[comp] Production Deploy

[github-actions]

This is an automated pull request to release the candidate branch into production, which will trigger a deployment.
It was created by the [Production PR] action.

---

Summary by cubic

Unifies findings into a single overview with create/detail sheets and a unified API, adds severity and area support (including general buckets), surfaces legacy scope in the UI, tightens permissions and notifications, and fixes enum validation, select label overflow, and role-gated status options.

• New Features

  • New /overview/findings with search, filters, open-count tab, deep-linking (auto-opens the sheet), and create/detail sheets.
  • Unified API: one GET /v1/findings with filters (status, severity, area, targets). Admin reuses the same DTOs and service.
  • Target model: each finding ties to exactly one target (task, evidence submission, form type, policy, vendor, risk, member, device) or an area; areas include general risks/vendors/policies.
  • Create/Detail sheets: support evidence submissions and general areas; role-gated status options; add copy-link and delete confirmation; show a legacy scope hint for backfilled findings.
  • Notifications: task findings notify only stakeholders; evidence form types are normalized; ready-for-review created by platform admins fall back to owners/admins.
  • Cleanup/UX: removed findings UIs from Tasks, Documents, and People; Admin tab reuses the new create sheet with org-scoped pickers and correct evidence-form endpoint; Export All Evidence now uses a Sheet; People/Devices tabs render faster with skeletons and non-blocking Fleet load. Truncated long select labels and fixed a SelectTrigger type error. DTO hardening: accepts new FindingArea values even if the process started before a Prisma client regen. Dropped a redundant creation audit log to prevent duplicate activity entries.

• Migration

  • Schema adds FindingSeverity, FindingArea (including other, risks, vendors, policies), and nullable FKs for policy/vendor/risk/member/device; drops FindingScope and backfills legacy rows to area='people' (kept as-is; legacy scope is shown in the UI).
  • Run the DB migration; no manual data steps. Auditor-only finding:create/delete remains; owners/admins keep read/update.

^{Written for commit 6f2474b. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app (staging)	Ready	Preview, Comment	Apr 19, 2026 5:36pm
comp-framework-editor	Ready	Preview, Comment	Apr 19, 2026 5:36pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
portal (staging)	Skipped		Apr 19, 2026 5:36pm

[cubic-dev-ai]

10 issues found across 59 files

Note: This PR contains a large number of files. During the trial, cubic reviews up to 50 files per PR. Paid plans get a higher limit.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/app/src/app/(app)/[orgId]/overview/components/CreateFindingSheet.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/overview/components/CreateFindingSheet.tsx:69">
P2: `evidenceSubmission` is handled in code but missing from the target dropdown, so users cannot create findings linked to an evidence submission from this form.</violation>
</file>

<file name="packages/db/prisma/schema/finding.prisma">

<violation number="1" location="packages/db/prisma/schema/finding.prisma:50">
P1: The model documents an "exactly one target or area" rule, but the schema/migration do not enforce it, allowing ambiguous or targetless findings to be persisted.</violation>
</file>

<file name="apps/api/src/findings/findings.service.ts">

<violation number="1" location="apps/api/src/findings/findings.service.ts:341">
P2: Normalize the finding before notifying on create, otherwise notification labels can expose DB enum values instead of external form-type names.</violation>

<violation number="2" location="apps/api/src/findings/findings.service.ts:448">
P2: Pass normalized form-type values to status-change notifications to avoid user-facing DB enum strings.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/overview/components/FindingDetailSheet.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/overview/components/FindingDetailSheet.tsx:74">
P2: Risk finding links point to `/risks/...` but the actual route is `/risk/...`, so the linked item navigation breaks for risk targets.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/FindingsTab.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/admin/organizations/[adminOrgId]/components/FindingsTab.tsx:219">
P1: `CreateFindingSheet` is wired into the admin org page, but it fetches task/policy/vendor/etc. options from current-org endpoints instead of the selected admin organization, causing incorrect target selection context.</violation>
</file>

<file name="apps/api/src/findings/dto/create-finding.dto.ts">

<violation number="1" location="apps/api/src/findings/dto/create-finding.dto.ts:39">
P1: The new target ID fields allow empty strings, which can bypass target/entity validation and then fail at DB write time.</violation>
</file>

<file name="apps/api/src/findings/findings.service.spec.ts">

<violation number="1" location="apps/api/src/findings/findings.service.spec.ts:35">
P2: Add `FindingSeverity` to the `@db` mock; `CreateFindingDto` uses it at import time and the current mock can break module initialization.</violation>
</file>

