Repository navigation
release: promocionar develop a main (3bd180ef) - #726
Merged
Merged
Conversation
sync: traer a develop los tres bumps de dependabot que entraron por main
sync: traer a develop el revert de @hono/node-server 2.x (#716)
La portada vendía a Evolith solo como linter de arquitectura y callaba el segundo diferenciador: las reglas van atadas a la fase SDLC del producto, `gate evaluate` mide los controles de la fase y `phase advance` bloquea la transición hasta que se cumplen, con las ADRs en el mismo ciclo. Un párrafo nuevo en EN/ES, sin cifras y sin afirmar firma criptográfica (la evidencia es legible por máquina, no firmada). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…, ReDoS y permisos de workflows CodeQL (main, 75 resultados) y Scorecard, triados a mano con el SARIF: se arregla lo que un llamador autenticado podía explotar y se descarta lo que no lo es. CWE-78 · inyección de shell (11 alertas) - `NxWorkspaceStrategy` interpolaba `apiName`, `hostName`, `remotes` y `domains` (entrada del tool MCP `evolith-scaffold`, sin validar) en una línea de shell. Ahora construye argv y lo ejecuta sin shell (`executeFileOrThrow`), y además exige que cada nombre sea un identificador plano: `--directory=apps/../..` y `--name=--flag` se rechazan antes de spawnear nada. - `ICommandExecutor` gana `executeFile`/`executeFileOrThrow`; el ejecutor del CLI ya lo tenía y el del MCP lo implementa con `execFile`. Se elimina el bloque duplicado de la interfaz (TS los fusionaba en silencio). - `git-log-reader` pasa `--since`/`--max-count` como argv. CWE-22 · path injection en core-api (9 alertas en el adaptador de fs) - `POST /evaluate` legacy leía `body.satellitePath`/`body.corePath` tal cual (el DTO decía "path traversal validation required" y nadie la hacía): el resolver los contiene bajo WORKSPACE_ROOT / CORE_PATH, y una instancia sin resolver falla cerrada. - `POST /architecture/validate-satellite`: el manifest manda en el caso de uso y traía sus propias rutas; se fijan a las resueltas. - `POST /projects/initialize`: `name` es un segmento de directorio, no una ruta (DTO + caso de uso, que también sirve al CLI). CWE-1321 · prototype pollution: `evolith-config-set` rechaza `__proto__`, `constructor` y `prototype` como segmentos y solo desciende por propiedades propias. ReDoS (8) · `/\/+$/` tardaba 15 s en 200k barras; se sustituye por el trim char a char que `codeowners.ts` ya usaba. `parseRepoUrl` queda anclado al host. El check de URL de `satellite adopt` se ancla al inicio. Scorecard Token-Permissions (7 workflows): `contents: read` arriba y la escritura declarada en el job que la hace (packages en docker, contents en docs-release y upload-assets, pull-requests:read para el guard 50). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ged out on 2026-09-17 Las cuatro evidencias de `maturity-evidence.json` se tomaron el 2026-08-18 y cruzaron la ventana de 30 días de `09-reconcile-maturity.mjs` el 2026-09-17, poniendo en rojo `Validate documentation` (requerido) en cualquier PR desde entonces; el primero en tropezar fue #724, un cambio solo de README. Se re-toman las cuatro contra runs reales, no se estira la fecha: - cli-baseline / coverage / documentation: cabeza de develop 4d65574, runs 34998373252 (13 jobs verdes; 107 suites, 1492 tests, branches 75,73 % sobre el umbral del 75 %) y 34998373244. - release: cabeza de main 99b5325, run 35435224976 (binarios y smoke-tests en las tres plataformas). `asOf` y la fecha del tablero no se mueven; la reconciliación se regenera con el propio script y pasa en `--check`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ad aged out again `09-reconcile-maturity.mjs` accepts evidence 0..30 days old; the 2026-08-18 entries hit 32 on 2026-09-19 and turned `Validate documentation` (a REQUIRED check) red on every pull request opened today (#722-#725) and on the main push 99b5325 — none of which touched what the evidence describes. Same failure mode as 3e5aac8, one month later. Fresh observations of the same four claims, not date bumps: - cli-baseline: run 35435871033 on cb2c8a1 (this PR), all THIRTEEN CLI CI jobs green. - coverage: same run — 107 suites / 1492 tests, Branches 75.69% (2382/3147) against the unchanged 75% threshold. - documentation: the latest green Documentation Validation is 34998373244 on the develop head 4d65574 (2026-09-15); every run today is red for exactly this staleness. - release: run 35435871089 on cb2c8a1 — binaries packaged and smoke-tested on the three platforms; publish/upload skipped by design on a pull request. The commits are ones a pull-request checkout can resolve (`git cat-file`): main's head 99b5325 is NOT reachable from develop yet, so citing it would have failed the guard with "references an unavailable commit". `asOf` stays 2026-09-05 with the board, so the reconciliation is regenerated but nothing downstream of the board date moves. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs(readme): resaltar el control del flujo SDLC en el posicionamiento
Conflict on the two maturity evidence files: another session refreshed the same four aged-out checks in 2ee3f9a (via #724) minutes before 93a90f9 did. develop's refresh wins outright — one observation per aging, not two — so this branch now carries no evidence change of its own; 09-reconcile-maturity --check and guard 46 pass on the result. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…triage-2026-09-19 fix(security): cerrar lo importante del tab Security — CWE-78/22/1321, ReDoS y permisos de workflows
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Contributor
📊 Bilingual Coverage ImpactPR Changes
Repository Coverage
✅ Good: All EN changes have ES counterparts. Generated by GitHub Actions |
main moved under the promotion: #723 (uuid pruned from mcp-server, @nestjs/* majors ignored in dependabot.yml) landed on main directly and carried a THIRD refresh of the same aged-out maturity evidence (20706cd). Conflict on the two evidence files only; develop's refresh (2ee3f9a, already on this branch) is kept — every commit it cites is reachable once main is merged in — and 09-reconcile-maturity --check plus guard 46 pass on the result. #723's own changes come through untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promoción
develop→main, fijada a3bd180efpara que lo que se revisa sea lo que se mergea. Sigue a #714.Qué sube
Seguridad (Security tab) — #725
NxWorkspaceStrategy(tool MCPevolith-scaffold) ejecuta sin shell (executeFileOrThrow, nuevo en el puertoICommandExecutor) y valida cada nombre;git-log-readerpor argv.POST /evaluatelegacy contienesatellitePath/corePathbajoWORKSPACE_ROOT/CORE_PATH; el manifest devalidate-satellitese fija a las rutas resueltas;projects/initialize.namevalidado como segmento.evolith-config-set; 8 ReDoS (15 s → 0 ms en 200k barras); anchor ensatellite adopt.contents: readarriba en 7 workflows, escritura declarada por job.mainse cierran las 37 alertas que quedan abiertas (las otras 58 ya están descartadas con motivo).Docs y evidencia — #724
Validate documentationen rojo en todos los PR de hoy).Nota
mainlleva #719 (bump de@opentelemetry/exporter-trace-otlp-http) quedevelopno tiene: esta promoción lo conserva (merge, no reset); el back-mergemain→developva en PR aparte.🤖 Generated with Claude Code