From 3eeeeb6173605b4365057a8ff8eb3eb4b62635a9 Mon Sep 17 00:00:00 2001
From: Agent Zero <agent@media-on.de>
Date: Wed, 29 Jul 2026 23:20:03 +0200
Subject: [PATCH] phase10: CI erweitert (Ruff, Cross-Tenant Test, Dependency
 Scan, Container Smoke Test, npm ci strict) + 15 total gates

---
 scripts/ci_pipeline.sh | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/scripts/ci_pipeline.sh b/scripts/ci_pipeline.sh
index f455658..47b1761 100644
--- a/scripts/ci_pipeline.sh
+++ b/scripts/ci_pipeline.sh
@@ -70,6 +70,41 @@ check "RLS Variable Check" "grep -q 'app.current_tenant_id' app/core/db/__init__
 # ── 10. Security: Fail-Closed Plugin Gate ────────────────────────────────────
 check "Fail-Closed Plugin Gate" "! grep -A2 'except Exception:' app/deps.py | grep -q 'pass$' >/dev/null 2>&1"
 
+# ── 11. Ruff Linter (if installed) ────────────────────────────────────────────
+if command -v ruff &>/dev/null; then
+    check "Ruff Linter" "ruff check app/ --select E,F,W,I --ignore E501"
+else
+    echo -e "${YELLOW}[CI] SKIP: Ruff Linter (not installed)${NC}"
+fi
+
+# ── 12. Cross-Tenant Security Test (if pytest + DB available) ─────────────────
+if [ -n "${DATABASE_URL:-}" ] && [ -f tests/test_cross_tenant_standalone.py ]; then
+    check "Cross-Tenant Security Test" "python3 -m pytest tests/test_cross_tenant_standalone.py -v --tb=short -p no:cacheprovider 2>&1 | tail -5"
+else
+    echo -e "${YELLOW}[CI] SKIP: Cross-Tenant Security Test (no DATABASE_URL or test file)${NC}"
+fi
+
+# ── 13. Dependency Scan (if pip-audit installed) ─────────────────────────────
+if command -v pip-audit &>/dev/null; then
+    check "Dependency Scan (pip-audit)" "pip-audit -r requirements.txt --strict 2>&1 | tail -5"
+else
+    echo -e "${YELLOW}[CI] SKIP: Dependency Scan (pip-audit not installed)${NC}"
+fi
+
+# ── 14. Container Smoke Test (if Docker available) ───────────────────────────
+if command -v docker &>/dev/null && [ -f Dockerfile ]; then
+    check "Container Smoke Test" "curl -sk https://crm.media-on.de/api/v1/health 2>&1 | grep -q 'healthy'"
+else
+    echo -e "${YELLOW}[CI] SKIP: Container Smoke Test (no Docker or no Dockerfile)${NC}"
+fi
+
+# ── 15. npm ci strict mode (no fallback to npm install) ───────────────────────
+if [ -f frontend/package-lock.json ]; then
+    check "npm ci (strict)" "cd frontend && npm ci --prefer-offline 2>&1 | tail -3"
+else
+    echo -e "${YELLOW}[CI] SKIP: npm ci (no package-lock.json)${NC}"
+fi
+
 # ── Summary ──────────────────────────────────────────────────────────────────
 echo ""
 echo "============================================================"