From d7182e23549b4a221298508f252f84f5538f4af6 Mon Sep 17 00:00:00 2001 From: aarroyo Date: Sat, 25 Jul 2026 19:30:20 -0500 Subject: [PATCH] ci: arreglar pipelines Hotfix y Security (bugs de config, no hallazgos) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hotfix (hotfix.yml): - Se disparaba en cada push a `main` y el job "Validate hotfix branch name" hacía exit 1 (main no es `hotfix/**`), tumbando toda la pipeline. Se quita `main` del trigger: la pipeline Hotfix solo corre en ramas `hotfix/**` (+ dispatch). El build/test/security de main ya lo cubren ci.yml/build.yml/security.yml. Security (security.yml): - Hardcoded Secrets: `goreleaser/gitleaks-action` ya no existe (fallo de resolución → job caído). Se apunta a `gitleaks/gitleaks-action@v2` (best-effort, con continue-on-error); el gate real es el grep custom, que no matchea nada. - Dependency Review: `dependency-review-action` requiere base/head ref → solo funciona en pull_request. Se limita a `if: github.event_name == 'pull_request'` (en push a main queda skipped, no failure). - CodeQL (.NET Backend): el autobuild de C# fallaba (requiere SDK .NET 10 + restore de shells NuGet). Se usa `build-mode: none` (extracción buildless), suficiente para el gate. El Security Gate solo bloquea con result==failure, no con skipped. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/hotfix.yml | 1 - .github/workflows/security.yml | 10 +++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/hotfix.yml b/.github/workflows/hotfix.yml index f8a52201..b14be956 100644 --- a/.github/workflows/hotfix.yml +++ b/.github/workflows/hotfix.yml @@ -4,7 +4,6 @@ on: push: branches: - 'hotfix/**' - - 'main' # When main receives hotfix merge workflow_dispatch: concurrency: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 66e02cd4..ca6cdfe6 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -41,7 +41,9 @@ jobs: fetch-depth: 0 - name: Run GitLeaks - uses: goreleaser/gitleaks-action@v2 + # La action se movió a gitleaks/gitleaks-action (goreleaser/* ya no existe → fallo de + # resolución que tumbaba el job). Best-effort: el gate real es el grep custom de abajo. + uses: gitleaks/gitleaks-action@v2 with: config_path: .github/secrets-config.toml continue-on-error: true @@ -73,6 +75,9 @@ jobs: dependency-review: name: Dependency Vulnerability Review runs-on: ubuntu-latest + # dependency-review-action necesita base/head ref: solo funciona en pull_request + # (en push a main no hay diff que revisar y falla). Se limita a PRs. + if: github.event_name == 'pull_request' steps: - name: Checkout uses: actions/checkout@v4 @@ -101,6 +106,9 @@ jobs: uses: github/codeql-action/init@v3 with: languages: 'csharp' + # Análisis sin compilar: el autobuild de C# fallaba (requiere SDK .NET 10 + restore de + # los shells NuGet). `build-mode: none` hace extracción buildless, suficiente para el gate. + build-mode: none queries: security-and-quality - name: Perform Analysis