Description
This issue was produced by the automated enterprise quality & NFR audit (2026-07-02), which audited the repository against the quality attributes from Wikipedia's "List of system quality attributes" plus AI-native development readiness. Attribute: machine-actionable quality gates (deterministic, self-explaining CI), cluster: AI-Native Autonomous Development Readiness, current score: 4/5. Audit justification: Determinism is institutionalized and self-enforced: every action is pinned to a full commit SHA and a structural test (test_actions_are_pinned_to_full_commit_shas in tests/pulumi/test_delivery_contracts.py) fails CI otherwise; the Dockerfile digest-pins the base image and sha256-verifies Pulumi/awscli/uv/actionlint/gitleaks/hadolint downloads; uv lock --check gates dependency drift; all jobs have timeout-minutes and concurrency groups. Gates self-explain — the destructive gate prints the exact override label to apply, test-coverage tells you which suites to run first, and preview summaries land in GITHUB_STEP_SUMMARY. Remaining gaps: failures are only log-text (no JUnit/SARIF artifacts or GitHub annotations for pytest/ruff suites an agent could parse), and pip-audit --strict makes the PR gate time-varying with no in-repo vulnerability-exception mechanism.
Test and lint gates emit no machine-readable results — pulumi-unit.yml, pulumi-integration.yml, pulumi-policy.yml, python-quality.yml, and pulumi-structural.yml run pytest/ruff inside Docker and surface failures only as raw job logs. Only Scorecard uploads SARIF (nightly-guardrails.yml). An agent or dashboard triaging a red check must scrape unstructured logs instead of reading a JUnit XML artifact or file/line annotations, which raises the cost of autonomous fix loops across many downstream template consumers.
pip-audit --strict is a time-varying blocker with no documented exception path — make test-deps-security runs pip-audit --strict against the locked environment; a newly published CVE turns unrelated PRs red with no code change, undermining the 'deterministic CI' property. There is no --ignore-vuln allowlist file, no documented triage/waiver workflow in docs/ci-guardrails.md or docs/security-baseline.md, so the only unblocking options are an emergency dependency bump or weakening the gate ad hoc.
Tasks
Acceptance Criteria
Description
This issue was produced by the automated enterprise quality & NFR audit (2026-07-02), which audited the repository against the quality attributes from Wikipedia's "List of system quality attributes" plus AI-native development readiness. Attribute: machine-actionable quality gates (deterministic, self-explaining CI), cluster: AI-Native Autonomous Development Readiness, current score: 4/5. Audit justification: Determinism is institutionalized and self-enforced: every action is pinned to a full commit SHA and a structural test (test_actions_are_pinned_to_full_commit_shas in tests/pulumi/test_delivery_contracts.py) fails CI otherwise; the Dockerfile digest-pins the base image and sha256-verifies Pulumi/awscli/uv/actionlint/gitleaks/hadolint downloads; uv lock --check gates dependency drift; all jobs have timeout-minutes and concurrency groups. Gates self-explain — the destructive gate prints the exact override label to apply, test-coverage tells you which suites to run first, and preview summaries land in GITHUB_STEP_SUMMARY. Remaining gaps: failures are only log-text (no JUnit/SARIF artifacts or GitHub annotations for pytest/ruff suites an agent could parse), and pip-audit --strict makes the PR gate time-varying with no in-repo vulnerability-exception mechanism.
Test and lint gates emit no machine-readable results — pulumi-unit.yml, pulumi-integration.yml, pulumi-policy.yml, python-quality.yml, and pulumi-structural.yml run pytest/ruff inside Docker and surface failures only as raw job logs. Only Scorecard uploads SARIF (nightly-guardrails.yml). An agent or dashboard triaging a red check must scrape unstructured logs instead of reading a JUnit XML artifact or file/line annotations, which raises the cost of autonomous fix loops across many downstream template consumers.
pip-audit --strict is a time-varying blocker with no documented exception path — make test-deps-security runs pip-audit --strict against the locked environment; a newly published CVE turns unrelated PRs red with no code change, undermining the 'deterministic CI' property. There is no --ignore-vuln allowlist file, no documented triage/waiver workflow in docs/ci-guardrails.md or docs/security-baseline.md, so the only unblocking options are an emergency dependency bump or weakening the gate ad hoc.
Tasks
Acceptance Criteria