ci: add Average Code Health gate (≥8.9 floor, target 9.5) to CI, pre-commit, pre-push

- Both hotspot (≥9.5) and average (≥8.9) gates now block commit/push/CI - Current average: 8.97 — threshold set at 8.9 to block regressions without blocking the current state; aspirational target remains 9.5 - pre-commit: replaced phantom pre_commit_code_health_safeguard with real inline check - pre-push: CodeScene step is now blocking (was informational-only) - CLAUDE.md: explicit instructions to monitor both scores via MCP CodeScene
2026-03-24 15:47:31 +01:00
parent 8a86995c23
commit e47625f8bb
4 changed files with 110 additions and 30 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,31 +80,44 @@ jobs:
        # cargo-llvm-cov exits non-zero if line coverage drops below 85%
        # lib.rs/main.rs/menu.rs are Tauri boilerplate -- not meaningfully unit-testable.

-      # ── 3. Code Health (CodeScene — Hotspot Code Health gate) ────────────
-      # The webhook integration handles per-PR delta analysis (posts review
-      # comments on PRs). This step enforces a minimum floor on the
-      # project-wide Hotspot Code Health score (weighted avg of the most
-      # frequently edited files — the ones that matter most).
-      # Current baseline: 9.53 | Aspirational target: 9.8
-      - name: Hotspot Code Health gate (≥9.5)
+      # ── 3. Code Health (CodeScene — Hotspot + Average Code Health gates) ──
+      # Enforces minimum floors on BOTH hotspot and average code health.
+      # Hotspot: weighted avg of most-edited files (9.6 current | target 9.8)
+      # Average: project-wide avg across all files (8.9 current | target 9.5)
+      # Both gates must pass — average catches regressions in non-hotspot files.
+      - name: Code Health gates (Hotspot ≥9.5 + Average ≥9.0)
        env:
          CODESCENE_PAT: ${{ secrets.CODESCENE_PAT }}
          CODESCENE_PROJECT_ID: ${{ secrets.CODESCENE_PROJECT_ID }}
        run: |
-          THRESHOLD=9.5
-          SCORE=$(curl -sf \
+          HOTSPOT_THRESHOLD=9.5
+          AVERAGE_THRESHOLD=8.9
+          API_RESPONSE=$(curl -sf \
            -H "Authorization: Bearer $CODESCENE_PAT" \
            -H "Accept: application/json" \
-            "https://api.codescene.io/v2/projects/$CODESCENE_PROJECT_ID" \
-            | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['hotspot_code_health']['now'])")
-          echo "Hotspot Code Health: $SCORE (threshold: $THRESHOLD)"
+            "https://api.codescene.io/v2/projects/$CODESCENE_PROJECT_ID")
+          HOTSPOT_SCORE=$(echo "$API_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['hotspot_code_health']['now'])")
+          AVERAGE_SCORE=$(echo "$API_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['code_health']['now'])")
+          echo "Hotspot Code Health: $HOTSPOT_SCORE (threshold: $HOTSPOT_THRESHOLD)"
+          echo "Average Code Health: $AVERAGE_SCORE (threshold: $AVERAGE_THRESHOLD)"
          python3 -c "
-          score = float('$SCORE')
-          threshold = float('$THRESHOLD')
-          if score < threshold:
-              print(f'❌ Hotspot Code Health {score:.2f} is below threshold {threshold}')
+          hotspot = float('$HOTSPOT_SCORE')
+          average = float('$AVERAGE_SCORE')
+          ht = float('$HOTSPOT_THRESHOLD')
+          at = float('$AVERAGE_THRESHOLD')
+          failed = False
+          if hotspot < ht:
+              print(f'❌ Hotspot Code Health {hotspot:.2f} is below threshold {ht}')
+              failed = True
+          else:
+              print(f'✅ Hotspot Code Health {hotspot:.2f} ≥ {ht}')
+          if average < at:
+              print(f'❌ Average Code Health {average:.2f} is below threshold {at}')
+              failed = True
+          else:
+              print(f'✅ Average Code Health {average:.2f} ≥ {at}')
+          if failed:
              exit(1)
-          print(f'✅ Hotspot Code Health {score:.2f} ≥ {threshold}')
          "

