Skip to content

test: verify Q.A live metadata and cleanup after bootstrap #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
v-Kaefer wants to merge 37 commits into
base: main
Choose a base branch
from
Open

test: verify Q.A live metadata and cleanup after bootstrap #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
7765808
test: add structured PR Sync smoke marker
v-Kaefer Aug 11, 2026
799208a
Merge pull request #63 from v-Kaefer/test/issue-62-structured-sync-smoke
v-Kaefer Aug 11, 2026
1d4e5d0
Merge pull request #64 from v-Kaefer/develop
v-Kaefer Aug 11, 2026
61c1796
fix: reconcile existing Project v2 single-select options
v-Kaefer Aug 11, 2026
139ef80
test: cover Project v2 status option reconciliation
v-Kaefer Aug 11, 2026
10749f0
Merge pull request #67 from v-Kaefer/fix/issue-66-project-status-options
v-Kaefer Aug 11, 2026
370ea00
Merge pull request #68 from v-Kaefer/develop
v-Kaefer Aug 11, 2026
da6eee0
fix: wait for Project v2 read-after-write convergence
v-Kaefer Aug 11, 2026
cf25ed6
Merge pull request #70 from v-Kaefer/fix/issue-69-live-project-readback
v-Kaefer Aug 11, 2026
a8e8265
Merge pull request #71 from v-Kaefer/develop
v-Kaefer Aug 11, 2026
f9ab977
feat: add promotion native metadata synchronization
v-Kaefer Aug 12, 2026
ed77ace
feat: route promotion sync with project context
v-Kaefer Aug 12, 2026
b9649e9
test: cover promotion native metadata aggregation
v-Kaefer Aug 12, 2026
d9a88dd
test: add live promotion metadata smoke
v-Kaefer Aug 12, 2026
4353e04
test: add live promotion PR metadata validation
v-Kaefer Aug 12, 2026
6f3e695
docs: expand promotion sync architecture
v-Kaefer Aug 12, 2026
4615ce9
docs: document promotion metadata sync in PT-BR
v-Kaefer Aug 12, 2026
b1a4ba1
docs: document promotion native metadata sync
v-Kaefer Aug 12, 2026
7b6e8b3
docs: document promotion native metadata sync in PT-BR
v-Kaefer Aug 12, 2026
9425075
feat: auto-discover configured Project v2
v-Kaefer Aug 12, 2026
08c26a8
feat: add pull request items to Project v2
v-Kaefer Aug 12, 2026
e402a3c
feat: sync implementation PR Project membership
v-Kaefer Aug 12, 2026
1e7981f
feat: create issue-linked implementation branches
v-Kaefer Aug 12, 2026
0aab3c0
test: cover PR Project membership and discovery
v-Kaefer Aug 12, 2026
e8c18db
test: cover native Development linked branches
v-Kaefer Aug 12, 2026
2085750
test: verify Development linkage on non-default PR
v-Kaefer Aug 12, 2026
74f6077
test: add live Development linkage smoke
v-Kaefer Aug 12, 2026
90beece
test: verify implementation PR Project membership
v-Kaefer Aug 12, 2026
251ea48
test: verify implementation PR Project membership live
v-Kaefer Aug 12, 2026
a264396
docs: document Development and PR Project membership
v-Kaefer Aug 12, 2026
fcc7571
docs: documentar Development e Project do PR
v-Kaefer Aug 12, 2026
1c023bd
docs: extend governance architecture for Development and Project
v-Kaefer Aug 12, 2026
0841345
docs: ampliar arquitetura para Development e Project
v-Kaefer Aug 12, 2026
5d73602
Merge pull request #73 from v-Kaefer/feat/issue-72-promotion-native-m…
v-Kaefer Aug 12, 2026
40ed705
Merge pull request #74 from v-Kaefer/develop
v-Kaefer Aug 12, 2026
e3375bf
test: exercise Vintex GPA sandbox flow
v-Kaefer Aug 24, 2026
cb1da99
test: promote Vintex GPA sandbox to Q.A
v-Kaefer Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 28 additions & 1 deletion .github/workflows/qa-live.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ jobs:
live-sandbox:
name: qa-live-gate
runs-on: ubuntu-latest
timeout-minutes: 15
timeout-minutes: 30
environment:
name: qa
deployment: false
Expand Down Expand Up @@ -80,3 +80,30 @@ jobs:
python tests/qa/live_pr_sync.py
--repo "$QA_REPOSITORY"
--run-id "pr-${{ inputs.pr_number }}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"

