mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-07-26 09:52:11 +03:00
00bdefcf0e
* chore(ci): gate hygiene — secrets baseline 0, semgrep metric drop, hadolint gate (WS6/D3 + WS1.7) - .gitleaks.toml: allowlist (with mandatory justification) for the 3 frozen generic-api-key false positives — latencyP50Ms/latencyP95Ms are metric FIELD NAMES and interleaved-thinking-2025-05-14 is Anthropic's PUBLIC beta header. quality-baseline secretFindings 3 -> 0: the ratchet is now zero-tolerance (verified: check:secrets --ratchet reports 0 findings, no regression). - quality-baseline: semgrepFindings removed — orphaned metric never wired to a blocking gate (semgrep.yml only echoes the count); CodeQL covers OWASP. - ci.yml lint job: hadolint on the Dockerfile (image pinned by digest, --failure-threshold error). Verified green against the current Dockerfile (5 pre-existing warnings visible, 0 errors). Also evaluated publint for the fast path (WS1.6) and REJECTED it with data: 1554 findings, ~all noise from the vendored dist/node_modules of the standalone package — wrong tool for this package shape; check:pack-boot is the real gate. * chore(ci): surgical baseline edit — preserve unicode formatting (was json.dump ensure_ascii noise)