chore: promote release-candidate to main#328
Merged
Merged
Conversation
Upgrade the Go toolchain from 1.26.4 to 1.26.5 across the repository, including go.mod, go.work, and GitHub Actions workflows, to ensure the build runs on the latest language patch release. Update the LerianStudio shared GitHub Actions workflows to v1.46.1 to leverage the latest CI/CD pipeline capabilities and bug fixes. Update multiple Go module dependencies to their newest versions to incorporate upstream bug fixes, security patches, and performance improvements.
Changelog atualizado.
Picks up the ArgoCD wait-timeout backoff fix and the Ungoliant curl-timeout increase (300s -> 900s) from github-actions-shared-workflows v1.46.2.
The plugin_crm extraction path decrypted contact, banking_details, legal_person and natural_person fields but not regulatory_fields or related_parties, so participant_document (a CNPJ) and related_parties[].document were projected as ciphertext into the snapshot -- the root cause of CCS-0011 in br-ccs batch generation. Add decryptRegulatoryFields and decryptRelatedParties, mirroring the existing per-object decryptors and reusing the same crypto instance; wire both into decryptNestedFields. Verified against the live dev-st CRM (KMS_VENDOR=none): all values are legacy AES-GCM (no tink: format). Fail-closed on undecryptable values; name/role/dates stay plaintext. X-Lerian-Ref: 0x1
Changelog atualizado.
…registry In single-tenant mode, LoadInternalConnectionsFromEnv silently skipped any DATASOURCE_*_CONFIG_NAME whose value was not in the internal registry, so a typo (e.g. midaz_onbaording) produced a datasource that never loaded with no diagnostic. Emit a WARN naming the offending value and the accepted set; an empty CONFIG_NAME stays silent (nothing to flag). Covers Manager and Worker via the shared loader. Closes #326 Claude-Session: https://claude.ai/code/session_01WscfYUmQmJ7KWNGE18mXNB
fredcamaral
had a problem deploying
to
create_release
July 24, 2026 02:46 — with 
GitHub Actions
Failure
GitHub Actions
Failure
📝 WalkthroughWalkthroughGo 1.26.5 and shared workflow versions were updated across CI, module dependencies were refreshed, engine beta changelog entries were added, and resolver handling now distinguishes empty from unknown datasource configuration names with deterministic warnings. ChangesResolver configuration logging
Go tooling and release metadata
✨ Finishing Touches✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/resolver/env_loader_test.go`:
- Around line 316-319: Update the assertions in the logger.entries verification
to require that no log entries are emitted when CONFIG_NAME is empty, rather
than checking only each entry’s config_name field. Preserve the existing test
setup and silent-skip contract while asserting logger.entries is empty.
- Around line 15-40: Update the test covering the empty CONFIG_NAME path to
assert that capturingLogger.entries is empty, ensuring no log is emitted when
configuration loading is skipped. Retain the existing field assertions for paths
that do log, and use the capturingLogger implementation to verify silence.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 14ac078c-470e-49fa-8b4b-fc099f5875e9
⛔ Files ignored due to path filters (2)
go.sumis excluded by!**/*.sumgo.workis excluded by!**/*.work
📒 Files selected for processing (12)
.github/workflows/engine-module.yml.github/workflows/fuzz.yml.github/workflows/pr-validation.yml.github/workflows/release.yml.github/workflows/routine.ymlcomponents/worker/internal/services/extract_crm_data.gocomponents/worker/internal/services/extract_crm_data_test.gogo.modpkg/engine/CHANGELOG.mdpkg/engine/go.modpkg/resolver/env_loader.gopkg/resolver/env_loader_test.go
Comment on lines
+15
to
+40
| // capturingLogger records every Log call so tests can assert on emitted | ||
| // warnings. It satisfies libLog.Logger; only Log is exercised here. | ||
| type capturingLogger struct { | ||
| entries []capturedEntry | ||
| } | ||
|
|
||
| type capturedEntry struct { | ||
| level libLog.Level | ||
| msg string | ||
| fields map[string]any | ||
| } | ||
|
|
||
| func (c *capturingLogger) Log(_ context.Context, level libLog.Level, msg string, fields ...libLog.Field) { | ||
| m := make(map[string]any, len(fields)) | ||
| for _, f := range fields { | ||
| m[f.Key] = f.Value | ||
| } | ||
|
|
||
| c.entries = append(c.entries, capturedEntry{level: level, msg: msg, fields: m}) | ||
| } | ||
|
|
||
| func (c *capturingLogger) With(_ ...libLog.Field) libLog.Logger { return c } | ||
| func (c *capturingLogger) WithGroup(_ string) libLog.Logger { return c } | ||
| func (c *capturingLogger) Enabled(_ libLog.Level) bool { return true } | ||
| func (c *capturingLogger) Sync(_ context.Context) error { return nil } | ||
|
|
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the target test file and nearby test utilities/mocks.
