UI work to fill SBOM sourcing management gap. UI planning remaining functionality exposure. Work on CI/Tests stabilization

Introduces CGS determinism test runs to CI workflows for Windows, macOS, Linux, Alpine, and Debian, fulfilling CGS-008 cross-platform requirements. Updates local-ci scripts to support new smoke steps, test timeouts, progress intervals, and project slicing for improved test isolation and diagnostics.

devops/scripts/local-ci.ps1

@@ -25,6 +25,21 @@
 .PARAMETER Workflow
     Specific workflow to simulate (for workflow mode)
 
+.PARAMETER SmokeStep
+    Smoke step (smoke mode only): build, unit, unit-split
+
+.PARAMETER TestTimeout
+    Per-test timeout (e.g., 5m) using --blame-hang (bash runner)
+
+.PARAMETER ProgressInterval
+    Progress heartbeat in seconds during long test runs
+
+.PARAMETER ProjectStart
+    Start index (1-based) for unit-split slicing
+
+.PARAMETER ProjectCount
+    Limit number of projects for unit-split slicing
+
 .PARAMETER Docker
     Force Docker execution mode
 
@@ -56,6 +71,18 @@
     .\local-ci.ps1 smoke
     Quick validation before push
 
+.EXAMPLE
+    .\local-ci.ps1 smoke -SmokeStep unit-split
+    Run Unit tests per project to isolate hangs
+
+.EXAMPLE
+    .\local-ci.ps1 smoke -SmokeStep unit-split -TestTimeout 5m -ProgressInterval 60
+    Add hang detection and progress heartbeat
+
+.EXAMPLE
+    .\local-ci.ps1 smoke -SmokeStep unit-split -ProjectStart 1 -ProjectCount 50
+    Run unit-split in chunks to narrow the slow/hanging project
+
 .EXAMPLE
     .\local-ci.ps1 pr
     Full PR check
@@ -82,14 +109,18 @@ param(
     [string]$Category,
     [string]$Module,
     [string]$Workflow,
+    [ValidateSet('build', 'unit', 'unit-split')]
+    [string]$SmokeStep,
+    [string]$TestTimeout,
+    [int]$ProgressInterval,
+    [int]$ProjectStart,
+    [int]$ProjectCount,
 
     [switch]$Docker,
     [switch]$Native,
     [switch]$Act,
 
     [int]$Parallel,
-
-    [switch]$Verbose,
     [switch]$DryRun,
     [switch]$Rebuild,
     [switch]$NoServices,
@@ -98,6 +129,8 @@ param(
     [switch]$Help
 )
 
+$isVerbose = $PSBoundParameters.ContainsKey('Verbose')
+
 # Script location
 $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $RepoRoot = Split-Path -Parent (Split-Path -Parent $ScriptDir)
@@ -134,8 +167,15 @@ function Find-BashExecutable {
         # Verify WSL is working
         $wslCheck = & wsl --status 2>&1
         if ($LASTEXITCODE -eq 0) {
-            Write-Info "Using WSL2 for Bash execution"
-            return @{ Type = 'wsl'; Path = 'wsl' }
+            $wslDotnetInfo = & wsl dotnet --info 2>&1
+            if ($LASTEXITCODE -eq 0 -and $wslDotnetInfo -match 'OS Name:\s+Windows') {
+                Write-Warning "WSL dotnet is Windows-based; falling back to Git Bash for path-safe execution"
+            } elseif ($LASTEXITCODE -eq 0) {
+                Write-Info "Using WSL2 for Bash execution"
+                return @{ Type = 'wsl'; Path = 'wsl' }
+            } else {
+                Write-Warning "WSL dotnet not available; falling back to Git Bash"
+            }
         }
     }
 
@@ -175,6 +215,13 @@ function Convert-ToUnixPath {
     return $WindowsPath -replace '\\', '/'
 }
 
+function Quote-ForBash {
+    param([string]$Value)
+
+    $replacement = "'" + '"' + "'" + '"' + "'"
+    return "'" + ($Value -replace "'", $replacement) + "'"
+}
+
 # Build argument list
 function Build-Arguments {
     $args = @($Mode)
@@ -182,11 +229,16 @@ function Build-Arguments {
     if ($Category) { $args += "--category"; $args += $Category }
     if ($Module) { $args += "--module"; $args += $Module }
     if ($Workflow) { $args += "--workflow"; $args += $Workflow }
+    if ($SmokeStep) { $args += "--smoke-step"; $args += $SmokeStep }
+    if ($TestTimeout) { $args += "--test-timeout"; $args += $TestTimeout }
+    if ($ProgressInterval) { $args += "--progress-interval"; $args += $ProgressInterval }
+    if ($ProjectStart) { $args += "--project-start"; $args += $ProjectStart }
+    if ($ProjectCount) { $args += "--project-count"; $args += $ProjectCount }
     if ($Docker) { $args += "--docker" }
     if ($Native) { $args += "--native" }
     if ($Act) { $args += "--act" }
     if ($Parallel) { $args += "--parallel"; $args += $Parallel }
-    if ($Verbose) { $args += "--verbose" }
+    if ($isVerbose) { $args += "--verbose" }
     if ($DryRun) { $args += "--dry-run" }
     if ($Rebuild) { $args += "--rebuild" }
     if ($NoServices) { $args += "--no-services" }
@@ -237,8 +289,10 @@ try {
         'gitbash' {
             # Git Bash uses its own path conversion
             $unixScript = $scriptPath -replace '\\', '/'
-            Write-Info "Executing: $($bash.Path) $unixScript $($bashArgs -join ' ')"
-            & $bash.Path $unixScript @bashArgs
+            $commandArgs = @($unixScript) + $bashArgs
+            $commandLine = ($commandArgs | ForEach-Object { Quote-ForBash $_ }) -join ' '
+            Write-Info "Executing: $($bash.Path) -lc $commandLine"
+            & $bash.Path -lc $commandLine
         }
         'path' {
             Write-Info "Executing: bash $scriptPath $($bashArgs -join ' ')"