      # ── 4. Documentation check (warning only — does not fail build) ───────
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -16,3 +16,46 @@ echo "  → tests..."
 pnpm test --run --silent

 echo "✅ Pre-commit passed"
+
+# ── CodeScene Code Health gate ────────────────────────────────────────────
+# Blocks commit if Hotspot < 9.5 OR Average < 9.0.
+# Note: remote scores lag behind local changes (update after push + re-analysis).
+# This catches regressions from previous pushes and notifies Claude Code immediately.
+# If `pre_commit_code_health_safeguard` fails: extract hooks, split components,
+# reduce complexity. Never use eslint-disable, #[allow(...)], or `as any`.
+echo "🏥 CodeScene code health check..."
+if [ -z "$CODESCENE_PAT" ] || [ -z "$CODESCENE_PROJECT_ID" ]; then
+  echo "  ⚠️  CODESCENE_PAT or CODESCENE_PROJECT_ID not set — skipping (CI will enforce)"
+else
+  API_RESPONSE=$(curl -sf \
+    -H "Authorization: Bearer $CODESCENE_PAT" \
+    -H "Accept: application/json" \
+    "https://api.codescene.io/v2/projects/$CODESCENE_PROJECT_ID" 2>/dev/null || echo "{}")
+  HOTSPOT_SCORE=$(echo "$API_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['hotspot_code_health']['now'])" 2>/dev/null || echo "")
+  AVERAGE_SCORE=$(echo "$API_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['code_health']['now'])" 2>/dev/null || echo "")
+  if [ -z "$HOTSPOT_SCORE" ] || [ -z "$AVERAGE_SCORE" ]; then
+    echo "  ⚠️  Could not fetch CodeScene scores — skipping (CI will enforce)"
+  else
+    echo "  Hotspot Code Health: $HOTSPOT_SCORE (threshold: 9.5)"
+    echo "  Average Code Health: $AVERAGE_SCORE (threshold: 8.9)"
+    python3 -c "
+import sys
+hotspot = float('$HOTSPOT_SCORE')
+average = float('$AVERAGE_SCORE')
+failed = False
+if hotspot < 9.5:
+    print(f'FAIL: Hotspot Code Health {hotspot:.2f} < 9.5 — extract hooks, split components, reduce complexity')
+    failed = True
+else:
+    print(f'OK: Hotspot {hotspot:.2f} >= 9.5')
+if average < 8.9:
+    print(f'FAIL: Average Code Health {average:.2f} < 9.0 — recent changes introduced regressions in non-hotspot files')
+    print('     Review files changed in this task. Never use eslint-disable, #[allow(...)], or as any to bypass.')
+    failed = True
+else:
+    print(f'OK: Average {average:.2f} >= 9.0')
+if failed:
+    sys.exit(1)
+" || exit 1
+  fi
+fi
--- a/.husky/pre-push
+++ b/.husky/pre-push
@@ -105,11 +105,11 @@ else
 fi

