feat: Quality pack targets

.github/workflows/ci.yml

@@ -38,6 +38,9 @@ jobs:
   docs:
     secrets: inherit
     uses: ./.github/workflows/docs.yml
+  quality_pack:
+    secrets: inherit
+    uses: ./.github/workflows/quality_pack.yml
   static-code-analysis:
     secrets: inherit
     uses: ./.github/workflows/static-code-analysis.yml
@@ -55,6 +58,7 @@ jobs:
       - build_and_test_cross_compilation
       - coverage
       - docs
+      - quality_pack
       - static-code-analysis
     permissions: {}
     runs-on: ubuntu-latest

.github/workflows/quality_pack-publish.yml

@@ -0,0 +1,123 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+# Waits for the CI workflow of a pull request, downloads the traceability gate
+# artifact produced by quality_pack_comment.yml, and posts (or edits) a
+# comment on the pull request with the gate summary and pass/fail status.
+#
+# Runs via workflow_run so that pull requests opened from forks — which get a
+# read-only GITHUB_TOKEN and cannot write comments themselves — still get a
+# comment posted by this workflow, which runs with the base repo's token.
+
+name: Publish Quality Pack Comment
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types:
+      - completed
+
+jobs:
+  quality-pack-comment:
+    name: Comment traceability gate on the pull request
+    if: github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read # list + download the artifacts of the triggering workflow run
+      pull-requests: write # comment on the pull request
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+      RUN_ID: ${{ github.event.workflow_run.id }}
+    steps:
+      - name: Resolve pull request number
+        id: metadata
+        env:
+          HEAD_REPO_OWNER: ${{ github.event.workflow_run.head_repository.owner.login }}
+          PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number || '' }}
+          REF_NAME: ${{ github.event.workflow_run.head_branch }}
+        run: |
+          set -euo pipefail
+
+          if [[ "$PR_NUMBER" == "null" ]]; then
+            PR_NUMBER=""
+          fi
+
+          # fork-origin workflow_run payloads do not include pull_requests[]
+          if [[ -z "$PR_NUMBER" && -n "$HEAD_REPO_OWNER" && -n "$REF_NAME" ]]; then
+            PR_NUMBER="$(gh api \
+              "repos/${REPO}/pulls?state=all&head=${HEAD_REPO_OWNER}:${REF_NAME}" \
+              --jq '.[0].number // empty' || true)"
+          fi
+
+          if [[ -z "$PR_NUMBER" ]]; then
+            echo "Could not determine PR number for pull_request event." >&2
+            exit 1
+          fi
+
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+
+      - name: Download quality pack artifact
+        id: download
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: quality-pack-metrics
+          path: _quality_pack_dl
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Render comment body
+        id: render
+        run: |
+          set -euo pipefail
+
+          GATE_FILE=_quality_pack_dl/_quality_pack/gate.txt
+          if [[ -f "$GATE_FILE" ]]; then
+            if grep -q "Threshold check passed." "$GATE_FILE"; then
+              status="**PASS**"
+            else
+              status="**FAIL**"
+            fi
+            gate_body=$(cat "$GATE_FILE")
+          else
+            status="**UNAVAILABLE**"
+            gate_body="No traceability gate output was produced by the CI run."
+          fi
+
+          {
+            echo "Quality pack traceability report for this pull request:"
+            echo
+            echo "Status: $status ([workflow run](${{ github.event.workflow_run.html_url }}))"
+            echo
+            echo '```text'
+            echo "$gate_body"
+            echo '```'
+          } > comment.md
+
+      - name: Find existing PR comment
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
+        id: fc
+        with:
+          issue-number: ${{ steps.metadata.outputs.pr_number }}
+          comment-author: "github-actions[bot]"
+          body-includes: Quality pack traceability report for this pull request
+
+      - name: Comment on PR with traceability gate summary
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
+        with:
+          issue-number: ${{ steps.metadata.outputs.pr_number }}
+          comment-id: ${{ steps.fc.outputs.comment-id }}
+          edit-mode: replace
+          body-path: comment.md

.github/workflows/quality_pack.yml

@@ -0,0 +1,75 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+# Builds the docs and runs the upstream //:traceability_gate against the
+# resulting _build/metrics.json, then uploads the gate output as an artifact.
+#
+# This workflow does NOT comment on the PR — see quality_pack-publish.yml for
+# the elevated-permissions companion that downloads the artifact and posts.
+# The split is required so that pull requests opened from forks (which get a
+# read-only GITHUB_TOKEN) still get a comment.
+
+name: Quality pack coverage
+
+on:
+  workflow_call:
+
+jobs:
+  quality-pack:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: eclipse-score/more-disk-space@v1
+      - name: Checkout repository
+        uses: actions/checkout@v7
+      - name: Create Bazel output base directory
+        run: |
+          sudo mkdir -p /mnt/.bazel
+          sudo chown -R $USER:$USER /mnt/.bazel
+      - name: Create config indicator file
+        run: echo "host" > .bazel_config
+      - name: Setup Bazel
+        uses: eclipse-score/cicd-actions/setup-bazel-cache@212bbf86267e9381da9d2daf962d12f6feafbc90 # v0.0.2
+        with:
+          unique-cache-name: ${{ github.job }}
+      - name: Allow linux-sandbox
+        uses: eclipse-score/cicd-actions/unblock-user-namespace-for-linux-sandbox@212bbf86267e9381da9d2daf962d12f6feafbc90 # v0.0.2
+      - name: Install Graphviz (required by PlantUML for non-sequence diagrams)
+        run: sudo apt-get update && sudo apt-get install -y graphviz
+      - name: Build unit + component tests (needed for test links)
+        run: bazel test //:unit_tests //:component_tests
+      - name: Build docs
+        run: bazel run //:docs
+      # Thresholds default to 0 while comp_req coverage is being (re-)built up
+      # against the SOME/IP protocol spec. Raise the --min-* flags as
+      # links land, so the gate never regresses without a follow-up ticket.
+      # --need-type=comp_req scopes the gate to component requirements;
+      # feat_req / stkh_req live upstream in eclipse-score/score and would
+      # otherwise pull the numbers to zero and flap the gate.
+      - name: Run traceability gate
+        continue-on-error: true
+        run: |
+          mkdir -p _quality_pack
+          bazel run //:traceability_gate -- \
+            --metrics-json "$PWD/_build/metrics.json" \
+            --need-type=comp_req \
+            > _quality_pack/gate.txt
+      - name: Upload quality pack artifact
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: quality-pack-metrics
+          path: |
+            _build/metrics.json
+            _quality_pack/gate.txt
+          if-no-files-found: warn
+          retention-days: 14

