fix(cloud-tests): parse all SecHub compliance formats + dedupe scan-mode literals

[tofikwest]

Summary

Two real P2s flagged by cubic on PR #2873 (production deploy), both isolated to API code, surgical fixes.

P2: formatSingleRequirement regex couldn't match 3 of 4 documented SecHub formats

The bug: the first capture group [A-Z][A-Z0-9 .]+? excluded lowercase letters and hyphens, so these documented formats all silently fell through to the raw-string fallback instead of producing structured standard version (control) output:

Format	Before	After
NIST.800-53.r5 AC-2	❌ fall-through	✅ raw (no version separator — intentional)
CIS AWS Foundations Benchmark v1.2.0 1.1	❌ fall-through	✅ cis 1.2.0 (1.1)
PCI DSS v3.2.1 8.2.3	✅ matched	✅ pci dss 3.2.1 (8.2.3)
AWS Foundational Security Best Practices v1.0.0/EC2.2	❌ fall-through	✅ aws fsbp 1.0.0 (EC2.2)

User-visible impact before the fix: compliance chips on Security Hub findings would render as one verbose label ("CIS AWS Foundations Benchmark v1.2.0 1.1") instead of cleanly split into standard / version / control parts (CIS 1.2.0 chip with 1.1 detail).

Three changes:

1. Widen the first capture group to [A-Za-z][A-Za-z0-9 .\-]+? to accept lowercase + hyphens.
2. Normalize / → ' ' before matching, so AWS FSBP's v1.0.0/EC2.2 separator works.
3. Make version capture required rather than optional. Formats without an explicit version (NIST embeds r5 in the standard name) now cleanly fall through to the raw fallback — avoids the awkward unspecified placeholder the prior code emitted.

P2: DTO drifted from the source-of-truth promise

The bug: aws-scan-mode.ts explicitly says "importers never spell the values themselves" — but the DTO at update-scan-mode.dto.ts hardcoded ['comp_scanners', 'security_hub'] in both the Swagger enum and the @IsIn validator. If we ever add a new mode, the DTO would silently accept fewer values than the union type allows.

Fix: add an exported tuple AWS_SCAN_MODES in aws-scan-mode.ts, use it in the DTO for both validator and Swagger metadata. One file to change when a new mode is added.

Tests

• security-hub.adapter.spec.ts: 26 → 29 tests (regression guards for CIS, PCI, AWS FSBP formats — would catch any future regex narrowing).
• aws-scan-mode.spec.ts: 6 → 9 tests (AWS_SCAN_MODES contents, default inclusion, round-trip consistency with resolveAwsScanMode — would catch drift if a future commit adds a mode to one file but forgets the other).

Why a separate PR

PR #2873 is the auto-generated main → release production deploy PR, which regenerates on every merge. Pushing fixes targeting main makes them eligible for the next deploy cycle.

Test plan

• 29 security-hub adapter tests pass, including 3 new regression guards
• 9 aws-scan-mode tests pass, including 3 new source-of-truth guards
• Typecheck clean for changed files
• Manual: hit PATCH /v1/cloud-security/connections/:id/scan-mode with {"mode": "bogus"} → expect 400 (DTO validation rejects unknown modes)
• Manual (when SecHub mode is in use): trigger a scan, inspect a SecHub finding's evidence, confirm remediation field contains Compliance: cis 1.2.0 (1.1); pci dss 3.2.1 (8.2.3) shape (or equivalent for the standards the customer has enabled)

🤖 Generated with Claude Code

---

Summary by cubic

Fixes Security Hub compliance parsing so CIS, PCI DSS, and AWS FSBP formats render structured chips, and centralizes AWS scan-mode values to prevent DTO drift. Improves chip labels and makes adding new modes safer.

• Bug Fixes
  • Compliance parsing: accept lowercase and hyphens in the standard name, normalize "/" to space, and require an explicit version; NIST 800-53 without a version separator is emitted verbatim instead of fabricating a placeholder.
  • AWS scan mode: export AWS_SCAN_MODES in aws-scan-mode.ts and use it for both Swagger enum and @IsIn validation, removing hardcoded literals.

^{Written for commit a5d1539. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	May 19, 2026 9:04pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		May 19, 2026 9:04pm
portal	Skipped		May 19, 2026 9:04pm

[cubic-dev-ai]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[claudfuen]

🎉 This PR is included in version 3.59.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