/baseline/run-pipeline.sh
• scripts/baseline/run-spotbugs.sh
• scripts/seed-repos.sh

---

📝 Walkthrough

Walkthrough

This PR introduces a comprehensive baseline capture and reporting system. It adds multiple Bash scripts to measure code quality metrics (tests, coverage, SpotBugs, security vulnerabilities, frontend audits, pipeline health) and generates a consolidated baseline document. Additionally, it updates .gitignore to selectively track baselines and adds a seed repository management script.

Changes

Cohort / File(s)	Summary
Configuration .gitignore	Updated to allow tracking docs/superpowers/baselines/ while ignoring raw data under docs/superpowers/baselines/**/raw/ and the .seeds/ directory.
Baseline Documentation docs/superpowers/baselines/2026-04-17/BASELINE.md	New generated baseline document capturing Maven test results (3059 tests, 0 failures), JaCoCo coverage metrics, flaky-test scan results, SpotBugs findings (1492 bugs), OWASP dependency-check results, Playwright E2E metrics (575 failed), and pipeline serve-smoke health checks with known gaps and re-run instructions.
Test and Quality Capture Scripts scripts/baseline/run-maven-tests.sh, scripts/baseline/run-spotbugs.sh, scripts/baseline/flaky-scan.sh	Scripts to execute Maven builds with JaCoCo coverage, run SpotBugs analysis, and detect flaky tests by running tests multiple times and analyzing failure patterns across runs.
Security and Dependency Scripts scripts/baseline/run-depcheck.sh, scripts/baseline/run-deptree.sh	Scripts to run OWASP Dependency-Check in aggregate mode and generate dependency tree reports with license aggregation, including JSON summarization of vulnerability findings.
Frontend Audit Script scripts/baseline/run-frontend-audit.sh	Script to install npm dependencies, run npm audit, build frontend, install Playwright, and execute E2E tests while capturing results and test counts.
Pipeline and Consolidation Scripts scripts/baseline/run-pipeline.sh, scripts/baseline/consolidate.sh	Script to execute indexing/enrichment phases and smoke tests on seed repos with health checks; script to aggregate raw capture artifacts into a consolidated Markdown baseline document with tool version metadata.
Repository Management scripts/seed-repos.sh	Script to clone or update reference repositories from a lock file, supporting selective checkout and shallow cloning for efficient storage.

Sequence Diagram

sequenceDiagram
    actor User
    participant Baseline as Baseline<br/>Capture
    participant Maven as Maven<br/>(Tests/Coverage)
    participant Analysis as Analysis<br/>(SpotBugs/DepCheck)
    participant Frontend as Frontend<br/>(npm/Playwright)
    participant Pipeline as Pipeline<br/>(Index/Enrich/Serve)
    participant Consolidate as Consolidate<br/>Script
    participant Output as docs/<br/>BASELINE.md

    User->>Baseline: Trigger baseline capture
    par Parallel Captures
        Baseline->>Maven: run-maven-tests.sh
        Maven-->>Baseline: jacoco.csv, surefire reports
        Baseline->>Maven: flaky-scan.sh (multi-run)
        Maven-->>Baseline: flaky.json
        Baseline->>Analysis: run-spotbugs.sh
        Analysis-->>Baseline: spotbugs-summary.json
        Baseline->>Analysis: run-depcheck.sh
        Analysis-->>Baseline: depcheck-summary.json
        Baseline->>Frontend: run-frontend-audit.sh
        Frontend-->>Baseline: playwright-summary.json
        Baseline->>Pipeline: run-pipeline.sh (per seed)
        Pipeline-->>Baseline: pipeline summary.json
    end
    Baseline->>Consolidate: Invoke consolidate.sh
    Consolidate->>Consolidate: Load all raw JSONs
    Consolidate->>Consolidate: Capture tool versions
    Consolidate->>Output: Write BASELINE.md
    Output-->>User: Baseline document ready

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Baselines captured, metrics flow,
Scripts that measure high and low,
Tests and bugs and coverage bright,
Consolidated into sight!
Quality locked, for future's might. ✨

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch phase-a/audit-baseline

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud