mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
00bdefcf0e
* chore(ci): gate hygiene — secrets baseline 0, semgrep metric drop, hadolint gate (WS6/D3 + WS1.7) - .gitleaks.toml: allowlist (with mandatory justification) for the 3 frozen generic-api-key false positives — latencyP50Ms/latencyP95Ms are metric FIELD NAMES and interleaved-thinking-2025-05-14 is Anthropic's PUBLIC beta header. quality-baseline secretFindings 3 -> 0: the ratchet is now zero-tolerance (verified: check:secrets --ratchet reports 0 findings, no regression). - quality-baseline: semgrepFindings removed — orphaned metric never wired to a blocking gate (semgrep.yml only echoes the count); CodeQL covers OWASP. - ci.yml lint job: hadolint on the Dockerfile (image pinned by digest, --failure-threshold error). Verified green against the current Dockerfile (5 pre-existing warnings visible, 0 errors). Also evaluated publint for the fast path (WS1.6) and REJECTED it with data: 1554 findings, ~all noise from the vendored dist/node_modules of the standalone package — wrong tool for this package shape; check:pack-boot is the real gate. * chore(ci): surgical baseline edit — preserve unicode formatting (was json.dump ensure_ascii noise)
545 B
545 B
- Quality gates hygiene (WS6/D3 + WS1.7): gitleaks baseline zeroed — the 3 frozen
generic-api-keyfalse positives (latency field names + the public Anthropic beta-header value) are allowlisted with justification, so any NEW secret finding now regresses the ratchet from 0; the orphanedsemgrepFindingsbaseline metric was dropped (never wired to a gate; CodeQL covers the OWASP families); Dockerfile now has a hadolint gate in the lint job (digest-pinned, error-threshold — the 5 pre-existing warnings stay visible without blocking)