git ls-files 'pkg/resolver/*' 'pkg/**/*mock.go' 'pkg/**/*_test.go' | sed -n '1,200p'
printf '\n--- env_loader_test.go ---\n'
cat -n pkg/resolver/env_loader_test.go | sed -n '1,220p'
printf '\n--- search for libLog.Logger mocks / mockgen directives ---\n'
rg -n --hidden --glob '!**/node_modules/**' --glob '!**/vendor/**' 'mockgen|go:generate.*mockgen|type .*Logger.*interface|libLog\.Logger|capturingLogger' pkg . | sed -n '1,240p'
printf '\n--- relevant resolver tests around empty-name assertion ---\n'
rg -n --hidden --glob '!**/node_modules/**' --glob '!**/vendor/**' 'config_name|empty-name|name.*empty|warning' pkg/resolver -A4 -B4 | sed -n '1,240p'Repository: LerianStudio/fetcher
Length of output: 50376
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n--- pkg/testutil/mocks.go ---\n'
cat -n pkg/testutil/mocks.go | sed -n '1,220p'
printf '\n--- pkg/resolver/resolver.mock.go ---\n'
cat -n pkg/resolver/resolver.mock.go | sed -n '1,220p'
printf '\n--- env_loader_test.go empty-name coverage and logger usage ---\n'
rg -n --context 4 'config_name|capturingLogger|LoadInternalConnectionsFromEnv|warn|warning|empty' pkg/resolver/env_loader_test.go | sed -n '1,240p'Repository: LerianStudio/fetcher
Length of output: 16886
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n--- pkg/resolver/env_loader.go ---\n'
cat -n pkg/resolver/env_loader.go | sed -n '1,260p'
printf '\n--- env_loader_test.go around the empty-name test block ---\n'
cat -n pkg/resolver/env_loader_test.go | sed -n '260,360p'Repository: LerianStudio/fetcher
Length of output: 11820
Assert the empty CONFIG_NAME path stays silent. assert.NotEqual(t, "", e.fields["config_name"]) still passes if this path starts logging a non-empty config name; assert.Empty(t, logger.entries) would lock the intended skip behavior.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/resolver/env_loader_test.go` around lines 15 - 40, Update the test
covering the empty CONFIG_NAME path to assert that capturingLogger.entries is
empty, ensuring no log is emitted when configuration loading is skipped. Retain
the existing field assertions for paths that do log, and use the capturingLogger
implementation to verify silence.
Source: Coding guidelines
Comment on lines
+316
to
+319
| for _, e := range logger.entries { | ||
| assert.NotEqual(t, "", e.fields["config_name"], | ||
| "empty CONFIG_NAME must be skipped before any log is emitted") | ||
| } |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Assert that no log entries were emitted.
This only rejects entries with an empty config_name; a warning without that field would still pass despite violating the silent-skip contract.
Proposed fix
- for _, e := range logger.entries {
- assert.NotEqual(t, "", e.fields["config_name"],
- "empty CONFIG_NAME must be skipped before any log is emitted")
- }
+ assert.Empty(t, logger.entries,
+ "empty CONFIG_NAME must be skipped before any log is emitted")📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| for _, e := range logger.entries { | |
| assert.NotEqual(t, "", e.fields["config_name"], | |
| "empty CONFIG_NAME must be skipped before any log is emitted") | |
| } | |
| assert.Empty(t, logger.entries, | |
| "empty CONFIG_NAME must be skipped before any log is emitted") |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/resolver/env_loader_test.go` around lines 316 - 319, Update the
assertions in the logger.entries verification to require that no log entries are
emitted when CONFIG_NAME is empty, rather than checking only each entry’s
config_name field. Preserve the existing test setup and silent-skip contract
while asserting logger.entries is empty.
Back-merge the 3.0.x hotfix line (CRM regulatory_fields decryption, #320) and release chores (3.0.1, 3.0.2) into the 3.1.0-beta line so release-candidate promotes to main without conflicts. Resolutions: go.mod/go.sum kept from release-candidate (newer, CI-green dependency pair); pkg/engine/CHANGELOG.md unioned to preserve both stable (1.1.1/1.1.0) and beta (1.1.0-beta.x) entries. Claude-Session: https://claude.ai/code/session_01WscfYUmQmJ7KWNGE18mXNB
Contributor
🔴 Lerian Library Version Check — action required
✅ 2 current · 🔴 1 needs update · 🕒 1 in grace · ⏭️ 1 skipped ·
|
lerian-studio
added
size/M
Contributor
🔍 PR Validation Summary✅ PR Mergeable — no blocking failures
|
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pkg/engine/CHANGELOG.md (1)
13-20: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winPlace the new beta releases at the top of the changelog.
