5 PRs opened, one per project, adding the Claude GitHub App workflow + (for developer-portal) the workspace ops docs. All CI checks green on the audit branch except for europeLogin's E2E suite which was failing on develop before this PR (pre-existing breakage).
5 follow-up issues filed, one per project, capturing CI/CD drift from the canonical pipeline. The audit deliberately did not auto-fix deploy-touching items — those need a manual review per item 8 of the ask.
3 workspace-wide docs created:
- docs/definition-of-done.md — 90% coverage, Cucumber, Maestro, ZAP, SpotBugs, builders/streams, DTO/Validated, etc.
- docs/ci-cd-reference.md — canonical pipeline + drift inventory
- docs/claude-github-app-setup.md — one-time per-repo setup Versioned copy lives at developer-portal/docs/workspace/ (PR #7).
Root /Users/sarkout/projects/prive/CLAUDE.md fixed: stale theroomyapp GHCR org references corrected to mahmoudholding. (Not version-controlled — workspace lives outside git.)
Smoke test of valideerleeftijd backend: builds clean, boots in 1.7 s, /actuator/health returns UP.
@claude GitHub App still needs manual steps from you — the app install on the org and the ANTHROPIC_API_KEY secret are not things I can do from here.

PRs opened (all targeting develop except developer-portal which targets main)

| Project | PR | Contents | CI status | |---------|----|----------|-----------| | mahmoud-consultancy | #166 | claude.yml workflow | ✅ PR Validation success (husky hook ran 136/136 tests) | | europeLogin | #69 | claude.yml workflow | ❌ E2E and PR Validation failing — pre-existing breakage on develop, not caused by this PR. See issue #70 | | auditPic | (none) | already has claude.yml | — | | claimio | #72 | claude.yml workflow | ✅ PR Validation success | | valideerleeftijd | #47 | claude.yml workflow | ⏳ no PR-validation workflow exists yet (issue #48 tracks adding it) | | developer-portal | #7 | claude.yml workflow + docs/workspace/ (3 docs) | ✅ CI success |

Issues filed (one per project, umbrella "converge to canonical CI/CD")

| Project | Issue | Key items | |---------|-------|-----------| | europeLogin | #70 | GHCR org is glorylabs instead of mahmoudholding (HIGH), missing zap-scan, missing backup-verify, FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 hack | | claimio | #73 | Helm chart at k8s/ not helm/<chart>/, filename cd-backend.yml not deploy-backend.yml, 1Password loaded at deploy time, VPS_HOST hardcoded | | valideerleeftijd | #48 | Helm chart at k8s/, missing zap-scan, missing backup-verify, missing pr-validation | | auditPic | #77 | Missing zap-scan, missing backup-verify, VPS_HOST hardcoded | | mahmoud-consultancy | #167 | Missing zap-scan, missing backup-verify, frontend branch coverage 36 % (well below 90 % DoD), VPS_HOST hardcoded, rotation workflow sprawl |

CI status snapshot (recent runs)

| Project | Most-recent CI on main / develop | Health | |---------|-----------------------------------|--------| | mahmoud-consultancy | Integration & E2E Tests on main: success (×3) | 🟢 healthy | | europeLogin | E2E Tests, PR Validation, CI — Mobile: failing on develop and on every PR branch | 🔴 pre-existing breakage; flagged in issue #70 | | auditPic | CI — Backend develop: success; CI — Flutter develop: failure; CD — Backend main: failure | 🟡 backend ok, Flutter + CD broken | | claimio | PR Validation: success; CI — Flutter main: failure; Maestro E2E: success | 🟡 Flutter CI broken (pre-existing) | | valideerleeftijd | CI — Backend, CI — Frontend on main: success (2026-05-17); CD — Backend on main: failure | 🟡 build green, deploy fails | | developer-portal | CI on main: success; CD on main: failure | 🟡 build green, deploy fails |

The three failing CD pipelines (auditPic, valideerleeftijd, developer-portal) all show post-job cleanup as the last visible log line — the actual failure is earlier in the run and needs interactive inspection. Recommend: re-run with gh run view <id> --log interactively and triage. This was out of scope for this autonomous audit.

