Skip to content

fix(ci): clear the red checks on main (hygiene, registry, security scan, coverage) - #542

Merged
acamarata merged 1 commit into
mainfrom
dw10-plugins-main-red
Oct 29, 2026
Merged

fix(ci): clear the red checks on main (hygiene, registry, security scan, coverage)#542
acamarata merged 1 commit into
mainfrom
dw10-plugins-main-red

Conversation

@acamarata

@acamarata acamarata commented Oct 29, 2026

Copy link
Copy Markdown
Contributor

Fixes the failing checks on main (latest push run).

Check Root cause Fix
Hygiene: file-size free/job-queue/go/api/handlers.go was 425 lines, budget 356 Worker loop moved to worker.go (handlers.go now 284); stale budget row removed. No budget raised.
Registry Consistency registry.json had workflows port 3733, free/workflows/plugin.json says 3712 Projection corrected; scripts/plugin-counts.sh --check --free-only passes.
Go Build & Test, Go coverage gate free/ci/internal/exec/container_facts_test.go built a bare Executor, but E611 now requires an explicit isolation policy Use BaselineIsolator like the sibling tests. Real test bug, no check skipped.
Security Scan (gitleaks) generic-api-key on the fixture guess-0123456789 in signin_test.go (commit d7094d5, reachable from a branch ref the CI fetch scans) Allowlisted the exact anchored literal, same style as the existing counting-sequence entry. Not a real secret.

Not fixable here:

  • Hygiene attribution-guard: commit 44c3ea1 on main carries a Co-authored-by trailer. Fixing it needs a history rewrite of main. The guard scans only the push range, so it clears on the next push.
  • free/ci/internal/legacy TestSecretsEnvLiveKeyGate fails on one dev machine only because of a global gitignore for .env; it passed in CI.

@acamarata
fix(ci): clear the red checks on main (hygiene, registry, security sc…
3c0cea4 
…an, coverage)

- job-queue: move the worker loop out of api/handlers.go into worker.go; the file
  was 425 lines against a 356 budget. The budget row is dropped (file is now 284).
- registry.json: workflows port 3712, matching free/workflows/plugin.json (the
  projection was left stale by the port fix); plugin-counts --check passes.
- ci/exec: container_facts_test.go builds its Executor with BaselineIsolator, as the
  other planned-container tests do; E611 now requires an explicit isolation policy.
  This was the only failure behind Go Build & Test and the coverage gate.
- gitleaks: allowlist the exact synthetic literal guess-0123456789 (signin_test.go
  fixture in branch history that the CI fetch scans).
@acamarata
acamarata merged commit d82b3db into main Oct 29, 2026
39 of 40 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@acamarata