Adopt @decoperations/calibrate for code quality gating

[jeremyjs]

Goal

Wire @decoperations/calibrate into OWASP.WTF so every push / PR runs the six weighted quality checks (TypeScript, ESLint, Prettier, security audit, tests, coverage) and reports a score.

Context

We're piloting calibrate adoption across DecOperations / Dial-WTF / YLaunchinator repos, starting with the strongest TS fits. OWASP.WTF is on the priority pilot list. There's a nice dogfood symmetry here: OWASP.WTF security-scans the whole DecOperations + Dial-WTF org footprint via the recent rollout, and now it'd run calibrate on itself as well.

Calibrate.WTF itself already self-hosts the workflow and has been green for the last 5+ runs on main — that's the reference implementation to copy.

Pilot strategy: land calibrate in advisory mode first (continue-on-error: true) so the first run can't block PRs while we look at the actual score and tune thresholds. Flip to gating mode once it's stable.

Stack notes

Plain TypeScript package (owasp-wtf). Default calibrate init config should work without per-workspace fuss. Calibrate.WTF's workflow is essentially the template — copy it nearly verbatim.

Install path

Same-org (DecOperations → DecOperations) — install @decoperations/calibrate from GitHub Packages using the default ${{ github.token }}. No extra PAT or org secret required.

Steps

• Create branch
• Run calibrate init to generate .calibrate/config.json (let it auto-detect the stack)
• Add .github/workflows/calibrate.yml modeled on decoperations/calibrate.wtf's workflow but with:
  • continue-on-error: true on the calibrate step (advisory mode)
  • Install of @decoperations/calibrate from GitHub Packages using ${{ github.token }}
  • PR-comment step posting the score
• Open PR, confirm workflow runs and posts a score comment
• Review the first score — tune .calibrate/config.json thresholds if defaults are too tight
• Once stable, remove continue-on-error: true to turn it into a real quality gate

Acceptance criteria

• Calibrate workflow runs on push/PR to default branch
• First run is advisory (non-blocking) — produces a score, doesn't fail the build
• Score is posted as a PR comment
• Follow-up to flip to gating mode is tracked

Reference

• Working workflow: https://github.com/decoperations/calibrate.wtf/blob/main/.github/workflows/calibrate.yml
• Install guide: decoperations/calibrate.wtf/docs/github-packages.md
• Calibrate repo: https://github.com/decoperations/calibrate.wtf

[jeremyjs]

PM Azimuth — 2026-05-23: Issue Rewrite Required Before Launch

This issue is not yet agent-ready. Moving to cycle:next.

Problem with current scope: The issue describes a multi-phase rollout (advisory → gating) but doesn't isolate Phase 1 into a self-contained, mergeable unit of work. An agent picking this up today would either do too little (only advisory) or too much (attempt gating without baseline data).

Rewritten scope for Phase 1 (agent-ready):

Title: feat(ci): integrate @decoperations/calibrate quality scoring (advisory mode, PR comments)

Acceptance criteria:

• @decoperations/calibrate installed as dev dep from GitHub Packages
• calibrate init run; .calibrate/config.json committed with all six dimensions
• .github/workflows/calibrate.yml created; runs on push + PR
• Calibrate step has continue-on-error: true (advisory, never blocks CI)
• Score summary posted as PR comment on every PR
• Existing ci.yml workflows unaffected
• Baseline score documented in PR description

Non-goals for Phase 1:

• Do NOT set continue-on-error: false
• Do NOT integrate score into release decisions
• Do NOT modify ci.yml

Phase 2 (gating) is a separate future issue — only creates after baseline data is collected.

Risk: risk:low (advisory, non-blocking, CI config only)

Dependencies: GitHub Packages auth (documented in PR #19)