mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-31 04:12:10 +03:00
28d57bf5f8
FIX 1 — security scanner install (gitleaks/osv/actionlint/zizmor): the step ran under bash -e and aborted before the $GITHUB_PATH export when 'go install ...gitleaks/v8@latest' failed/produced a non-working binary, so no scanner landed on PATH and every check self-skipped. Rewritten to set +e, install from official release downloads, ALWAYS export $HOME/.local/bin, and print diagnostics. Validated only on the next CI run (binaries install in CI). FIX 2 — size-limit bundleSize: add @size-limit/file devDependency (the correct preset for the plain FILE-size .size-limit.json) + allowlist entry. check:bundle-size now measures the 4 bin entries via the preset (bundleSize=5601) instead of erroring on the missing preset / falling back to fs.statSync. FIX 3 — codeqlAlerts promoted to BLOCKING: check-codeql-ratchet.mjs now reads metrics.codeqlAlerts.value, exits 1 ONLY on a real regression (measured > baseline), and exits 0 (graceful skip) on any measurement failure (gh absent / no auth / no repo / API error) so missing infra never blocks. Baseline seeded codeqlAlerts=0 (repo has 0 open alerts). Blocking step wired in the quality-gate job with security-events:read; the duplicate advisory step removed from quality-extended. New TDD: evaluateCodeqlRatchet (5 cases).