mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-02 05:12:11 +03:00
28d57bf5f8
FIX 1 — security scanner install (gitleaks/osv/actionlint/zizmor): the step ran under bash -e and aborted before the $GITHUB_PATH export when 'go install ...gitleaks/v8@latest' failed/produced a non-working binary, so no scanner landed on PATH and every check self-skipped. Rewritten to set +e, install from official release downloads, ALWAYS export $HOME/.local/bin, and print diagnostics. Validated only on the next CI run (binaries install in CI). FIX 2 — size-limit bundleSize: add @size-limit/file devDependency (the correct preset for the plain FILE-size .size-limit.json) + allowlist entry. check:bundle-size now measures the 4 bin entries via the preset (bundleSize=5601) instead of erroring on the missing preset / falling back to fs.statSync. FIX 3 — codeqlAlerts promoted to BLOCKING: check-codeql-ratchet.mjs now reads metrics.codeqlAlerts.value, exits 1 ONLY on a real regression (measured > baseline), and exits 0 (graceful skip) on any measurement failure (gh absent / no auth / no repo / API error) so missing infra never blocks. Baseline seeded codeqlAlerts=0 (repo has 0 open alerts). Blocking step wired in the quality-gate job with security-events:read; the duplicate advisory step removed from quality-extended. New TDD: evaluateCodeqlRatchet (5 cases).
127 lines
2.5 KiB
JSON
127 lines
2.5 KiB
JSON
{
|
|
"_comment": "Allowlist anti-slopsquatting (check-deps.mjs). Toda dep nova exige adicao EXPLICITA aqui apos verificar que e legitima.",
|
|
"allowed": [
|
|
"@aws-sdk/client-bedrock-runtime",
|
|
"@cyclonedx/cyclonedx-npm",
|
|
"@dnd-kit/core",
|
|
"@dnd-kit/sortable",
|
|
"@dnd-kit/utilities",
|
|
"@huggingface/transformers",
|
|
"@lobehub/icons",
|
|
"@modelcontextprotocol/sdk",
|
|
"@monaco-editor/react",
|
|
"@ngrok/ngrok",
|
|
"@opencode-ai/plugin",
|
|
"@playwright/test",
|
|
"@size-limit/file",
|
|
"@stryker-mutator/core",
|
|
"@stryker-mutator/tap-runner",
|
|
"@swc/helpers",
|
|
"@tailwindcss/postcss",
|
|
"@testing-library/jest-dom",
|
|
"@testing-library/react",
|
|
"@types/bcryptjs",
|
|
"@types/better-sqlite3",
|
|
"@types/bun",
|
|
"@types/keytar",
|
|
"@types/mdx",
|
|
"@types/node",
|
|
"@types/react",
|
|
"@types/react-dom",
|
|
"@types/ws",
|
|
"@vitejs/plugin-react",
|
|
"@xyflow/react",
|
|
"axios",
|
|
"bcryptjs",
|
|
"better-sqlite3",
|
|
"bottleneck",
|
|
"c8",
|
|
"commander",
|
|
"concurrently",
|
|
"cross-env",
|
|
"csv-stringify",
|
|
"dpdm",
|
|
"electron",
|
|
"electron-builder",
|
|
"electron-updater",
|
|
"eslint",
|
|
"eslint-config-next",
|
|
"eslint-plugin-sonarjs",
|
|
"express",
|
|
"fast-check",
|
|
"fetch-socks",
|
|
"fflate",
|
|
"fumadocs-core",
|
|
"fumadocs-mdx",
|
|
"fumadocs-ui",
|
|
"glob",
|
|
"gray-matter",
|
|
"http-proxy-middleware",
|
|
"https-proxy-agent",
|
|
"husky",
|
|
"ink",
|
|
"ink-spinner",
|
|
"ink-text-input",
|
|
"ioredis",
|
|
"jose",
|
|
"js-yaml",
|
|
"jscpd",
|
|
"jsdom",
|
|
"jsonc-parser",
|
|
"keytar",
|
|
"knip",
|
|
"license-checker-rseidelsohn",
|
|
"lint-staged",
|
|
"lockfile-lint",
|
|
"lowdb",
|
|
"lucide-react",
|
|
"marked",
|
|
"marked-terminal",
|
|
"material-symbols",
|
|
"mermaid",
|
|
"monaco-editor",
|
|
"next",
|
|
"next-intl",
|
|
"next-themes",
|
|
"node-loader",
|
|
"node-machine-id",
|
|
"open",
|
|
"ora",
|
|
"parse5",
|
|
"pino",
|
|
"pino-abstract-transport",
|
|
"pino-pretty",
|
|
"playwright",
|
|
"prettier",
|
|
"react",
|
|
"react-dom",
|
|
"react-is",
|
|
"react-markdown",
|
|
"react-reconciler",
|
|
"recharts",
|
|
"selfsigned",
|
|
"size-limit",
|
|
"sql.js",
|
|
"sqlite-vec",
|
|
"tailwindcss",
|
|
"tls-client-node",
|
|
"tsup",
|
|
"tsx",
|
|
"type-coverage",
|
|
"typescript",
|
|
"typescript-eslint",
|
|
"undici",
|
|
"update-notifier",
|
|
"uuid",
|
|
"vitest",
|
|
"wait-on",
|
|
"wreq-js",
|
|
"ws",
|
|
"wtfnode",
|
|
"xxhash-wasm",
|
|
"yazl",
|
|
"zod",
|
|
"zustand"
|
|
]
|
|
}
|