 # ── 5. CodeScene code health gate ────────────────────────────────────────
-# Note: remote API scores lag behind local changes (only updates after push + re-analysis).
-# We report the remote score for visibility but don't block on it.
-# The pre-commit hook already runs `pre_commit_code_health_safeguard` locally.
+# Blocks push if Hotspot < 9.5 OR Average < 9.0.
+# Remote scores reflect state after last push — this catches regressions
+# introduced in a previous push that weren't caught yet.
 echo ""
-echo "🏥 [5/5] CodeScene code health (informational — local safeguard runs in pre-commit)..."
+echo "🏥 [5/5] CodeScene code health (Hotspot ≥9.5 + Average ≥9.0)..."
 if [ -z "$CODESCENE_PAT" ] || [ -z "$CODESCENE_PROJECT_ID" ]; then
  echo "  ⚠️  CODESCENE_PAT or CODESCENE_PROJECT_ID not set — skipping"
 else
@@ -117,14 +117,31 @@ else
    -H "Authorization: Bearer $CODESCENE_PAT" \
    -H "Accept: application/json" \
    "https://api.codescene.io/v2/projects/$CODESCENE_PROJECT_ID" 2>/dev/null || echo "{}")
-  if echo "$API_RESPONSE" | python3 -c "import sys,json; json.load(sys.stdin)['analysis']" 2>/dev/null; then
-    HOTSPOT_SCORE=$(echo "$API_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['hotspot_code_health']['now'])")
-    AVERAGE_SCORE=$(echo "$API_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['code_health']['now'])")
-    echo "  Remote Hotspot Code Health: $HOTSPOT_SCORE"
-    echo "  Remote Average Code Health: $AVERAGE_SCORE"
-    echo "  (remote scores update after push — local safeguard already passed in pre-commit)"
+  HOTSPOT_SCORE=$(echo "$API_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['hotspot_code_health']['now'])" 2>/dev/null || echo "")
+  AVERAGE_SCORE=$(echo "$API_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['analysis']['code_health']['now'])" 2>/dev/null || echo "")
+  if [ -z "$HOTSPOT_SCORE" ] || [ -z "$AVERAGE_SCORE" ]; then
+    echo "  ⚠️  Could not fetch remote scores — skipping (CI will enforce)"
  else
-    echo "  ⚠️  Could not fetch remote scores — continuing"
+    echo "  Remote Hotspot Code Health: $HOTSPOT_SCORE (threshold: 9.5)"
+    echo "  Remote Average Code Health: $AVERAGE_SCORE (threshold: 8.9)"
+    python3 -c "
+import sys
+hotspot = float('$HOTSPOT_SCORE')
+average = float('$AVERAGE_SCORE')
+failed = False
+if hotspot < 9.5:
+    print(f'FAIL: Hotspot Code Health {hotspot:.2f} < 9.5')
+    failed = True
+else:
+    print(f'OK: Hotspot {hotspot:.2f} >= 9.5')
+if average < 8.9:
+    print(f'FAIL: Average Code Health {average:.2f} < 9.0 — regressions detected, fix before pushing')
+    failed = True
+else:
+    print(f'OK: Average {average:.2f} >= 9.0')
+if failed:
+    sys.exit(1)
+" || exit 1
  fi
 fi

--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -8,10 +8,17 @@ pnpm test
 pnpm test:coverage                  # frontend ≥70%
 cargo test
 cargo llvm-cov --manifest-path src-tauri/Cargo.toml --no-clean --fail-under-lines 85
-pre_commit_code_health_safeguard    # CodeScene ≥9.2 hotspot + ≥9.2 average (target: 9.5+)
 ```

-If `pre_commit_code_health_safeguard` fails: extract hooks, split components, reduce complexity. Never add `// eslint-disable`, `#[allow(...)]`, or `as any` to pass the gate.
+**CodeScene Code Health** — the pre-commit and pre-push hooks enforce:
+- Hotspot Code Health ≥ 9.5 (most-edited files)
+- Average Code Health ≥ 9.0 (project-wide, ALL files)
+
+**Both gates block commit/push.** If either fails: extract hooks, split large components, reduce function complexity. Never add `// eslint-disable`, `#[allow(...)]`, or `as any` to pass the gate. Check both scores via MCP CodeScene after every significant change:
+- `hotspot_code_health.now` ≥ 9.5
+- `code_health.now` ≥ 9.0 (average — do NOT ignore this one)
+
+If Average Code Health is below 9.0, you must fix regressions before pushing — even in files you didn't directly modify, if your changes indirectly affected complexity.

 ## ⛔ BEFORE FIRING laputa-task-done — Two-phase QA