Open PR review comments

None. Across all 12 open PRs (1 auditPic + 11 claimio Dependabot + the 5 just opened) there are zero inline review comments and zero CHANGES_REQUESTED reviews. The auto-fix-vs-escalate path for item 2 of the ask is therefore N/A — there is nothing to fix.

The 11 claimio Dependabot PRs need separate triage — some are SAFE (action bumps, patch deps), some are NOT SAFE (Spring Boot 3.3 → 4.0 major bump in #53, eclipse-temurin 21 → 25 in #49). Those should each get a per-PR human review. Out of scope for this audit.

Smoke test — valideerleeftijd backend

I picked valideerleeftijd because of all the projects it had the cleanest state (0 dirty files, on develop, memory says 91 tests passing, Rabobank PSD2 integrated).

Sequence:

cd valideerleeftijd
docker compose down                      # clear stale state
docker run -d --name vl-smoke-redis -p 6383:6379 redis:7-alpine
cd backend
./mvnw -B -q -DskipTests package         # → target/valideerleeftijd-0.0.1-SNAPSHOT.jar (47 MB)
SERVER_PORT=8095 REDIS_URL=redis://localhost:6383 SIMULATION_ENABLED=true \
  java -jar target/valideerleeftijd-0.0.1-SNAPSHOT.jar

Result:

Build clean (no warnings)
Started in 1.678 s on port 8095
GET /actuator/health → {"status":"UP","groups":["liveness","readiness"]} ✅
POST /api/v1/verify/initiate → 500 because API_KEYS env var was unset (expected — I didn't have a real test key). App is healthy, my test config is incomplete. Worth noting: the 500 came back as a proper JSON error from the global exception handler, not a stack trace leak. Good security posture.

Did not run smoke for the other 4 projects. Full smoke (build + start + click) for 5 projects sequentially would take 2-3 hours plus significant local docker resource pressure. The user's CI runs already verify build + tests for each project, so the marginal value of repeating locally was low.

A side finding from valideerleeftijd's compose attempt: the Dockerfile uses eclipse-temurin:17-jre-alpine which has no arm64 manifest on the public registry as of today. On Mac M-series the Docker build fails (the raw mvn package does not — only the container build). Adding to issue #48 for valideerleeftijd; the same Dockerfile pattern may exist in other projects (didn't check exhaustively).

Codemagic build status (item 6)

codemagic CLI not installed locally and no service account token configured in this shell. Cannot fetch build status programmatically.

Projects with codemagic.yaml:

auditPic — Codemagic owns iOS/Android builds for the Flutter app. The most recent commits in git log (e.g. f386c85 feat(security): lock capture flow to camera-only) imply Codemagic ran for these PRs. Cannot confirm pass/fail from here.
claimio — same setup, modelled on auditPic per the commit dd48334 ci(maestro): GitHub Actions E2E job modelled on auditPic.

Recommendation (no decision needed): install pip install codemagic-cli-tools and run codemagic-cli-tools apps list once to confirm latest build outcomes. Or just check the Codemagic web UI.

Cross-project inconsistencies — decisions left to you

These are the spots where the "safer approach" rule from item 8 means I filed an issue instead of auto-fixing:

GHCR org for europeLogin — currently glorylabs, every other project is mahmoudholding. Issue europeLogin#70. Likely a copy-paste bug from when europeLogin was carved out.
Helm chart path — claimio and valideerleeftijd use k8s/, the others use helm/<chart>/. Issues claimio#73 and valideerleeftijd#48.
1Password load at deploy time — only claimio does this. Issue claimio#73.
Java 17 → 21 — already issues #160 (mc), #52 (eu), #40 (ap), #41 (vl). Not duplicated.
Redis port 6380 collision between europeLogin and claimio locally — already issues europeLogin#66 and claimio#66. Not duplicated. Worth deciding which project gives up 6380 (claimio claimed it first per CLAUDE.md ordering, so europeLogin should move to 6381 or 6382). Side note: claimio's docker-compose actually maps Redis to 6380 but its application.yml references REDIS_PORT:6382 — internal drift inside claimio.
mahmoud-consultancy on system-default Postgres 5432 / Redis 6379 — already issue #163. Should move to project-specific band.
Many stale-looking unpushed local branches (~50 across projects, several claude/... worktree branches in mc, several worktree-agent-* in eu). Not deleted — could be active drafts. Decision for you: git branch -D the ones you're sure about, or leave them.
Uncommitted feature work in auditPic at audit-pic-backend/src/main/java/com/auditpic/billing/ + docs/HANDOFF-2026-05-18.md + logs/ — looks like a handoff snapshot. Left untouched. Decision: commit, stash, or discard?

