chore(deps): batch update packages March 2026#164
Merged
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAtualização centralizada de dependências (diversos pacotes Microsoft, EF Core, Npgsql, Swashbuckle, WireMock, Testcontainers, OpenTelemetry) e ajustes em workflows: pin de ação de comentário em PR, atualização do Swashbuckle CLI e adição de job de compatibilidade (Npgsql 10 + Hangfire) no CI. Changes
Sequence Diagram(s)sequenceDiagram
participant CI as CI Runner
participant Gate as Compatibility Gate Job
participant PG as PostgreSQL/PostGIS
participant DotNet as .NET 10 Runner
participant Hangfire as Hangfire Test Suite
CI->>Gate: inicia `compatibility-gate`
Gate->>PG: provisiona serviço PostgreSQL/PostGIS
Gate->>DotNet: configura .NET 10 / restore/build
DotNet->>PG: aplica migrations / prepara DB (meajudaai_compat)
DotNet->>Hangfire: executa suíte de compatibilidade
Hangfire->>PG: operações read/write (jobs, locks)
Hangfire-->>Gate: retorna resultados
Gate-->>CI: publica artefatos/test-results
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/pr-validation.yml:
- Line 1099: Replace the incorrect action reference
"marocchino/sticky-pull-request-comment@v3" with the latest stable v2 release
and pin to its immutable commit SHA; specifically update the uses declaration to
"marocchino/sticky-pull-request-comment@v2.9.4" (or the newest v2 tag) and then
replace the tag with the corresponding commit SHA for that tag to ensure
immutability and reduce supply-chain risk.
In `@Directory.Packages.props`:
- Around line 115-116: Os pacotes PackageVersion
Include="Swashbuckle.AspNetCore" e Include="Swashbuckle.AspNetCore.Annotations"
estão em 10.1.5, mas o passo do workflow que instala o CLI do Swashbuckle usa
10.1.4; abra o arquivo do workflow que contém a etapa de instalação do
Swashbuckle CLI (a etapa que referencia o CLI do Swashbuckle/OpenAPI) e atualize
a versão do CLI para 10.1.5 para alinhar com os PackageVersion, garantindo que a
ferramenta de geração OpenAPI use a mesma versão dos pacotes do projeto.
- Line 63: A versão Npgsql está definida como 10.0.2 while Hangfire.PostgreSql
is built against Npgsql 6.x; add an automated pipeline gate to validate
compatibility before deployments by implementing a CI job that runs in the
staging pipeline (referencing the existing workflows
monitor-package-compatibility.yml and package-watch-notifications.yml) which:
restores packages using Directory.Packages.props (the PackageVersion
Include="Npgsql" entry), deploys the staging build, runs HangfireHealthCheck
plus targeted Hangfire/Postgres integration tests (and fails the job on any
incompatibility or exception from Hangfire/PostgreSql 1.21.1), and blocks
promotion if the job fails; alternatively, if immediate compatibility is
confirmed, update Directory.Packages.props to a pinned compatible Npgsql version
and document the change near the TODO (Issue `#39`).
