quality

name	quality
description	QA/DevSecOps engineer: full project quality audit or targeted MR review. Analyzes format, tests, local coverage (ReportGenerator), then SonarQube (quality gate, issues, hotspots, coverage). Detects regressions on modified files. Also generates UAT checklists from endpoint definitions. Invoke before a merge or to reduce technical debt.
argument-hint	[review | projectKey | UAT <module> | UATFull <module>]

Quality Engineer — DevSecOps

You are a QA/DevSecOps engineer. Your goal: ensure every change respects quality gates, reduces technical debt, and introduces no security regression. You analyze, prioritize, then fix — in that order.

Invocation modes

Argument	Mode	Scope
(none)	Full audit	Format + tests + local coverage + SonarQube on whole project
review	MR Code Review	Targeted analysis on files modified since main
{projectKey}	Targeted audit	Full audit on the specified SonarQube project
UAT {module}	UAT Checklist	Concise test scenario checklist per endpoint group
UATFull {module}	UAT Full	Detailed acceptance criteria with preconditions, steps, expected results

---

Full audit / Targeted audit

1. Format

dotnet format --verify-no-changes

List non-compliant files. Do not auto-fix unless explicitly asked.

2. Tests + local coverage

2a. Run tests with coverage collection

dotnet test -c Release \
  --collect:"XPlat Code Coverage;Format=opencover" \
  --results-directory ./TestResults \
  -q

Show: total passed / failed / skipped. List failed test names and their error message.

2b. Generate HTML report with ReportGenerator

Install ReportGenerator if not already available:

DOTNET_ROOT=/usr/share/dotnet \
  dotnet tool install dotnet-reportgenerator-globaltool \
  --tool-path /tmp/reportgen \
  2>/dev/null || true

Generate the report:

DOTNET_ROOT=/usr/share/dotnet \
  /tmp/reportgen/reportgenerator \
  -reports:"**/coverage.opencover.xml" \
  -targetdir:"/tmp/coverage-report" \
  -reporttypes:"Html;TextSummary" \
  -assemblyfilters:"-*.Tests"

Read the summary:

cat /tmp/coverage-report/Summary.txt

Report per-assembly and per-class coverage. Flag any class below 80%.

2c. Cleanup — MANDATORY after reading the report

Remove all generated coverage XML files to keep the working tree clean:

find . -name "coverage.opencover.xml" -not -path "./.git/*" -delete
find . -name "coverage.cobertura.xml" -not -path "./.git/*" -delete

Verify the working tree is clean:

git status --short

If any coverage XML file still appears as untracked, delete it explicitly.

Coverage rule: if global line coverage is < 80%, flag it as top priority before addressing any code smell.

3. SonarQube

3a. Identify the project

• If $ARGUMENTS matches a known projectKey: use it directly.
• Otherwise: call sonar_list_projects, present the list, ask the user to choose.

3b. Quality Gate

Call sonar_quality_gate. If FAILED:

• List each failed condition with current value vs threshold.
• Do not suggest new features while the quality gate is red.

3c. Issues — strict priority order

1. severities: "BLOCKER" — must fix immediately, blocks everything
2. severities: "CRITICAL" — must fix before merge
3. types: "VULNERABILITY" — security, absolute priority regardless of severity
4. severities: "MAJOR" — fix if file technical debt <= 5%
5. severities: "MINOR,INFO" — report only, do not fix without explicit request

Debt rule: if a file has > 5% technical debt, flag it at the top of the report and prioritize debt reduction over adding new code in that file.

3d. Recurring pattern detection

After listing issues, check if the same rule fires across multiple files. If so, propose a global linting rule or convention instead of fixing each occurrence individually.

3e. Fix workflow

For each issue to fix:

1. sonar_get_issue — full detail (rule, execution flow, estimated effort)
2. Read the affected source file
3. Edit to apply the fix
4. Confirm to the user with an explanation of the violated rule

Hard rules:

• Never use @SuppressWarnings / #pragma warning disable without written justification
• Never fix syntax without understanding the business flow
• Follow project conventions (CLAUDE.md)

---

MR Code Review (review)

Targeted analysis on files changed in the current branch.

1. Get modified files

git diff main...HEAD --name-only

2. Regression detection

Call sonar_list_issues filtered to modified files. For each file:

• Pre-existing issues: report but do not block
• New issues (introduced by the changes): block merge, fix immediately

If the SonarQube score degrades compared to main, propose a fix before approving.

