Research-Stack/4-Infrastructure/NoDupeLabs/pipeline

Quality Pipeline

Universal self-configuring quality pipeline for Cline. Auto-detects the project stack and runs the appropriate checks.

MCP Servers Required

Configure these in your Cline MCP settings before running:

Server	Key tools
Semgrep	semgrep_scan, semgrep_scan_supply_chain, semgrep_findings, get_abstract_syntax_tree
Project Health Auditor	list_repo_files, file_metrics, git_churn, map_tests
API Debugger	load_openapi, ingest_logs, explain_failure, make_repro
memory	memory_store, memory_search, memory_update, memory_graph

Files

.clinerules                  ← Cline reads this automatically (per-project)
orchestrator_prompt.md       ← Paste into Cline task input to start pipeline
pyproject.toml               ← Tool configuration (single source of truth)
.flake8                      ← flake8 config (does not support pyproject.toml)
.gitignore                   ← Includes reports/ and secret file patterns
scripts/
  audit.py                   ← Universal pipeline runner (auto-detects stack)
  install_tools.sh           ← One-time tool installation
reports/                     ← Generated at runtime — gitignored

Setup

# 1. Install tools (one time)
bash scripts/install_tools.sh

# 2. Update pyproject.toml — replace these values:
#    name, version, description
#    requires-python
#    python_version  (tool.mypy)
#    target-version  (tool.black)
#    known_first_party (tool.isort)

Usage

# See what the pipeline detects in your project
python scripts/audit.py detect

# Phase 0 — baseline (run before starting Cline)
python scripts/audit.py recon

# Phase 2 — full validation (all checks must pass)
python scripts/audit.py audit

# Single check
python scripts/audit.py pytest
python scripts/audit.py mypy
python scripts/audit.py gitleaks

Starting the Pipeline in Cline

1. Open this project as your Cline workspace root
2. Paste the contents of orchestrator_prompt.md as your task
3. Cline will read .clinerules, check memory MCP for prior state, and begin Phase 0 automatically

Detected Technologies

The pipeline auto-detects and enables checks for:

• Languages: Python, Node/JS, Go, Java, Ruby, Rust
• APIs: FastAPI, Flask, Django, aiohttp (triggers API Debugger MCP)
• Infrastructure: Ansible, Docker, Podman, Helm, Kubernetes, Terraform
• Always active: gitleaks (secrets), trivy (filesystem vulns)

MCP vs Subprocess

Some checks are handled by MCP servers and skipped in subprocess mode:

Check	Handler
SAST (bandit)	Semgrep MCP → semgrep_scan()
Complexity (radon)	Project Health Auditor MCP → file_metrics()
Lint (pylint/flake8)	Project Health Auditor MCP → file_metrics()
Dead code (vulture)	Project Health Auditor MCP → file_metrics()

Fallback subprocess tools remain installed for when MCP servers are unavailable.

Success Criteria

All of the following must be true simultaneously:

• reports/summary.json → "status": "PASSED", "failed": []
• reports/mcp_semgrep_after.json → zero CRITICAL/HIGH findings
• reports/mcp_semgrep_supply_chain_after.json → zero vulnerabilities
• reports/mcp_health_metrics_after_*.json → CC ≤ 10, MI ≥ 65 for all files
• reports/mcp_api_after.json → zero failures (if API detected)
• memory MCP → last_audit_status = "PASSED"