mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
273ecf7b5f
Add a --ratchet mode to check-secrets, check-workflows and check-bundle-size: read the metric value from config/quality/quality-baseline.json, compare the measured count, and exit 1 only on a real regression (measured > baseline, direction:down). Without --ratchet the scripts keep their advisory behavior (exit 0). Every graceful SKIP (binary absent, size-limit plugin/build absent) exits 0 even with --ratchet — missing infra never blocks, only a measured regression does. check-workflows ratchets ONLY zizmorFindings; actionlint stays reported, and the separate --strict all-or-nothing flag is untouched. check-bundle-size only enforces on the real size-limit gzip path (comparable to the frozen baseline); the raw fallback-stat measurement SKIPs under --ratchet. Re-baseline zizmorFindings 187 -> 192: legitimate drift from new workflow files (nightly-schemathesis.yml etc.) added in v3.8.26; reproducible locally and confirmed in CI run #27593205254 (job 81578109020) = 192. secretFindings (3) and bundleSize (5601) already matched the CI value and are unchanged. Wire blocking in the ci.yml quality-extended job: drop the job-level continue-on-error; make Secret scan / Workflow lint / Bundle size blocking with --ratchet; keep the scanner install, osv vuln ratchet, oasdiff breaking-change and dpdm circular-deps advisory via step-level continue-on-error. Tests: extend tests/unit/build for each script's --ratchet mode (measured==baseline -> 0, measured>baseline -> regression, binary/baseline absent -> graceful null/skip). 81 build tests pass.