[TEMP — NÃO MERGEAR] rodar CI completo do fix/pr263-blockers

SECURITY.md

@@ -0,0 +1,59 @@
+# Security Policy
+
+## Supported Versions
+
+We actively support and provide security patches for the following versions of Boss:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| latest  | ✅ Yes             |
+| < 2.0   | ❌ No              |
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+To report a security issue, please use one of the following methods:
+
+1. **GitHub Private Vulnerability Reporting** (preferred):
+   Navigate to the [Security Advisories](https://github.com/HashLoad/boss/security/advisories/new) page
+   and submit a private advisory.
+
+2. **Email**: Send details to `security@hashload.com` with the subject line:
+   `[SECURITY] Boss - <brief description>`
+
+### What to include
+
+- Description of the vulnerability and its potential impact
+- Steps to reproduce or proof-of-concept
+- Affected version(s) and environment (OS, Delphi version)
+- Any suggested mitigation or fix
+
+### Response Timeline
+
+| Stage             | Target SLA        |
+| ----------------- | ----------------- |
+| Acknowledgement   | ≤ 3 business days |
+| Initial triage    | ≤ 7 business days |
+| Fix / Advisory    | ≤ 90 days         |
+
+We will keep you informed throughout the process and credit you in the release notes
+(unless you prefer to remain anonymous).
+
+## Scope
+
+This policy covers the **Boss CLI binary** (`boss.exe` / `boss`) and the Go source code
+in this repository. It does **not** cover:
+
+- Third-party packages installed via `boss install` (report those to their respective maintainers)
+- The PubPascal portal (report to `security@pubpascal.dev`)
+
+## CRA Compliance
+
+Boss ships a machine-readable **Software Bill of Materials (SBOM)** with every release
+and maintains this vulnerability-disclosure policy in accordance with the
+[EU Cyber Resilience Act (CRA)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32024R2847)
+Article 14 (active vulnerability management) and Annex I Part II (secure development).
+
+The SBOM is published as `sbom.cdx.json` (CycloneDX 1.6) at each
+[GitHub release](https://github.com/HashLoad/boss/releases).

internal/adapters/primary/cli/cmd_test.go

@@ -23,6 +23,7 @@ func TestRootCommand(t *testing.T) {
 	t.Run("register commands", func(t *testing.T) {
 		// These should not panic
 		versionCmdRegister(root)
+		pubpascalCmdRegister(root)
 
 		// Verify command was added
 		if root.Commands() == nil {
@@ -39,7 +40,7 @@ func TestVersionCommand(t *testing.T) {
 	// Find the version command
 	var versionCmd *cobra.Command
 	for _, cmd := range root.Commands() {
-		if cmd.Use == "version" {
+		if cmd.Use == cmdNameVersion {
 			versionCmd = cmd
 			break
 		}
@@ -117,6 +118,8 @@ func TestCommandHelp(t *testing.T) {
 	// Register all commands
 	versionCmdRegister(root)
 	installCmdRegister(root)
+	pubpascalCmdRegister(root)
+	craCmdRegister(root)
 
 	for _, cmd := range root.Commands() {
 		t.Run(cmd.Use, func(t *testing.T) {
@@ -160,3 +163,53 @@ func TestRootHelp(t *testing.T) {
 		t.Error("Root command should produce help output")
 	}
 }
+
+// findCommand returns the direct sub-command of parent with the given name.
+func findCommand(parent *cobra.Command, name string) *cobra.Command {
+	for _, cmd := range parent.Commands() {
+		if cmd.Name() == name {
+			return cmd
+		}
+	}
+
+	return nil
+}
+
+// assertSubcommands reports every expected sub-command missing from parent.
+func assertSubcommands(t *testing.T, parent *cobra.Command, label string, names []string) {
+	t.Helper()
+
+	for _, name := range names {
+		if findCommand(parent, name) == nil {
+			t.Errorf("%s subcommand '%s' not found", label, name)
+		}
+	}
+}
+
+// TestPubPascalCommands tests that the PubPascal commands are registered correctly.
+func TestPubPascalCommands(t *testing.T) {
+	root := &cobra.Command{Use: "boss"}
+	pubpascalCmdRegister(root)
+
+	// Check workspace command and its subcommands
+	workspaceCmd := findCommand(root, "workspace")
+	if workspaceCmd == nil {
+		t.Fatal("Workspace command not found")
+	}
+	assertSubcommands(t, workspaceCmd, "Workspace", []string{"clone", "status", "update", "push"})
+
+	// Check pkg command and root commands
+	pkgCmd := findCommand(root, "pkg")
+	if pkgCmd == nil {
+		t.Fatal("Pkg command not found")
+	}
+	if findCommand(root, "sbom") == nil {
+		t.Error("Root command 'sbom' not found")
+	}
+	if findCommand(root, "publish-sbom") == nil {
+		t.Error("Root command 'publish-sbom' not found")
+	}
+
+	// Check pkg subcommands
+	assertSubcommands(t, pkgCmd, "Pkg", []string{"spec", "pack"})
+}