Repository navigation
chore(quality): rebaseline zizmorFindings 152→155 (nightly-release-green.yml drift) - #4669
diegosouzapw wants to merge 3 commits into
Conversation
…C+D) (#4622) C — scripts/quality/validate-release-green.mjs (npm run check:release-green): reproduces the release-equivalent validation (typecheck, eslint, db-rules, public-creds, full unit, vitest, ratchets, optional --with-build package-artifact) against the current working tree and classifies each red as HARD (real defect, exit 1) vs DRIFT (ratchet — reported, never affects exit / never blocks). Pure helpers exported + orchestration behind a direct-run guard; unit-tested. D — .github/workflows/nightly-release-green.yml: runs C on the active release branch nightly (and on workflow_dispatch) and opens/updates a single tracking issue on HARD failures. Never a required check, never touches a contributor PR. Closes the gap where the full gate (ci.yml) only ran on the release PR, so reds accrued silently on release/** and surfaced in 40-min layers at release time. Non-blocking by construction; drift is the maintainer's to rebaseline at release. Co-authored-by: Diego Rodrigues de Sa e Souza <diego.souza@cdwasolutions.com.br>
…reen.yml drift) O novo workflow .github/workflows/nightly-release-green.yml (#4622, Solution C+D do ciclo v3.8.34) traz 3 unpinned-uses (actions/checkout@v7, setup-node@v6, upload-artifact@v4) seguindo a convencao @vn deliberada do repo (137+ unpinned existentes, INTOCADA). Sem template-injection (todos os ${{...}} via env:), checkout com persist-credentials:false. Medido localmente com zizmor 1.25.2 = 155 e no CI run #27950299650 (job Quality Gates Extended) = 155 > baseline 152. Drift legitimo de novo workflow -> rebaseline, consistente com _scanner_harden_workflows_2026_06_16.
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Skipped this batch: superseded. The release baseline already moved past this rebaseline — |
|
Fechando: stale. O baseline |
Job vermelho que isto conserta
Quality Gates (Extended) no CI run #27950299650 —
[check-workflows] REGRESSION — 155 zizmor finding(s) > baseline 152.Causa
O ciclo v3.8.34 adicionou um único workflow novo:
.github/workflows/nightly-release-green.yml(#4622, Solution C+D). Ele traz 3 unpinned-uses:actions/checkout@v7actions/setup-node@v6actions/upload-artifact@v4Esses seguem a convenção
@vNdeliberada do repo (137+ unpinned-uses já existentes, marcadosINTOCADAna nota_scanner_harden_workflows_2026_06_16do baseline). Não há template-injection (todos os${{...}}já vão viaenv:) e o checkout usapersist-credentials: false(sem artipacked).Ação
Rebaseline
metrics.zizmorFindings.value152 → 155 + nota de justificativa. Drift legítimo de novo workflow, consistente com o precedente documentado.Verificação
zizmor 1.25.2:[check-workflows] --ratchet OK — 155, baseline 155 (no regression)(exit 0).jq empty).config/quality/quality-baseline.jsonalterado.