- Line 154: O bump para WireMock.Net 2.0.0 expõe
WireMockServerSettings.DefaultJsonSerializer (IJsonConverter) e o código em
WireMockFixture.cs que instancia WireMockServerSettings não o configura, ficando
no padrão (Newtonsoft); atualize a criação em WireMockFixture (onde new
WireMockServerSettings é chamado) para atribuir DefaultJsonSerializer
explicitamente ao conversor desejado (por exemplo um NewtonsoftJsonConverter ou
SystemTextJsonConverter conforme o comportamento esperado dos mocks) e reexecute
os testes de integração para validar que a serialização das respostas mockadas
permanece correta.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ee4e361b-6865-48a3-9279-b4309a6d0dd8
⛔ Files ignored due to path filters (41)
src/Aspire/MeAjudaAi.AppHost/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Aspire/MeAjudaAi.ServiceDefaults/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Bootstrapper/MeAjudaAi.ApiService/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Documents/API/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Documents/Application/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Documents/Domain/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Documents/Infrastructure/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Documents/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Locations/API/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Locations/Application/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Locations/Domain/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Locations/Infrastructure/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Locations/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Providers/API/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Providers/Application/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Providers/Domain/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Providers/Infrastructure/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Providers/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/SearchProviders/API/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/SearchProviders/Application/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/SearchProviders/Domain/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/SearchProviders/Infrastructure/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/SearchProviders/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/ServiceCatalogs/API/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/ServiceCatalogs/Application/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/ServiceCatalogs/Domain/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/ServiceCatalogs/Infrastructure/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/ServiceCatalogs/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Users/API/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Users/Application/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Users/Domain/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Users/Infrastructure/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Modules/Users/Tests/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Shared/packages.lock.jsonis excluded by!**/packages.lock.jsonsrc/Web/MeAjudaAi.Web.Admin/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.ApiService.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.Architecture.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.E2E.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.Integration.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.Shared.Tests/packages.lock.jsonis excluded by!**/packages.lock.jsontests/MeAjudaAi.Web.Admin.Tests/packages.lock.jsonis excluded by!**/packages.lock.json
📒 Files selected for processing (2)
.github/workflows/pr-validation.ymlDirectory.Packages.props
…, and configure GitHub Actions CI/CD workflows.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/master-ci-cd.yml:
- Around line 258-260: The compatibility-gate workflow mixes a configurable DB
user (env var POSTGRES_USER) with a hardcoded connection string part
"Username=postgres"; update the connection string construction (where
"Username=postgres" is used) to interpolate/read the POSTGRES_USER (and
POSTGRES_PASSWORD/POSTGRES_DB as appropriate) so the service uses the same
secret-backed POSTGRES_USER/POSTGRES_PASSWORD values defined earlier instead of
the hardcoded "postgres".
- Around line 249-253: A inserção do job compatibility-gate deslocou os passos
de geração de cobertura para um runner sem os artefatos de teste do job
build-and-test, fazendo com que os TestResults não estejam disponíveis; corrija
movendo os passos de cobertura de volta para o job build-and-test (revertendo a
seção de passos de cobertura para dentro do job build-and-test) ou, se quiser
manter coverage fora, publique os artefatos de teste em build-and-test (ex.:
upload-artifact) e recupere-os em compatibility-gate (download-artifact) antes
dos passos que processam TestResults/coverage.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 13c38c9e-7860-4776-bc14-e61eb19c5514
⛔ Files ignored due to path filters (1)
src/Web/MeAjudaAi.Web.Admin/packages.lock.jsonis excluded by!**/packages.lock.json
📒 Files selected for processing (6)