- name: Run live implementation PR Project membership test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
run: >-
python tests/qa/live_implementation_project.py
--repo "$QA_REPOSITORY"
--run-id "pr-${{ inputs.pr_number }}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"

- name: Run live Promotion Sync native metadata test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
run: >-
python tests/qa/live_promotion_sync.py
--repo "$QA_REPOSITORY"
--run-id "pr-${{ inputs.pr_number }}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"

- name: Run live Development linked-branch test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
run: >-
python tests/qa/live_linked_branch.py
--repo "$QA_REPOSITORY"
--run-id "pr-${{ inputs.pr_number }}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
Comment on lines +84 to +109

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Pass inputs.pr_number through env instead of direct template expansion.

Lines 91, 100, and 109 expand ${{ inputs.pr_number }} directly into the shell command. zizmor flags this as template injection. The same pattern exists in the earlier steps, so the new steps extend the exposure. Bind the input to an environment variable, and reference the variable in the command.

🛡️ Proposed fix for one step; apply the same change to the other two 
       - name: Run live implementation PR Project membership test
         env:
           QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
           PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
+          PR_NUMBER: ${{ inputs.pr_number }}
         run: >-
           python tests/qa/live_implementation_project.py
           --repo "$QA_REPOSITORY"
-          --run-id "pr-${{ inputs.pr_number }}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          --run-id "pr-${PR_NUMBER}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Run live implementation PR Project membership test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
run: >-
python tests/qa/live_implementation_project.py
--repo "$QA_REPOSITORY"
--run-id "pr-${{ inputs.pr_number }}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
- name: Run live Promotion Sync native metadata test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
run: >-
python tests/qa/live_promotion_sync.py
--repo "$QA_REPOSITORY"
--run-id "pr-${{ inputs.pr_number }}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
- name: Run live Development linked-branch test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
run: >-
python tests/qa/live_linked_branch.py
--repo "$QA_REPOSITORY"
--run-id "pr-${{ inputs.pr_number }}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
- name: Run live implementation PR Project membership test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
PR_NUMBER: ${{ inputs.pr_number }}
run: >-
python tests/qa/live_implementation_project.py
--repo "$QA_REPOSITORY"
--run-id "pr-${PR_NUMBER}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
- name: Run live Promotion Sync native metadata test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
PR_NUMBER: ${{ inputs.pr_number }}
run: >-
python tests/qa/live_promotion_sync.py
--repo "$QA_REPOSITORY"
--run-id "pr-${PR_NUMBER}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
- name: Run live Development linked-branch test
env:
QA_REPOSITORY: ${{ vars.QA_REPOSITORY }}
PROJECT_SETUP_PAT: ${{ secrets.QA_PROJECT_SETUP_PAT }}
PR_NUMBER: ${{ inputs.pr_number }}
run: >-
python tests/qa/live_linked_branch.py
--repo "$QA_REPOSITORY"
--run-id "pr-${PR_NUMBER}-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
🧰 Tools
🪛 zizmor (1.29.0)

[error] 91-91: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 100-100: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

[error] 109-109: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/qa-live.yml around lines 84 - 109, Update all three live
QA steps—“Run live implementation PR Project membership test,” “Run live
Promotion Sync native metadata test,” and “Run live Development linked-branch
test”—to expose inputs.pr_number through the step env as a dedicated variable,
then reference that environment variable in each --run-id argument instead of
expanding the GitHub template directly in the shell command.

Source: Linters/SAST tools

Loading