The release script prepends new entries immediately after the title, but these
3.1.0-beta.*entries appear below older releases. Move1.1.0-beta.2first, followed by1.1.0-beta.1, before1.1.1so the changelog matches the release pipeline’s ordering contract.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/engine/CHANGELOG.md` around lines 13 - 20, Reorder the release entries in the pkg/engine changelog so 1.1.0-beta.2 appears first, followed by 1.1.0-beta.1, both immediately before the existing 1.1.1 entry. Preserve each release’s existing text and formatting.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@pkg/engine/CHANGELOG.md`:
- Around line 13-20: Reorder the release entries in the pkg/engine changelog so
1.1.0-beta.2 appears first, followed by 1.1.0-beta.1, both immediately before
the existing 1.1.1 entry. Preserve each release’s existing text and formatting.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 38125910-617c-4f6d-8e45-691f62fd0366
📒 Files selected for processing (1)
pkg/engine/CHANGELOG.md
Contributor
🔒 Security Scan Results —
|
| Stage | Status | Blocking? |
|---|---|---|
| Filesystem Scan | ✅ Clean | — |
| Docker Image Scan | 🔴 Yes | |
| Docker Hub Health Score | 🔴 Yes | |
| Pre-release Version Check | 🔴 Yes |
Trivy
Filesystem Scan
✅ No vulnerabilities or secrets found.
Docker Image Scan
| Severity | Vulnerability | Title |
|---|---|---|
| CRITICAL/HIGH | GHSA-hrxh-6v49-42gf | gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities |
Docker Hub Health Score Compliance
⚠️ Policies — 3/4 met
| Policy | Status |
|---|---|
| Default non-root user | ✅ Passed |
| No fixable critical/high CVEs | |
| No high-profile vulnerabilities | ✅ Passed |
| No AGPL v3 licenses | ✅ Passed |
⚠️ Some Docker Hub health score policies are not met. Review the table above.
Pre-release Version Check
🚫 Found 1 unstable version pin(s). Only stable releases (x.y.z) and SHA-based pins are allowed.
| File | Line | Content |
|---|---|---|
./go.mod |
68 | github.com/LerianStudio/fetcher/pkg/engine v1.1.0-beta.2 |
Replace pre-release suffixes (
-alpha,-beta,-rc,-dev, etc.) with stable releases.
Contributor
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 89.7% ✅ PASS |
| Threshold | 80% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/fetcher/v2/components/manager/cmd/huma-spec |
33.4% |
github.com/LerianStudio/fetcher/v2/components/manager/internal/adapters/cache |
100.0% |
github.com/LerianStudio/fetcher/v2/components/manager/internal/adapters/http/in |
89.4% |
github.com/LerianStudio/fetcher/v2/components/manager/internal/services/command |
92.8% |
github.com/LerianStudio/fetcher/v2/components/manager/internal/services/query |
96.4% |
Generated by Go PR Analysis workflow
Contributor
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 87.4% ✅ PASS |
| Threshold | 80% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/fetcher/v2/components/worker/internal/services |
90.0% |
Generated by Go PR Analysis workflow
Contributor
🔒 Security Scan Results —
|
| Stage | Status | Blocking? |
|---|---|---|
| Filesystem Scan | ✅ Clean | — |
| Docker Image Scan | 🔴 Yes | |
| Docker Hub Health Score | 🔴 Yes | |
| Pre-release Version Check | 🔴 Yes |
Trivy
Filesystem Scan
✅ No vulnerabilities or secrets found.
Docker Image Scan
| Severity | Vulnerability | Title |
|---|---|---|
| CRITICAL/HIGH | GHSA-hrxh-6v49-42gf | gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities |
Docker Hub Health Score Compliance
⚠️ Policies — 3/4 met
| Policy | Status |
|---|---|
| Default non-root user | ✅ Passed |
| No fixable critical/high CVEs | |
| No high-profile vulnerabilities | ✅ Passed |
| No AGPL v3 licenses | ✅ Passed |
⚠️ Some Docker Hub health score policies are not met. Review the table above.
Pre-release Version Check
🚫 Found 1 unstable version pin(s). Only stable releases (x.y.z) and SHA-based pins are allowed.
| File | Line | Content |
|---|---|---|
./go.mod |
68 | github.com/LerianStudio/fetcher/pkg/engine v1.1.0-beta.2 |
Replace pre-release suffixes (
-alpha,-beta,-rc,-dev, etc.) with stable releases.
|
Docs PR opened: https://github.com/lerianstudio/documentation/pull/193 The Fetcher configuration page now states that unknown DATASOURCE _CONFIG_NAME values are skipped with a WARN log naming the accepted set. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
release-candidateintomain(stable). Carries the release-candidatedelta since the last stable sync (
3.1.0-beta.2train).Includes, among the beta content already reviewed on develop:
DATASOURCE_*_CONFIG_NAMEis outside the internal registry (DATASOURCE_*_CONFIG_NAME outside the internal registry is silently skipped at startup (no log) #326) — single-tenant env loader emits a WARN naming the offending value and the accepted set instead of silently skipping a typo'd datasource. Covers Manager and Worker via the shared loader.Closes #326
https://claude.ai/code/session_01WscfYUmQmJ7KWNGE18mXNB