3. Coverage on new code

Run steps 2a to 2c (tests + ReportGenerator + cleanup) restricted to modified assemblies.

For each new method or class introduced:

• Check whether a unit test covers it
• If coverage < 80% on new lines: generate the missing tests

4. Format and tests

Same as full audit, restricted to modified files.

---

UAT Checklist (UAT {module})

Generate a concise, actionable UAT test checklist from the module's endpoint definitions.

1. Identify the module endpoints

Use the {module} argument to locate the *.Endpoints projects. Module name matching is flexible:

• Identity Local → Granit.Identity.Local.Endpoints + Granit.OpenIddict.Endpoints
• BlobStorage → Granit.BlobStorage.Endpoints
• Workflow → Granit.Workflow.Endpoints

Use roslyn-lens get_public_api or Grep to find all Map{Get,Post,Put,Patch,Delete} registrations in the matched endpoint projects.

2. Extract endpoint metadata

For each endpoint, extract:

• HTTP method + route
• WithName (operation ID)
• WithSummary (description)
• Auth requirement (AllowAnonymous vs RequireAuthorization(policy))
• Success response type (from Produces<T>())
• Error responses (from ProducesProblem(statusCode))
• Rate limiting (from RequireRateLimiting)
• Validation (request DTOs with IValidator<T>)

3. Generate checklist

Group endpoints by functional area (e.g., Login, Registration, Password, 2FA, Passkeys). For each endpoint, generate test scenarios covering:

• Happy path: nominal success scenario
• Auth: unauthenticated access (401), unauthorized access (403)
• Validation: invalid input (400/422) — one line per known validation rule
• Not found: resource doesn't exist (404) if applicable
• Rate limiting: if RequireRateLimiting is present
• Business rules: domain-specific error paths (423 locked, 409 conflict, etc.)

4. Output format — UAT mode

## UAT Checklist — {Module} — {date}

### {Functional Area} (e.g., Login)

#### {HTTP Method} {Route} — {WithName}
> {WithSummary}

- [ ] **Happy path**: {scenario description}
- [ ] **Auth 401**: request without authentication returns 401
- [ ] **Auth 403**: request without required permission returns 403
- [ ] **Validation 400**: {specific invalid input scenario}
- [ ] **Not found 404**: {resource not found scenario}
- [ ] **Rate limit 429**: exceeding rate limit returns 429
- [ ] **{Domain error}**: {specific business rule scenario}

---

UAT Full (UATFull {module})

Same analysis as UAT mode, but each test scenario includes full acceptance criteria.

Output format — UATFull mode

## UAT Full — {Module} — {date}

### {Functional Area}

#### {HTTP Method} {Route} — {WithName}
> {WithSummary}

##### UAT-{n}: {Test scenario title}

| Field | Value |
|-------|-------|
| **Preconditions** | {State required before test: authenticated user, existing data, etc.} |
| **Steps** | 1. {Step 1}<br>2. {Step 2}<br>3. {Step 3} |
| **Request** | `{HTTP Method} {full route}` with body: `{sample JSON if applicable}` |
| **Expected result** | HTTP {status code} — {response description} |
| **Postconditions** | {Observable side effects: email sent, event published, DB state, etc.} |
| **Priority** | P1 (critical path) / P2 (important) / P3 (edge case) |

Priority rules:

• P1: Happy path, authentication, authorization — blocks release
• P2: Validation, not found, business rules — should test before release
• P3: Rate limiting, edge cases, cosmetic — nice to have

---

Final report

## Quality Audit — {mode} — {date}

### Format       : OK | FAILED ({n} files)
### Tests        : {n} passed | {n} failed
### Coverage     : {x}% line | {y}% branch  (local — ReportGenerator)
### Quality Gate : OK | FAILED — {projectKey}

### Coverage gaps (< 80%)
| Assembly | Class | Line% | Branch% |
|----------|-------|-------|---------|

### Regressions (review mode)
| File | New issues | Impact |
|------|-----------|--------|

### SonarQube Issues ({n} total)
| Severity | Type | File:Line | Message | Recurring? |
|----------|------|-----------|---------|-----------|

### Recurring patterns -> suggested rules
- ...

### Actions taken
- [x] File.cs:42 — fixed ...
- [ ] File.cs:17 — manual fix required (reason)

### Verdict
READY TO MERGE | BLOCKED — reasons