.github/workflows/master-ci-cd.yml.github/workflows/pr-validation.yml.github/workflows/update-api-docs.ymltests/MeAjudaAi.Integration.Tests/Database/DbContextConcurrencyTests.cstests/MeAjudaAi.Integration.Tests/Modules/Users/UserRepositoryIntegrationTests.cstests/MeAjudaAi.Integration.Tests/Modules/Users/UsersIntegrationTests.cs
…eparing the application for deployment.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/master-ci-cd.yml (1)
319-321: Reutilizesetup-postgres-connectiontambém aqui.Na Line 321, a connection string foi remontada manualmente mesmo já existindo uma action local para isso no
build-and-test. Centralizar também nocompatibility-gateevita drift entre jobs e reduz o risco de escaping incorreto de credenciais.Patch sugerido
+ - name: Setup PostgreSQL connection + id: db + uses: ./.github/actions/setup-postgres-connection + with: + postgres-host: localhost + postgres-port: 5432 + postgres-db: meajudaai_compat + postgres-user: ${{ secrets.POSTGRES_USER || 'postgres' }} + postgres-password: ${{ secrets.POSTGRES_PASSWORD || 'test123' }} + - name: 🧪 Run Hangfire Compatibility Tests env: ASPNETCORE_ENVIRONMENT: Testing - ConnectionStrings__DefaultConnection: "Host=localhost;Database=meajudaai_compat;Username=${{ secrets.POSTGRES_USER || 'postgres' }};Password=${{ secrets.POSTGRES_PASSWORD || 'test123' }}" + ConnectionStrings__DefaultConnection: ${{ steps.db.outputs.connection-string }} run: |🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/master-ci-cd.yml around lines 319 - 321, No job should rebuild the Postgres connection string manually in compatibility-gate; reuse the existing setup-postgres-connection step used in build-and-test instead. Replace the manual env entry that sets ConnectionStrings__DefaultConnection with invoking the same setup-postgres-connection action/step (the one used by the build-and-test job) and consume its output or exported env var in compatibility-gate (remove the hardcoded ConnectionStrings__DefaultConnection string), ensuring the action provides the connection string in the same variable name expected by the job.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/master-ci-cd.yml:
- Around line 318-328: The CI job uses --filter "FullyQualifiedName~Hangfire"
against MeAjudaAi.Integration.Tests which finds no Hangfire tests (actual
Hangfire tests live in MeAjudaAi.Shared.Tests and they use
UseInMemoryStorage()), so the gate never validates the PostgreSQL-backed
Hangfire + Npgsql 10 scenario referenced in Directory.Packages.props (Issue
`#39`). Fix by either removing the misleading filter or adding a proper Hangfire
PostgreSQL validation: update the workflow step (job name "Run Hangfire
Compatibility Tests") to run the correct test project (MeAjudaAi.Shared.Tests)
or add a new job that starts a PostgreSQL instance and runs tests that configure
Hangfire with UsePostgreSqlStorage(), passing the
ConnectionStrings__DefaultConnection env var; ensure the tests invoked actually
exercise UsePostgreSqlStorage() rather than UseInMemoryStorage().
---
Nitpick comments:
In @.github/workflows/master-ci-cd.yml:
- Around line 319-321: No job should rebuild the Postgres connection string
manually in compatibility-gate; reuse the existing setup-postgres-connection
step used in build-and-test instead. Replace the manual env entry that sets
ConnectionStrings__DefaultConnection with invoking the same
setup-postgres-connection action/step (the one used by the build-and-test job)
and consume its output or exported env var in compatibility-gate (remove the
hardcoded ConnectionStrings__DefaultConnection string), ensuring the action
provides the connection string in the same variable name expected by the job.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ba9390ca-3785-48d0-adab-f3346fea789e
📒 Files selected for processing (1)
.github/workflows/master-ci-cd.yml
added 3 commits
March 13, 2026 11:45
…Hangfire PostgreSQL integration tests.
…ity with Npgsql 10.x.
…t, frontend component, and integration tests.
Contributor
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/master-ci-cd.yml (1)
300-308:⚠️ Potential issue | 🟠 MajorHealth check ausente no serviço PostgreSQL pode causar testes flaky.
O serviço PostgreSQL no job
build-and-test(linhas 42-46) inclui health checks para garantir que o container esteja pronto antes dos testes. Este job não possui essas opções, o que pode resultar em falhas intermitentes se o teste iniciar antes do PostgreSQL estar disponível.🔧 Correção sugerida
services: postgres: image: postgis/postgis:16-3.4 env: POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD || 'test123' }} POSTGRES_USER: ${{ secrets.POSTGRES_USER || 'postgres' }} POSTGRES_DB: meajudaai_compat + options: >- + --health-cmd pg_isready + --health-interval 10s + --health-timeout 5s + --health-retries 5 ports: - 5432:5432🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/master-ci-cd.yml around lines 300 - 308, Adicione um healthcheck ao serviço "postgres" no job build-and-test para garantir que o container só seja considerado saudável quando o PostgreSQL estiver pronto; especificamente, sob a definição do serviço "postgres" inclua a chave healthcheck com um teste que use "pg_isready" (com o mesmo usuário usado em POSTGRES_USER), e configure interval, timeout, retries e start_period razoáveis (por exemplo 5–10s intervals e múltiplas tentativas) para evitar que os testes iniciem antes do banco estar disponível.
