mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-02 05:12:11 +03:00
65f9ce7edf
* docs(ops): add quality-gate assessment + replication playbook (Fase 9 foundation)
* feat(ci): flip oasdiff breaking-change gate to blocking (ratchet)
* docs(ops): deliver main branch-protection ruleset for owner to apply
* fix(ci): run typecheck:core in PR->release fast-gates (close fast-gates hole, part 1)
* perf(mutation): enable Stryker incremental mode + cache (scales the 60/80 rollout)
* feat(ci): commit CodeQL advanced config (security-extended), replacing default-setup
* feat(ci): version semgrep SAST workflow (owasp/secrets), advisory
* feat(quality): TIA test-impact map builder (import-graph; map built at runtime, gitignored)
* feat(quality): TIA impacted-test selector with run-all fail-safe
* fix(ci): run TIA-impacted unit tests in PR->release fast-gates (build map at runtime, fail-safe full)
* feat(ci): DAST-smoke per-PR (schemathesis subset + promptfoo injection-guard, blocking)
* fix(ci): unbreak Fase 9 PR CI (MDX frontmatter, CodeQL conflict, dast-smoke advisory)
- Add MDX frontmatter to docs/ops/{BRANCH_PROTECTION_MAIN,QUALITY_GATE_PLAYBOOK}.md.
fumadocs rejects frontmatter-less docs -> 'npm run build' failed -> broke dast-smoke's
build step (the release fast-gates never runs build, so this only surfaced on the PR).
- codeql.yml: workflow_dispatch-only until the owner switches repo CodeQL Default->Advanced
(advanced configs cannot be processed while default setup is enabled; documented inline).
- dast-smoke.yml: job-level continue-on-error (advisory) so this brand-new gate matures
before it blocks (repo convention: advisory -> blocking).
* ci(quality): make TIA unit-test step advisory until release test-debt is cleared
release/v3.8.27 carries ~17 pre-existing failing unit tests (budget #3537, apiKey
#3552, several Zod schemas, Puter/Qwen executors, mimocode entry, etc.) unrelated to
this PR — the new 'run tests on PR->release' gate surfaced them. Per the repo's
advisory->blocking convention, this step enters advisory (it still runs + reports)
so pre-existing debt doesn't block the gate program. typecheck:core stays blocking.
Flip to blocking (remove continue-on-error) once the release suite is green.
57 lines
1.7 KiB
JavaScript
57 lines
1.7 KiB
JavaScript
import fs from "node:fs";
|
|
import path from "node:path";
|
|
import { execFileSync } from "node:child_process";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
|
|
const HUB_RE = /(setupPolyfill|tsconfig|package\.json|package-lock\.json|\.env|vitest\.config|stryker\.conf)/;
|
|
const TEST_RE = /\.(test|spec)\.(ts|tsx|mts)$/;
|
|
|
|
export function selectImpacted({ changed, map }) {
|
|
const out = new Set();
|
|
for (const f of changed) {
|
|
if (HUB_RE.test(f)) return ["__RUN_ALL__"];
|
|
if (TEST_RE.test(f)) {
|
|
out.add(f);
|
|
continue;
|
|
}
|
|
const isSource =
|
|
f.startsWith("src/") ||
|
|
f.startsWith("open-sse/") ||
|
|
f.startsWith("electron/") ||
|
|
f.startsWith("bin/");
|
|
if (!isSource) continue;
|
|
const hits = map.sources[f];
|
|
if (!hits) return ["__RUN_ALL__"];
|
|
hits.forEach((t) => out.add(t));
|
|
}
|
|
return [...out].sort();
|
|
}
|
|
|
|
function changedFiles() {
|
|
const baseRef = process.env.GITHUB_BASE_REF;
|
|
const baseTarget = process.env.GITHUB_BASE_SHA || (baseRef ? `origin/${baseRef}` : "HEAD~1");
|
|
const stdout = execFileSync(
|
|
"git",
|
|
["diff", "--name-only", "--diff-filter=ACMR", `${baseTarget}...HEAD`],
|
|
{ cwd: ROOT, encoding: "utf8" }
|
|
);
|
|
return stdout
|
|
.split("\n")
|
|
.map((s) => s.trim())
|
|
.filter(Boolean);
|
|
}
|
|
|
|
if (import.meta.url === `file://${process.argv[1]}`) {
|
|
const mapPath = path.join(ROOT, "config/quality/test-impact-map.json");
|
|
let map;
|
|
try {
|
|
map = JSON.parse(fs.readFileSync(mapPath, "utf8"));
|
|
} catch {
|
|
console.log("__RUN_ALL__");
|
|
process.exit(0);
|
|
}
|
|
const sel = selectImpacted({ changed: changedFiles(), map });
|
|
process.stdout.write(sel.join("\n") + "\n");
|
|
}
|