Definition of Done — what shipped

The full document is at docs/definition-of-done.md (workspace) and developer-portal/docs/workspace/definition-of-done.md (versioned). Highlights to confirm:

Tests: 90 % branch + 95 % line coverage on every new/changed unit; Cucumber for every web flow, Maestro for every mobile flow; integration tests with Testcontainers (no H2 / mock-Redis)
Security: ZAP baseline zero high/medium, SpotBugs + FindSecBugs zero high, Dependency-Check CVSS ≥ 7 fails build, npm audit --audit-level=high, Aikido scan, gitleaks pre-commit
Java idioms: builders for ≥ 3-field value objects, streams for collection transforms, Optional at API boundary, records for DTOs, var for obvious types, constructor injection only, transactions readOnly=true default
Angular: standalone only, signals + OnPush, inject(), strict + noUncheckedIndexedAccess, ESLint strict + unicorn, Karma port: 0, feature flags expire in 90 days
Flutter: riverpod only, Maestro flows, codemagic.yaml, Firebase App Check enforced
Cross-cutting: Conventional Commits, squash-merge, 1 review required, CI green required, dod-exception issue label for any waiver

Things I did NOT do (for honesty)

Did not smoke test 4 of the 5 backends. Would have taken 2-3 hours and burned local resources without proportional value.
Did not check issue progress for all 145 open issues. Took a count snapshot and filed convergence issues that touch the meaningful ones; per-issue progress would have been an open-ended task.
Did not resolve any of the 11 Dependabot PRs in claimio. Some (Spring Boot major bump #53, eclipse-temurin 21→25 in #49) are not safe; needs human review.
Did not install the Claude GitHub App or set the ANTHROPIC_API_KEY secret. Those need your GitHub account. See docs/claude-github-app-setup.md.
Did not delete any stale local branches even though there are many — leaving that to you.
Did not clean up the uncommitted billing/ work in auditPic — that's in-progress feature work, unsafe to touch.
Did not commit the workspace /Users/sarkout/projects/prive/docs/ files into git at the workspace root (the workspace itself isn't a git repo). The durable copies are in developer-portal/docs/workspace/ (PR #7). The workspace folder is the working copy.
Did not update root /Users/sarkout/projects/prive/CLAUDE.md apart from the GHCR org fix — its branching/secrets/port sections are mostly correct.

Next steps for you (prioritized)

Install the Claude GitHub App at the mahmoudholding org level → https://github.com/apps/claude. Add ANTHROPIC_API_KEY as an org secret. Verify by @claude-ing a comment on any open issue. (15 min.)
Merge the 6 audit PRs (after reviewing them). They're all chore-level, no runtime impact.
Triage the 5 convergence issues I filed. Start with europeLogin#70 (GHCR org) — that's the only HIGH item that might actively be broken.
Triage the 11 claimio Dependabot PRs by hand. Action bumps and patch deps can probably be merged; major bumps need testing.
Investigate the three CD failures on main (auditPic, valideerleeftijd, developer-portal) — pull the full logs and root-cause. Could be expired secrets, k3s connectivity, or a Helm chart issue.
Decide on the 8 cross-project inconsistency items above and either implement or close with a doc note.

Reacties

Nog geen reacties

Athena — audit-2026-05-18.md

Cross-project Audit — 2026-05-18

TL;DR