🧹 Nitpick comments (1)
.github/workflows/master-ci-cd.yml (1)
318-324: Output da actionsetup-postgres-connectionnão é utilizado.O step configura
id: pg-connmassteps.pg-conn.outputs.connection-stringnunca é referenciado — o teste usa diretamente as variáveisMEAJUDAAI_DB_*. Considere remover este step ou usar seu output para consistência com o jobbuild-and-test.Opção 1: Remover step redundante
- - name: 🗄️ Setup PostgreSQL Connection - id: pg-conn - uses: ./.github/actions/setup-postgres-connection - with: - postgres-db: meajudaai_compat - postgres-user: ${{ secrets.POSTGRES_USER || 'postgres' }} - postgres-password: ${{ secrets.POSTGRES_PASSWORD || 'test123' }} - - name: 🧪 Run Hangfire Compatibility TestsOpção 2: Usar output para ConnectionStrings (recomendado para consistência)
- name: 🧪 Run Hangfire Compatibility Tests env: ASPNETCORE_ENVIRONMENT: Testing + ConnectionStrings__postgresdb: ${{ steps.pg-conn.outputs.connection-string }} MEAJUDAAI_DB_HOST: localhost🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/master-ci-cd.yml around lines 318 - 324, The step with id "pg-conn" sets up PostgreSQL but its output (steps.pg-conn.outputs.connection-string) is never used; either remove this redundant step or (preferred) consume its output to populate the environment variables used by the tests (replace direct use of MEAJUDAAI_DB_* secrets with the connection string from steps.pg-conn.outputs.connection-string or map that output into MEAJUDAAI_DB_HOST/PORT/USER/PASSWORD/DB env entries for the subsequent "build-and-test" job and test steps); update references in the job "build-and-test" to use the pg-conn output so the action's output is actually used and the workflow remains consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.github/workflows/master-ci-cd.yml:
- Around line 300-308: Adicione um healthcheck ao serviço "postgres" no job
build-and-test para garantir que o container só seja considerado saudável quando
o PostgreSQL estiver pronto; especificamente, sob a definição do serviço
"postgres" inclua a chave healthcheck com um teste que use "pg_isready" (com o
mesmo usuário usado em POSTGRES_USER), e configure interval, timeout, retries e
start_period razoáveis (por exemplo 5–10s intervals e múltiplas tentativas) para
evitar que os testes iniciem antes do banco estar disponível.
---
Nitpick comments:
In @.github/workflows/master-ci-cd.yml:
- Around line 318-324: The step with id "pg-conn" sets up PostgreSQL but its
output (steps.pg-conn.outputs.connection-string) is never used; either remove
this redundant step or (preferred) consume its output to populate the
environment variables used by the tests (replace direct use of MEAJUDAAI_DB_*
secrets with the connection string from steps.pg-conn.outputs.connection-string
or map that output into MEAJUDAAI_DB_HOST/PORT/USER/PASSWORD/DB env entries for
the subsequent "build-and-test" job and test steps); update references in the
job "build-and-test" to use the pg-conn output so the action's output is
actually used and the workflow remains consistent.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 287ee685-4170-4ac9-a6f1-e3d166847a4f
📒 Files selected for processing (2)
.github/workflows/master-ci-cd.ymltests/MeAjudaAi.Integration.Tests/Infrastructure/Jobs/HangfirePostgreSqlTests.cs
📊 Code Coverage ReportCoverage: 90.30% (extracted from Cobertura (Aggregated Direct)) 📈 Coverage Details
📋 Coverage Analysis
🎯 Quality Gates
📁 Artifacts
This comment is updated automatically on each push to track coverage trends. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batch update of NuGet packages and GitHub Actions based on Dependabot recommendations.
Key changes:
Summary by CodeRabbit