<file name="apps/api/src/findings/finding-notifier.service.ts">

<violation number="1" location="apps/api/src/findings/finding-notifier.service.ts:158">
P2: `ready_for_review` notifications are dropped for findings created by platform admins because the new logic returns early when `createdById` is null.</violation>

<violation number="2" location="apps/api/src/findings/finding-notifier.service.ts:433">
P2: `includeAdmins` bypasses org active-member checks for the primary recipient, which can send notifications to deactivated users.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[carhartlewis]

• Issue 1 (P2) — CONFIRMED, fixed: Added evidenceSubmission entry to TARGET_OPTIONS in CreateFindingSheet.tsx.
• Issue 2 (P1) — Valid observation but fix skipped: Adding a DB CHECK constraint requires a migration and risks rejecting any legacy rows; deferring to a planned cleanup.
• Issue 3 (P2) — FALSE: finding-notifier.service.ts already runs every form-type value through normalizeFormType() before rendering labels. Notifier receives raw enums by design.
• Issue 4 (P2) — FALSE: Line 74 already points to /risk/${id} (singular), matching the actual route directory.
• Issue 5 (P1) — FALSE: FindingsTab.tsx:219 passes organizationId={orgId}, adminCreateFn (posting to /v1/admin/organizations/${orgId}/findings), and endpointOverrides that route every picker to admin endpoints.
• Issue 6 (P1) — FALSE: @IsOptional() only skips validators when value is null/undefined; @isnotempty() fires on "" and returns 400. Empty strings can't reach the DB.
• Issue 7 (P2) — CONFIRMED, fixed: Added FindingSeverity to the @db mock in findings.service.spec.ts.
• Issue 8A (P2) — FALSE: notifyStatusChanged explicitly falls back to getOwnersAndAdmins when createdById is null (lines 173-187, with comment).
• Issue 8B (P2) — Violation as written is FALSE (primary recipient does check both deactivated: false and isActive: true). A minor asymmetry exists on admins but doesn't match the claim; skipping.

[cubic-dev-ai]

5 issues found across 62 files

Note: This PR contains a large number of files. During the trial, cubic reviews up to 50 files per PR. Paid plans get a higher limit.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/findings/finding-audit.service.ts">

<violation number="1" location="apps/api/src/findings/finding-audit.service.ts:11">
P2: `logFindingCreated` remains an unused code path, so the newly added target mapping is dead code and can diverge from real audit behavior.</violation>
</file>

<file name="apps/api/src/findings/findings.service.ts">

<violation number="1" location="apps/api/src/findings/findings.service.ts:131">
P2: `listForOrganization` does not support filtering by severity, so callers cannot retrieve findings by severity even though severity is now persisted.</violation>
</file>

<file name="packages/db/prisma/schema/finding.prisma">

<violation number="1" location="packages/db/prisma/schema/finding.prisma:55">
P1: The schema documents an "exactly one target or area" invariant, but it is not enforced at the database level, so invalid findings (zero or multiple targets) can be persisted.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/overview/components/FindingDetailSheet.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/overview/components/FindingDetailSheet.tsx:329">
P2: Filter status options by role before rendering; the current dropdown exposes backend-forbidden statuses and leads to predictable 403 save failures.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/overview/components/CreateFindingSheet.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/overview/components/CreateFindingSheet.tsx:147">
P2: `extractOptions` does not handle object-map responses, so the document-type target picker can render empty for evidence-form endpoints that return keyed objects.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[cubic-dev-ai]

4 issues found across 63 files

Note: This PR contains a large number of files. During the trial, cubic reviews up to 50 files per PR. Paid plans get a higher limit.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/findings/findings.controller.spec.ts">

<violation number="1" location="apps/api/src/findings/findings.controller.spec.ts:4">
P2: Replace this placeholder test with a real controller assertion. As written, the spec always passes and provides no coverage for `FindingsController` regressions.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/people/devices/components/DevicesTabContent.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/people/devices/components/DevicesTabContent.tsx:43">
P2: This agent-only loading gate can show a false empty-state message while Fleet is still loading. Keep the skeleton until Fleet resolves when there is no agent data yet.</violation>
</file>

<file name="apps/api/src/findings/finding-notifier.service.ts">

<violation number="1" location="apps/api/src/findings/finding-notifier.service.ts:383">
P1: Scope recipient lookup queries by `organizationId`; current ID-only lookups can resolve cross-tenant recipients and leak finding notifications.</violation>
</file>

<file name="apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.tsx">

<violation number="1" location="apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.tsx:145">
P2: Deep-link handling does not switch to the requested finding when a different finding is already selected.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[carhartlewis]

Approved by @Marfuen

[claudfuen]

🎉 This PR is included in version 3.24.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