BUILD

@@ -42,18 +42,70 @@ use_format_targets(
 # Documentation
 # ==============================================================================
 
+# ==============================================================================
+# Quality-pack aggregate test suites
+# ==============================================================================
+# Unit tests (tagged `unit`). A test_suite in a top-level BUILD file cannot use
+# a package wildcard like `//score/...` in its `tests` attribute, so unit tests
+# are aggregated by explicit label. Run with:
+#   bazel test //:unit_tests
+test_suite(
+    name = "unit_tests",
+    tests = [
+        "//score/serializer:null_serializer_test",
+        "//score/socom/test/unit:socom_test",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+# Component-level tests (integration / stress, tagged `component`). Run with:
+#   bazel test //:component_tests
+test_suite(
+    name = "component_tests",
+    tests = [
+        "//score/gateway_ipc_binding/test:gateway_ipc_binding_test",
+        "//score/socom/test/stress:socom_stress_test",
+    ],
+    visibility = ["//visibility:public"],
+)
+
 docs(
     bundles = [
         {
-            "bundle": "//score/socom/docs:docs_bundle",
-            "mount_at": "socom",
+            "bundle": "//score/config/docs:docs_bundle",
+            "mount_at": "config",
             "attach_to": "components",
         },
         {
             "bundle": "//score/gateway_ipc_binding/docs:docs_bundle",
             "mount_at": "gateway_ipc_binding",
             "attach_to": "components",
         },
+        {
+            "bundle": "//score/gatewayd/docs:docs_bundle",
+            "mount_at": "gatewayd",
+            "attach_to": "components",
+        },
+        {
+            "bundle": "//score/serializer/docs:docs_bundle",
+            "mount_at": "serializer",
+            "attach_to": "components",
+        },
+        {
+            "bundle": "//score/socom/docs:docs_bundle",
+            "mount_at": "socom",
+            "attach_to": "components",
+        },
+        {
+            "bundle": "//score/someip/docs:docs_bundle",
+            "mount_at": "someip",
+            "attach_to": "components",
+        },
+        {
+            "bundle": "//score/someipd/docs:docs_bundle",
+            "mount_at": "someipd",
+            "attach_to": "components",
+        },
     ],
     source_dir = "docs",
 )

README.md

@@ -43,6 +43,34 @@ bazel run @score_tooling//coverage:generate_coverage_html
 
 The HTML report is stored at `coverage_linux/index.html`. You can open it in a web browser to view the coverage results.
 
+## Quality pack
+
+Requirements traceability is produced by the documentation build. Run the tests
+first: the docs build reads `bazel-testlogs` to link each requirement to the
+tests that verify it.
+
+```sh
+bazel test //:unit_tests //:component_tests
+bazel run //:docs
+```
+
+This generates:
+
+- `_build/index.html` — documentation, showing the source-code and test
+  links on each requirement
+- `_build/needs.json` — the requirements model
+- `_build/metrics.json` — traceability metrics
+
+To print the traceability summary on the command line:
+
+```sh
+bazel run //:traceability_gate -- --metrics-json "$PWD/_build/metrics.json"
+```
+
+CI runs the same gate on every pull request with thresholds attached, and
+posts the summary as a sticky comment — see
+`.github/workflows/quality_pack_comment.yml`.
+
 ### Start the daemons
 
 Start the daemons in this order:

score/config/docs/BUILD

@@ -0,0 +1,22 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+load("@score_docs_as_code//:docs.bzl", "docs_bundle")
+
+# Docs bundle for this component. Kept in its own package so the parent
+# BUILD does not need to load @score_docs_as_code.
+docs_bundle(
+    name = "docs_bundle",
+    source_dir = "",
+    visibility = ["//visibility:public"],
+)

score/config/docs/index.rst

@@ -0,0 +1,31 @@
+..
+   # *******************************************************************************
+   # Copyright (c) 2026 Contributors to the Eclipse Foundation
+   #
+   # See the NOTICE file(s) distributed with this work for additional
+   # information regarding copyright ownership.
+   #
+   # This program and the accompanying materials are made available under the
+   # terms of the Apache License Version 2.0 which is available at
+   # https://www.apache.org/licenses/LICENSE-2.0
+   #
+   # SPDX-License-Identifier: Apache-2.0
+   # *******************************************************************************
+
+.. _config:
+
+Config
+######
+
+.. comp:: Config
+   :id: comp__config
+   :security: NO
+   :safety: QM
+   :status: valid
+   :version: 1
+   :belongs_to: feat__someip_gateway
+
+Abstract
+========
+
+Provides the FlatBuffers schema (mw_someip_config.fbs) and JSON schema used to define and validate gateway configuration.