Repository navigation
feat(radar): stable catalog export workflow with provenance - #10826
Merged
Merged
Conversation
Passo 10 of the Radar go-live: publish the OmniRoute catalog export the Radar
server consumes to a stable URL, so the 1 GB-RAM private server pulls it via
RADAR_EXPORT_URL instead of depending on the deploy-time snapshot.
- scripts/release/radar-export.mjs: emits {geradoEm, budgets, totais, registry,
provenance} from the catalog config modules. Provenance (sourceCommit,
sourceRef, runUrl, generatedBy) is never fabricated — unknown fields stay null.
- .github/workflows/radar-export.yml: on main catalog changes / manual dispatch /
weekly, generates the export and clobbers the stable 'radar-export-latest'
release asset (gh release, GH_TOKEN — checkout persist-credentials:false).
- tests/unit/radar-export.test.mjs: consumer contract (budgets[] non-empty) +
provenance null-when-unknown + GitHub-env reflection.
Stable URL for RADAR_EXPORT_URL:
https://github.com/diegosouzapw/OmniRoute/releases/download/radar-export-latest/export-omniroute.json
Re-baselines zizmorFindings 190->192 (+2 unpinned-uses @vn, the repo-wide
deliberate convention; artipacked auto-fixed).
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…inference#10826) Passo 10 of the Radar go-live: publish the OmniRoute catalog export the Radar server consumes to a stable URL, so the 1 GB-RAM private server pulls it via RADAR_EXPORT_URL instead of depending on the deploy-time snapshot. - scripts/release/radar-export.mjs: emits {geradoEm, budgets, totais, registry, provenance} from the catalog config modules. Provenance (sourceCommit, sourceRef, runUrl, generatedBy) is never fabricated — unknown fields stay null. - .github/workflows/radar-export.yml: on main catalog changes / manual dispatch / weekly, generates the export and clobbers the stable 'radar-export-latest' release asset (gh release, GH_TOKEN — checkout persist-credentials:false). - tests/unit/radar-export.test.mjs: consumer contract (budgets[] non-empty) + provenance null-when-unknown + GitHub-env reflection. Stable URL for RADAR_EXPORT_URL: https://github.com/diegosouzapw/OmniRoute/releases/download/radar-export-latest/export-omniroute.json Re-baselines zizmorFindings 190->192 (+2 unpinned-uses @vn, the repo-wide deliberate convention; artipacked auto-fixed). Co-authored-by: Xiangzhe <bakryun0718@proton.me>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexto
Passo 10 do go-live do Radar ("export estável + proveniência"). Hoje o servidor privado do Radar (1 GB RAM na Akamai, nunca clona/builda o OmniRoute) depende do snapshot do export gravado no deploy, vindo da máquina do operador. Este PR publica o export numa URL estável para o servidor baixar via
RADAR_EXPORT_URL.Mudança
scripts/release/radar-export.mjs— gera{geradoEm, budgets, totais, registry, provenance}a partir dos módulos de catálogo (open-sse/config/freeModelCatalog*.ts,providerRegistry.ts). Proveniência (sourceCommit,sourceRef,runUrl,generatedBy) nunca é inventada — desconhecido permanecenull(D16). Contrato do consumidor (src/feed/exportSource.tsdo radar-server) preservado:budgets[]não-vazio; chaves extras ignoradas..github/workflows/radar-export.yml— em mudança do catálogo nomain/ dispatch manual / semanal, gera e clobra o asset estávelradar-export-latest(viagh release,GH_TOKEN; checkout compersist-credentials: false).tests/unit/radar-export.test.mjs— contrato do consumidor + proveniência null-quando-desconhecido + reflexo do ambiente GitHub Actions. 3/3 verde.URL estável (definir em
RADAR_EXPORT_URLno.envdo radar-server)Gates locais
check:test-discoveryOK ·check:workflows --ratchetOK (zizmorFindings re-baseline 190→192, +2 unpinned-uses @vn — convenção deliberada do repo; artipacked corrigido compersist-credentials: false).src//open-sse/bin.