[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Deploys the cloud-tests auditor visibility improvements: clearer evidence, per-check descriptions, grouping, comments on findings, and a new History tab; also fixes background-check exemptions to persist reason/justification and tightens “Fix All” to failed-only with stricter exception expiry parsing.

• New Features

  • Evidence viewer on each result with server-side redaction of secrets; copy-to-clipboard.
  • “About this check” panel: AWS checks get a cached Tier 3 description (what/pass/fail/why); GCP/Azure derive descriptions from provider evidence; forbidden control IDs/URLs stripped.
  • Results grouped by check within each service (by checkKey) with “X of Y failing”, display caps, and a renamed “Scan Results” tab; remediation text parsed into steps, reference link, and compliance chips; safer reference URLs.
  • Exceptions and History: mark exceptions with a required reason (20+ chars), optional reviewer, and optional expiry; reconciliation writes FindingResolution/Regression; History tab shows summaries, active exceptions, regressions, and supports revoke.
  • Comments on findings: new finding entity type and an entity-aware permission guard; thread shown on the finding detail sheet.
  • Polish: “Fix All” now targets failed findings only; exception expiry enforces timezone on full ISO timestamps (bare YYYY-MM-DD still expands to end-of-day UTC); stricter, case-insensitive strip of control citations in check descriptions.

• Migration

  • Adds DB tables and fields for check definitions and history: CheckDefinition, FindingException, FindingResolution, FindingRegression; plus scannedServices/failedServices on IntegrationCheckRun and CommentEntityType.finding.
  • Adds backgroundCheckExemptReason and backgroundCheckExemptJustification on Member; persisted when exempt is true and cleared when set to false.

^{Written for commit e080cd2. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	May 15, 2026 10:58pm
comp-framework-editor (staging)	Ready	Preview, Comment	May 15, 2026 10:58pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal (staging)	Skipped		May 15, 2026 10:58pm

[cubic-dev-ai]

5 issues found across 64 files

Confidence score: 3/5

• There is concrete regression risk: in apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx, the Fix All targeting can now include passed findings, which is user-facing and could trigger unintended batch actions.
• The highest-severity issue is in apps/api/src/cloud-security/reconciliation.service.spec.ts: the hoisted jest.mock() referencing dbMock may break test execution unless the mock variable naming/placement is adjusted.
• apps/api/src/cloud-security/exception-expiry.utils.ts has environment-dependent datetime parsing without explicit timezone offsets, which can produce inconsistent expiry behavior across servers.
• Pay close attention to apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx, apps/api/src/cloud-security/reconciliation.service.spec.ts, and apps/api/src/cloud-security/exception-expiry.utils.ts - unintended fix targeting, mock hoisting safety, and timezone-sensitive expiry logic are the key risks.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/cloud-security/exception-expiry.utils.ts">

<violation number="1" location="apps/api/src/cloud-security/exception-expiry.utils.ts:50">
P2: Require an explicit timezone offset for timestamp inputs. Allowing timezone-less datetimes causes environment-dependent expiry values when `new Date(input)` parses in server local time.</violation>
</file>

<file name="apps/api/src/cloud-security/reconciliation.service.ts">

<violation number="1" location="apps/api/src/cloud-security/reconciliation.service.ts:127">
P2: Redundant condition: `!prior.passed === false` is equivalent to `prior.passed` (due to `!` binding tighter than `===`), making it a duplicate of the next line `if (prior.passed) continue`. Remove this line — it adds confusion and likely masks a logic error the author originally intended (e.g., filtering on a different field).</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/cloud-tests/components/CloudTestsSection.tsx:359">
P1: `Fix All` now includes passed findings because service groups store passed+failed results, but batch target selection still filters only by remediation key.</violation>
</file>

<file name="apps/api/src/cloud-security/ai-description.prompt.ts">

<violation number="1" location="apps/api/src/cloud-security/ai-description.prompt.ts:109">
P2: Make the ISO control-number regex case-insensitive so lowercase variants are also blocked.</violation>
</file>

<file name="apps/api/src/cloud-security/reconciliation.service.spec.ts">

<violation number="1" location="apps/api/src/cloud-security/reconciliation.service.spec.ts:24">
P1: Rename `dbMock` to a `mock*` variable (or inline the factory) so the hoisted `jest.mock()` can access it safely.</violation>
</file>

_{Tip: instead of fixing issues one by one fix them all with cubic
Re-trigger cubic}

[claudfuen]

🎉 This PR is included in version 3.56.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