Skip to content

docs(board): registrar en GT-710 la decisión sobre los checks requeridos #692

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
beyondnetPeru merged 1 commit into from
Sep 6, 2026
Merged

docs(board): registrar en GT-710 la decisión sobre los checks requeridos #692

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions reference/core/control-center/gaps/gap-reference-catalog.es.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10092,7 +10092,8 @@ Los dos se arreglaron de forma estructural y no como correcciones: el rethrow no
| dato | valor |
|---|---|
| contextos requeridos en `main` y `develop` | 9 |
| ¿incluyen `Security Audit`? | **no** (tampoco `Trivy` ni `build-and-test`) |
| ¿incluyen `Security Audit`? | **no** cuando se registró; **sí desde el 2026-09-05** (10 contextos en ambas ramas, verificado) |
| ¿incluyen `Trivy Container Scan` o `build-and-test`? | **no** — decididos requeridos, pendiente de aplicar; `build-and-test` con una precondición (ver criterio 3) |
| `Security Audit` en rojo desde | `b84523b4`, 2026-09-02 |
| merges a `main` en ese intervalo | **8**, cuatro de ellos de dependencias npm |
| cómo lo presenta GitHub | `UNSTABLE`, no `BLOCKED` |
Expand All @@ -10111,5 +10112,5 @@ Los dos se arreglaron de forma estructural y no como correcciones: el rethrow no
- **Criterios de aceptación:**
- [ ] `Security Audit` figura en los contextos requeridos de `main` y de `develop`.
- [ ] **FALSABILIDAD:** un PR con un advisory ALTA sin declarar sale `BLOCKED` y no `UNSTABLE`, observado y no supuesto.
- [ ] La decisión sobre `Trivy` y `build-and-test` queda escrita — requeridos también, o registrado por qué no lo son.
- [~] La decisión sobre `Trivy` y `build-and-test` queda escrita — requeridos también, o registrado por qué no lo son. **DECIDIDO por el dueño el 2026-09-05: requeridos los dos.** Ejecutable solo la mitad, y la otra mitad no es pereza sino un deadlock medido: **`Trivy Container Scan` es seguro de requerir** porque vive en `sdk-cli-ci.yml`, que **no lleva filtro `paths`** —y su comentario explica que no debe llevarlo nunca, por el bloqueo que `CodeQL SAST` causó en el PR #218 al volverse requerido—, así que reporta en todo PR. **`build-and-test` NO puede requerirse tal como está:** vive en `sdk-cli-release.yml`, cuyo disparador `pull_request` sí filtra por `src/sdk/cli/**`, `src/packages/**`, `.github/workflows/sdk-cli-release.yml` y `.harness/**`. Un check requerido detrás de un filtro de rutas **nunca reporta** en un PR que no las toca, y GitHub lee «no reportó» como «no satisfecho»: el PR queda inmergeable para siempre con todo en verde. Es exactamente lo que le habría pasado a [#690](https://github.com/beyondnetcode/evolith_arch32/pull/690), que solo tocó `reference/`. **Precondición, no alternativa:** quitar el filtro `paths` del `pull_request` de `sdk-cli-release.yml` —el mismo arreglo que ya se aplicó a `sdk-cli-ci.yml`— y solo entonces añadirlo a los requeridos. **Nota sobre el nombre:** el check a requerir es `Trivy Container Scan`, el nombre del job; el check `Trivy` a secas que publica `aquasecurity/trivy-action` aparece en `main` pero no en la cabeza de `develop`, así que requerir ese nombre reintroduciría el mismo deadlock por otra vía.
- **Estado:** `PENDIENTE`
5 changes: 3 additions & 2 deletions reference/core/control-center/gaps/gap-reference-catalog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10185,7 +10185,8 @@ Both were fixed structurally rather than corrected: the rethrow now names BOTH f
| fact | value |
|---|---|
| required contexts on `main` and `develop` | 9 |
| do they include `Security Audit`? | **no** (nor `Trivy` nor `build-and-test`) |
| do they include `Security Audit`? | **no** when registered; **yes since 2026-09-05** (10 contexts on both branches, verified) |
| do they include `Trivy Container Scan` or `build-and-test`? | **no** — decided required, not yet applied; `build-and-test` carries a precondition (see criterion 3) |
| `Security Audit` red since | `b84523b4`, 2026-09-02 |
| merges into `main` in that window | **8**, four of them npm dependency changes |
| how GitHub renders them | `UNSTABLE`, not `BLOCKED` |
Expand All @@ -10204,5 +10205,5 @@ Both were fixed structurally rather than corrected: the rethrow now names BOTH f
- **Acceptance criteria:**
- [ ] `Security Audit` appears in the required contexts of both `main` and `develop`.
- [ ] **FALSIFIABILITY:** a PR carrying an undeclared HIGH advisory comes out `BLOCKED` rather than `UNSTABLE`, observed and not assumed.
- [ ] The decision on `Trivy` and `build-and-test` is written down — required too, or a recorded reason why not.
- [~] The decision on `Trivy` and `build-and-test` is written down — required too, or a recorded reason why not. **DECIDED by the owner 2026-09-05: both required.** Only half is executable, and the other half is not laziness but a measured deadlock: **`Trivy Container Scan` is safe to require** because it lives in `sdk-cli-ci.yml`, which carries **no `paths` filter** — and whose comment says it must never carry one, because of the block `CodeQL SAST` caused on PR #218 once it became required — so it reports on every PR. **`build-and-test` CANNOT be required as it stands:** it lives in `sdk-cli-release.yml`, whose `pull_request` trigger does filter on `src/sdk/cli/**`, `src/packages/**`, `.github/workflows/sdk-cli-release.yml` and `.harness/**`. A required check behind a path filter **never reports** on a PR that misses those paths, and GitHub reads "never reported" as "not satisfied": the PR is unmergeable forever with everything green. That is exactly what would have happened to [#690](https://github.com/beyondnetcode/evolith_arch32/pull/690), which touched only `reference/`. **A precondition, not an alternative:** drop the `paths` filter from `sdk-cli-release.yml`'s `pull_request` — the same fix already applied to `sdk-cli-ci.yml` — and only then add it to the required set. **On the name:** the check to require is `Trivy Container Scan`, the job name; the bare `Trivy` check published by `aquasecurity/trivy-action` shows on `main` but not on `develop`'s head, so requiring that name would reintroduce the same deadlock by another route.
- **Status:** `PENDING`
Loading
Loading