Add artifacts for the weekly drift report and bug triage automations

[devin-ai-integration]

Summary

This repo is the hub for two always-on Devin Automations: it holds the shared output contract, both designs, and the exact prompts each automation runs. Sibling PRs add the matching scanners to petclinic-microservices and timesheet-infra.

Why a schema first: the weekly report has to be one report over npm, Maven and Terraform, and its remediation queue is the input to a Track 2 fan-out. So each repo carries its own read-only scanner emitting the same document (docs/automations/remediation-queue.schema.json), and the report is a merge-and-sort over those documents instead of hand-assembled prose. Every scanner validates against the schema (checked with jsonschema against real output from all three repos).

scripts/drift_scan.py here scans backend/ and frontend/:

npm outdated --json --long  ->  current/latest/gap per package
npm audit --json            ->  advisories (kept even when npm outdated has nothing to say,
                                since a transitive CVE needs a lockfile bump or an override)
rank_score = worst severity + advisory volume + staleness + exposure(runtime > dev)
size       = XS lockfile-only | S in-major bump | M breaking major | L high blast radius

Ranking and sizing live in the scanners, not in the prompt, so the queue is reproducible and week-over-week comparable rather than a fresh judgment call each Monday. Current run: 64 items, 0 scan errors; a non-empty errors array makes the report partial — an unreachable registry is never published as "no findings".

Docs state trigger / guardrails / human checkpoint for each automation:

• docs/automations/weekly-drift-report.md — schedule Mondays 06:00 UTC, read-only, no autonomous remediation, queue is a proposal a maintainer picks from before any fan-out starts.
• docs/automations/bug-triage.md — GitHub issue labeled bug, reproduce before assigning severity, and an explicit definition of "trivial" (one file, ~<10 lines, no schema/API/auth change, existing tests pass). Anything else stops at "here's the fix I propose — confirm and I'll do it"; uncertainty counts as non-trivial.

docs/automations/prompts/ holds the verbatim prompt text of each automation so a prompt change is reviewable in a PR instead of only living in the Automations UI.

No production code, dependency or CI changes.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/1cf3e3c3095942f2acedc39b9996c14f
Requested by: @sumitshatwara

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud