feat(enrichment): add IaC misconfig analyzer (#1508)

[jonathanchang31]

Summary

This PR adds a new REES analyzer for issue #1508 that scans changed IaC and config files for common static misconfigurations and renders the findings into the external review brief.

Related Issue

Closes: #1508

Change Type

• New feature
• Tests
• Documentation
• Bug fix
• Breaking change

Detection Coverage

• wildcard CORS with credentials
• 0.0.0.0/0 open ingress
• public bucket ACL / public access settings
• SameSite=None with Secure=false
• disabled TLS verification
• production debug enabled
• hardcoded service URLs in config

Real Behavior Proof

Focused validation

• npm --prefix review-enrichment test ✅

Full repo validation

• npm run test:ci ✅
• npm audit --audit-level=moderate ✅

Checklist

• Added analyzer implementation
• Wired analyzer into REES registry
• Added brief rendering
• Added targeted tests
• Ran full required validation
• Kept change scoped to wanted paths
• Avoided unrelated changes

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-06-29 21:50:53 UTC}

6 files · 1 AI reviewer · no blockers · readiness 48/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
This PR adds a pure local IaC/config analyzer, wires it into the REES registry and brief rendering, and covers the main rule paths with targeted tests. The changed code is coherent with the stated feature and the analyzer is registered in the post-change `BriefFindings` contract, so the visible implementation is safe enough to proceed. The notable maintenance gap is that the UI analyzer catalog excerpt still lacks the new analyzer entry, so users may not see or understand the new selectable analyzer outside the service README.

Nits — 6 non-blocking

• nit: `apps/gittensory-ui/src/lib/rees-analyzers.ts` is not updated in this diff, so the new `iacMisconfig` analyzer is documented in `review-enrichment/README.md` but not reflected in the existing UI analyzer catalog excerpt.
• nit: `review-enrichment/src/analyzers/iac-misconfig.ts:53` deduplicates findings by `kind:line`; include the file in the key if this helper is ever reused across multi-file scans to avoid accidental cross-file suppression.
• nit: `review-enrichment/src/analyzers/iac-misconfig.ts:86` tracks paired signals across an entire diff hunk, which can produce noisy CORS/cookie/debug findings when unrelated config blocks happen to be adjacent in one hunk.
• Add an `iacMisconfig` entry to `apps/gittensory-ui/src/lib/rees-analyzers.ts` so the UI-facing analyzer list stays in parity with `review-enrichment/src/brief.ts` and `review-enrichment/README.md`.
• Tighten paired-rule state in `review-enrichment/src/analyzers/iac-misconfig.ts` around obvious block boundaries or adjacent-line windows if you want fewer false positives from large YAML/Terraform hunks.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (size label size:L; no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR; address the blocker before review.
Contributor workload	✅ 10/10	Author activity: 123 registered-repo PR(s), 67 merged, 11 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	jonathanchang31; Gittensor profile; 123 PR(s), 11 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: jonathanchang31
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 123 PR(s), 11 issue(s).
• Related work: Titles/paths share 6 meaningful terms. (PR #1750)
• Related work: Titles/paths share 6 meaningful terms. (PR #1751)
• Related work: Titles/paths share 6 meaningful terms. (PR #1764)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Explain no-issue PR.
• Review top overlaps.
• Add a concise scope and risk note.
• Fix the blocker.
• Triage stale or unlinked PRs.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review