From 7c5a5ca34019ef2423e45f1dfd402c95cf6a90f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Gregorio=20J=20Jim=C3=A9nez=20Bodes?= <202805065+Traky12@users.noreply.github.com> Date: Fri, 4 Sep 2026 13:52:28 +0200 Subject: [PATCH 1/2] fix(ci): repair Agent Sync Hardening, Thingsdata, and Visual Summary workflows - metrics-sync.sh: exclude untracked files from git status when computing castuo_agent_drift_detection. The workflow's own 'metrics-sync.sh > metrics.prom' redirect created an untracked file in the repo root before the script body ran, making drift always report 1 and fail the Sabionda gate every run. - thingsdata-integration.yml: replace the mosquitto healthcheck (mosquitto_sub -C 1, which waits for a message nobody publishes and always times out) with mosquitto_pub, which only validates the broker accepts connections. - generate-visual-summary.yml: stop pushing directly to protected main (rejected with GH013 - PR required / signed commits required); open a PR from a dedicated branch instead. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/generate-visual-summary.yml | 14 ++++++++++++-- .github/workflows/thingsdata-integration.yml | 7 ++++++- scripts/metrics-sync.sh | 6 +++++- 3 files changed, 23 insertions(+), 4 deletions(-) diff --git a/.github/workflows/generate-visual-summary.yml b/.github/workflows/generate-visual-summary.yml index e5c519d1..fefafa47 100644 --- a/.github/workflows/generate-visual-summary.yml +++ b/.github/workflows/generate-visual-summary.yml @@ -33,17 +33,27 @@ jobs: - name: Generate visual PDF summary run: ./scripts/generate-pdf.sh docs/RESUMEN-VISUAL-ESTADO.md visual-summary.pdf - - name: Commit summary markdown + - name: Commit summary markdown via pull request + env: + GH_TOKEN: ${{ github.token }} run: | if git diff --quiet -- docs/RESUMEN-VISUAL-ESTADO.md; then echo "No visual summary changes to commit" exit 0 fi + # main esta protegida (requiere PR + firmas + checks), por lo que un + # push directo (git push origin HEAD:main) es rechazado por GH013. + # En su lugar, publicamos el cambio en una rama y abrimos un PR. + branch="chore/visual-summary-${{ github.run_number }}" git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git checkout -b "$branch" git add docs/RESUMEN-VISUAL-ESTADO.md git commit -m "docs: actualizar resumen visual automatizado" - git push origin HEAD:main + git push origin "$branch" + gh pr create --base main --head "$branch" \ + --title "docs: actualizar resumen visual automatizado" \ + --body "Resumen visual regenerado automaticamente por el workflow Generate Visual Summary (run #${{ github.run_number }})." - name: Upload visual artifacts uses: actions/upload-artifact@v4 diff --git a/.github/workflows/thingsdata-integration.yml b/.github/workflows/thingsdata-integration.yml index e4f97faa..c415a4f3 100644 --- a/.github/workflows/thingsdata-integration.yml +++ b/.github/workflows/thingsdata-integration.yml @@ -78,8 +78,13 @@ jobs: services: mosquitto: image: eclipse-mosquitto:2 + # mosquitto_sub -C 1 espera recibir un mensaje, pero nadie publica en + # 'castuo/health' durante el arranque del servicio, por lo que el + # healthcheck siempre expiraba (exit 27) y el contenedor quedaba + # "unhealthy". mosquitto_pub solo valida que el broker acepta + # conexiones/publicaciones y termina con exito de inmediato. options: >- - --health-cmd="mosquitto_sub -h localhost -p 1883 -t 'castuo/health' -C 1 -W 1" + --health-cmd="mosquitto_pub -h localhost -p 1883 -t 'castuo/health' -m 'healthcheck'" --health-interval=10s --health-timeout=5s --health-retries=5 diff --git a/scripts/metrics-sync.sh b/scripts/metrics-sync.sh index 97b9d95b..446af734 100755 --- a/scripts/metrics-sync.sh +++ b/scripts/metrics-sync.sh @@ -22,7 +22,11 @@ if ls logs/*.log > /dev/null 2>&1; then fi drift=0 -if [[ -n "$(git status --porcelain)" ]]; then +# Nota: se ignoran ficheros sin seguimiento (--untracked-files=no) porque la +# propia redireccion `> metrics.prom` de este script crea un fichero nuevo en +# la raiz del repo antes de que se ejecute este bloque, lo que provocaba un +# falso positivo de drift en cada ejecucion de CI. +if [[ -n "$(git status --porcelain --untracked-files=no)" ]]; then drift=1 fi From a154fea0760195ccd242e38e8f0e828bbc705343 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Fri, 4 Sep 2026 11:54:15 +0000 Subject: [PATCH 2/2] docs: actualizar changelog preview del PR --- CHANGELOG.md | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 02466b0a..9b3dba0d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,9 +1,17 @@ # CHANGELOG -## [Unreleased] - 2026-08-01 +## [Unreleased] - 2026-09-04 -- Merge fe9a1449e46f3e84ce0fe013375dd0b7938ba43c into e067bde4d081caf85c3af10b51160abef24c466a (0ba736c) -- Revise README for Cast-o framework details (fe9a144) +- Merge 7c5a5ca34019ef2423e45f1dfd402c95cf6a90f2 into b01ab0112b2a9ff02070e403ad70db8bda2d0ba8 (b60b7cf) +- fix(ci): repair Agent Sync Hardening, Thingsdata, and Visual Summary workflows (7c5a5ca) +- docs(evos): integrate castuo-evidence into ecosystem navigation (b01ab01) +- docs: add negative assurance boundary (e3aabfc) +- docs: add private cloud evidence boundary (4d0c0f7) +- ci: align documentation and validation contracts (6c9e233) +- ci: make hardening and Python validation CI-safe (0c86512) +- chore: apply architecture governance and security baseline (5ccf164) +- docs: rewrite README to align with ecosystem contract and evidence-first principles (8484ced) +- Revise README for Cast-o framework details (#11) (f4ea214) - Create SECURITY.md for security policy and reporting (#5) (e067bde) - docs: actualizar resumen visual automatizado (cf1b175) - Add GitHub Actions workflow for Python package with Conda (d1b6e5c)