mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-20 14:12:59 +03:00
65f9ce7edf
* docs(ops): add quality-gate assessment + replication playbook (Fase 9 foundation)
* feat(ci): flip oasdiff breaking-change gate to blocking (ratchet)
* docs(ops): deliver main branch-protection ruleset for owner to apply
* fix(ci): run typecheck:core in PR->release fast-gates (close fast-gates hole, part 1)
* perf(mutation): enable Stryker incremental mode + cache (scales the 60/80 rollout)
* feat(ci): commit CodeQL advanced config (security-extended), replacing default-setup
* feat(ci): version semgrep SAST workflow (owasp/secrets), advisory
* feat(quality): TIA test-impact map builder (import-graph; map built at runtime, gitignored)
* feat(quality): TIA impacted-test selector with run-all fail-safe
* fix(ci): run TIA-impacted unit tests in PR->release fast-gates (build map at runtime, fail-safe full)
* feat(ci): DAST-smoke per-PR (schemathesis subset + promptfoo injection-guard, blocking)
* fix(ci): unbreak Fase 9 PR CI (MDX frontmatter, CodeQL conflict, dast-smoke advisory)
- Add MDX frontmatter to docs/ops/{BRANCH_PROTECTION_MAIN,QUALITY_GATE_PLAYBOOK}.md.
fumadocs rejects frontmatter-less docs -> 'npm run build' failed -> broke dast-smoke's
build step (the release fast-gates never runs build, so this only surfaced on the PR).
- codeql.yml: workflow_dispatch-only until the owner switches repo CodeQL Default->Advanced
(advanced configs cannot be processed while default setup is enabled; documented inline).
- dast-smoke.yml: job-level continue-on-error (advisory) so this brand-new gate matures
before it blocks (repo convention: advisory -> blocking).
* ci(quality): make TIA unit-test step advisory until release test-debt is cleared
release/v3.8.27 carries ~17 pre-existing failing unit tests (budget #3537, apiKey
#3552, several Zod schemas, Puter/Qwen executors, mimocode entry, etc.) unrelated to
this PR — the new 'run tests on PR->release' gate surfaced them. Per the repo's
advisory->blocking convention, this step enters advisory (it still runs + reports)
so pre-existing debt doesn't block the gate program. typecheck:core stays blocking.
Flip to blocking (remove continue-on-error) once the release suite is green.
30 lines
860 B
YAML
30 lines
860 B
YAML
name: semgrep
|
|
on:
|
|
pull_request:
|
|
branches: ["main", "release/**"]
|
|
push:
|
|
branches: ["main"]
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
semgrep:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: semgrep/semgrep
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
- name: Run semgrep (advisory)
|
|
continue-on-error: true
|
|
run: |
|
|
semgrep scan --config p/owasp-top-ten --config p/secrets \
|
|
--sarif --output semgrep.sarif --metrics off || true
|
|
python -c "import json; d=json.load(open('semgrep.sarif')); print('semgrepFindings=%d' % len(d['runs'][0]['results']))" || echo "semgrepFindings=SKIP"
|
|
- uses: actions/upload-artifact@v4
|
|
if: always()
|
|
with:
|
|
name: semgrep-sarif
|
|
path: semgrep.sarif
|
|
retention-days: 14
|