From cb22efdc273d42438fe4a0c5681b2dcb23867026 Mon Sep 17 00:00:00 2001 From: forge-bot Date: Tue, 14 Jul 2026 08:46:28 +0000 Subject: [PATCH] =?UTF-8?q?Reviewer=20=EC=97=AD=ED=95=A0=20=EA=B2=80?= =?UTF-8?q?=EC=A6=9D=20=EB=B3=B4=EA=B3=A0=EC=84=9C=20smoke=20(role-reviewe?= =?UTF-8?q?r-live-v4-001)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- scripts/verify-operational-risk.sh | 268 +++++++++++++++++++++++++++++ 1 file changed, 268 insertions(+) create mode 100644 scripts/verify-operational-risk.sh diff --git a/scripts/verify-operational-risk.sh b/scripts/verify-operational-risk.sh new file mode 100644 index 0000000..7c415a9 --- /dev/null +++ b/scripts/verify-operational-risk.sh @@ -0,0 +1,268 @@ +#!/bin/bash +# Operational Risk Verification Script +# Usage: ./scripts/verify-operational-risk.sh + +set -e + +PROJECT_NAME="runtime-role-matrix-live-202607141522-v4" +REPORT_DIR="docs/reviewer/reports" +TIMESTAMP=$(date +"%Y%m%d_%H%M%S") + +# Colors for output +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +NC='\033[0m' + +log_info() { echo -e "${GREEN}[INFO]${NC} $1"; } +log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; } +log_error() { echo -e "${RED}[ERROR]${NC} $1"; } + +# Create report directory +mkdir -p "${REPORT_DIR}" + +log_info "Starting Operational Risk Verification for ${PROJECT_NAME}" + +# Initialize risk assessment +RISK_SCORE=0 +RISK_ITEMS="[]" + +# 1. Monitoring Configuration +echo "" +log_info "=== 1. Monitoring Configuration ===" + +MONITORING_SCORE=0 + +# Check for monitoring configuration files +if [ -f "monitoring/prometheus.yml" ] || [ -f "monitoring/grafana.json" ]; then + log_info "Monitoring configuration found" + MONITORING_SCORE=$((MONITORING_SCORE + 25)) +else + log_warn "No monitoring configuration found" +fi + +# Check for metrics endpoints +if grep -r "metrics" . --include="*.java" --include="*.js" --include="*.ts" -l 2>/dev/null | head -1 > /dev/null; then + log_info "Metrics endpoints detected" + MONITORING_SCORE=$((MONITORING_SCORE + 25)) +else + log_warn "No metrics endpoints detected" +fi + +# Check for health endpoints +if grep -r "health" . --include="*.java" --include="*.js" --include="*.ts" -l 2>/dev/null | head -1 > /dev/null; then + log_info "Health endpoints detected" + MONITORING_SCORE=$((MONITORING_SCORE + 25)) +else + log_warn "No health endpoints detected" +fi + +# Check for logging configuration +if [ -f "logging/logback.xml" ] || [ -f "logging/log4j2.xml" ] || [ -f "logging/config.js" ]; then + log_info "Logging configuration found" + MONITORING_SCORE=$((MONITORING_SCORE + 25)) +else + log_warn "No logging configuration found" +fi + +log_info "Monitoring Score: ${MONITORING_SCORE}/100" +RISK_SCORE=$((RISK_SCORE + (100 - MONITORING_SCORE))) + +# 2. Alert Configuration +echo "" +log_info "=== 2. Alert Configuration ===" + +ALERT_SCORE=0 + +if [ -f "monitoring/alerts.yml" ] || [ -f "monitoring/alerts.json" ]; then + log_info "Alert configuration found" + ALERT_SCORE=$((ALERT_SCORE + 50)) +else + log_warn "No alert configuration found" +fi + +if [ -f "monitoring/notifications.config" ]; then + log_info "Notification configuration found" + ALERT_SCORE=$((ALERT_SCORE + 50)) +else + log_warn "No notification configuration found" +fi + +log_info "Alert Score: ${ALERT_SCORE}/100" +RISK_SCORE=$((RISK_SCORE + (100 - ALERT_SCORE))) + +# 3. Rollback Capability +echo "" +log_info "=== 3. Rollback Capability ===" + +ROLLBACK_SCORE=0 + +if [ -f "scripts/rollback.sh" ] || [ -f "scripts/rollback.py" ]; then + log_info "Rollback script found" + ROLLBACK_SCORE=$((ROLLBACK_SCORE + 50)) +else + log_warn "No rollback script found" +fi + +if [ -f "docker-compose.yml" ] || [ -f "kubernetes/" ]; then + log_info "Container orchestration detected" + ROLLBACK_SCORE=$((ROLLBACK_SCORE + 50)) +else + log_warn "No container orchestration detected" +fi + +log_info "Rollback Score: ${ROLLBACK_SCORE}/100" +RISK_SCORE=$((RISK_SCORE + (100 - ROLLBACK_SCORE))) + +# 4. Documentation +echo "" +log_info "=== 4. Documentation ===" + +DOC_SCORE=0 + +if [ -f "docs/OPERATIONAL.md" ] || [ -f "docs/runbook.md" ]; then + log_info "Operational documentation found" + DOC_SCORE=$((DOC_SCORE + 50)) +else + log_warn "No operational documentation found" +fi + +if [ -f "README.md" ]; then + log_info "README found" + DOC_SCORE=$((DOC_SCORE + 50)) +else + log_warn "No README found" +fi + +log_info "Documentation Score: ${DOC_SCORE}/100" +RISK_SCORE=$((RISK_SCORE + (100 - DOC_SCORE))) + +# 5. Security +echo "" +log_info "=== 5. Security Configuration ===" + +SECURITY_SCORE=0 + +if [ -f ".env.example" ]; then + log_info "Environment template found" + SECURITY_SCORE=$((SECURITY_SCORE + 20)) +else + log_warn "No environment template found" +fi + +if [ -f "security/sast-config.yml" ] || [ -f ".sast.yml" ]; then + log_info "SAST configuration found" + SECURITY_SCORE=$((SECURITY_SCORE + 20)) +else + log_warn "No SAST configuration found" +fi + +if [ -f "security/dependency-check.gradle" ] || [ -f ".snyk" ]; then + log_info "Dependency scanning configured" + SECURITY_SCORE=$((SECURITY_SCORE + 20)) +else + log_warn "No dependency scanning configured" +fi + +if [ -f "SECRETS.md" ] || grep -r "secrets" . --include="*.md" -l 2>/dev/null | head -1 > /dev/null; then + log_info "Secrets management documented" + SECURITY_SCORE=$((SECURITY_SCORE + 20)) +else + log_warn "No secrets management documentation" +fi + +if [ -f ".dockerignore" ] || [ -f ".gitignore" ]; then + log_info "Security ignore files present" + SECURITY_SCORE=$((SECURITY_SCORE + 20)) +else + log_warn "No security ignore files" +fi + +log_info "Security Score: ${SECURITY_SCORE}/100" +RISK_SCORE=$((RISK_SCORE + (100 - SECURITY_SCORE))) + +# Calculate overall risk level +AVG_SCORE=$(( (MONITORING_SCORE + ALERT_SCORE + ROLLBACK_SCORE + DOC_SCORE + SECURITY_SCORE) / 5 )) + +if [ ${AVG_SCORE} -ge 80 ]; then + RISK_LEVEL="LOW" +elif [ ${AVG_SCORE} -ge 60 ]; then + RISK_LEVEL="MEDIUM" +elif [ ${AVG_SCORE} -ge 40 ]; then + RISK_LEVEL="HIGH" +else + RISK_LEVEL="CRITICAL" +fi + +# Generate report +echo "" +log_info "=== Generating Risk Assessment Report ===" + +cat > "${REPORT_DIR}/operational_risk_${TIMESTAMP}.json" << EOF +{ + "project": "${PROJECT_NAME}", + "timestamp": "${TIMESTAMP}", + "verification_type": "operational_risk", + "assessment": { + "monitoring": { + "score": ${MONITORING_SCORE}, + "max_score": 100, + "status": $([ ${MONITORING_SCORE} -ge 75 ] && echo ""passed"" || echo ""needs_improvement"") + }, + "alerts": { + "score": ${ALERT_SCORE}, + "max_score": 100, + "status": $([ ${ALERT_SCORE} -ge 75 ] && echo ""passed"" || echo ""needs_improvement"") + }, + "rollback": { + "score": ${ROLLBACK_SCORE}, + "max_score": 100, + "status": $([ ${ROLLBACK_SCORE} -ge 75 ] && echo ""passed"" || echo ""needs_improvement"") + }, + "documentation": { + "score": ${DOC_SCORE}, + "max_score": 100, + "status": $([ ${DOC_SCORE} -ge 75 ] && echo ""passed"" || echo ""needs_improvement"") + }, + "security": { + "score": ${SECURITY_SCORE}, + "max_score": 100, + "status": $([ ${SECURITY_SCORE} -ge 75 ] && echo ""passed"" || echo ""needs_improvement"") + } + }, + "overall_score": ${AVG_SCORE}, + "risk_level": "${RISK_LEVEL}", + "recommendations": [ + $([ ${MONITORING_SCORE} -lt 75 ] && echo '"Implement comprehensive monitoring and metrics collection"' || echo ''), + $([ ${ALERT_SCORE} -lt 75 ] && echo '"Configure alerting rules and notification channels"' || echo ''), + $([ ${ROLLBACK_SCORE} -lt 75 ] && echo '"Develop and test rollback procedures"' || echo ''), + $([ ${DOC_SCORE} -lt 75 ] && echo '"Create operational documentation and runbooks"' || echo ''), + $([ ${SECURITY_SCORE} -lt 75 ] && echo '"Enhance security configuration and scanning"' || echo '') + ] +} +EOF + +log_info "Risk assessment report: ${REPORT_DIR}/operational_risk_${TIMESTAMP}.json" + +# Final summary +echo "" +echo "========================================" +log_info "Operational Risk Assessment Summary" +echo "========================================" +echo "Monitoring: ${MONITORING_SCORE}/100" +echo "Alerts: ${ALERT_SCORE}/100" +echo "Rollback: ${ROLLBACK_SCORE}/100" +echo "Documentation: ${DOC_SCORE}/100" +echo "Security: ${SECURITY_SCORE}/100" +echo "----------------------------------------" +echo "Overall Score: ${AVG_SCORE}/100" +echo "Risk Level: ${RISK_LEVEL}" +echo "========================================" + +if [ "${RISK_LEVEL}" = "LOW" ] || [ "${RISK_LEVEL}" = "MEDIUM" ]; then + log_info "Risk assessment: ACCEPTABLE" + exit 0 +else + log_warn "Risk assessment: NEEDS ATTENTION" + exit 1 +fi