Atualizações de dependências sem pager de madrugada: um fluxo prático

# This passes. It tells you nothing about production behaviour.
npm test -- --testPathPattern=payment.service.test.ts

# .github/workflows/ci.yml — the classic "green but broken" config
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm test        # unit tests only, mocks everywhere
      - run: npm run lint

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:recommended", ":semanticCommits", ":prHourlyLimit2"],
  "timezone": "Europe/Berlin",
  "schedule": ["before 5am on weekday"],
  "prHourlyLimit": 2,
  "prConcurrentLimit": 10,
  "packageRules": [
    {
      "matchUpdateTypes": ["patch"],
      "groupName": "all-patches",
      "automerge": true,
      "automergeType": "pr",
      "requiredStatusChecks": ["ci/test", "ci/lint", "ci/typecheck"],
      "commitMessagePrefix": "chore(deps):",
      "commitMessageTopic": "{{depName}}"
    },
    {
      "matchUpdateTypes": ["minor"],
      "groupName": "all-minors",
      "automerge": false,
      "requiredStatusChecks": ["ci/test", "ci/lint", "ci/typecheck", "ci/integration"],
      "commitMessagePrefix": "feat(deps):",
      "commitMessageTopic": "{{depName}}"
    },
    {
      "matchUpdateTypes": ["major"],
      "groupName": "all-majors",
      "automerge": false,
      "requiredStatusChecks": ["ci/test", "ci/lint", "ci/typecheck", "ci/integration", "ci/e2e"],
      "commitMessagePrefix": "BREAKING:",
      "commitMessageTopic": "{{depName}}"
    },
    {
      "matchPackageNames": ["@aws-sdk/*", "kubernetes-client", "pg", "redis"],
      "matchUpdateTypes": ["minor", "major"],
      "automerge": false,
      "reviewers": ["@your-team/platform"],
      "labels": ["needs-human-eyes"]
    }
  ],
  "ignoreDeps": ["@types/node", "typescript"],
  "postUpdateOptions": ["npmDedupe"],
  "npmrc": "strict-peer-dependencies=false"
}

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "daily"
      time: "04:00"
      timezone: "Europe/Berlin"
    open-pull-requests-limit: 10
    pull-request-branch-name.separator: "-"
    commit-message:
      prefix: "chore(deps)"
      prefix-development: "chore(deps-dev)"
    groups:
      patches:
        patterns: ["*"]
        update-types: ["patch"]
      minors:
        patterns: ["*"]
        update-types: ["minor"]
      majors:
        patterns: ["*"]
        update-types: ["major"]
    ignore:
      - dependency-name: "@types/node"
      - dependency-name: "typescript"
    labels:
      - "dependencies"
    reviewers:
      - "your-team/platform"
    allow:
      - dependency-type: "direct"
      - dependency-type: "indirect"

# .github/workflows/velocity.yml
name: Velocity Gate
on:
  pull_request:
    types: [opened, synchronize, reopened]
 
jobs:
  lint-and-unit:
    runs-on: ubuntu-latest
    timeout-minutes: 3
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: 'pip'
      - uses: actions/setup-go@v5
        with:
          go-version: '1.22'
          cache: true
 
      - name: Install deps (Node)
        if: hashFiles('package-lock.json') != ''
        run: npm ci --prefer-offline --no-audit
 
      - name: Install deps (Python)
        if: hashFiles('requirements.txt') != ''
        run: pip install --no-cache-dir -r requirements.txt
 
      - name: Install deps (Go)
        if: hashFiles('go.sum') != ''
        run: go mod download
 
      - name: Lint & Typecheck
        run: |
          set -euo pipefail
          if [[ -f package-lock.json || -f package.json ]]; then
            npm run lint
            npm run typecheck
          fi
          if [[ -f requirements.txt || -f pyproject.toml ]]; then
            if command -v ruff >/dev/null 2>&1; then python -m ruff check .; fi
            if command -v mypy >/dev/null 2>&1; then python -m mypy .; fi
          fi
          if [[ -f go.sum ]]; then
            go vet ./...
            if command -v golangci-lint >/dev/null 2>&1; then golangci-lint run ./...; fi
          fi
 
      - name: Unit Tests
        run: |
          set -euo pipefail
          if [[ -f package-lock.json || -f package.json ]]; then
            npm test -- --passWithNoTests
          fi
          if [[ -f requirements.txt || -f pyproject.toml ]]; then
            python -m pytest --tb=short -q
          fi
          if [[ -f go.sum ]]; then
            go test ./... -short
          fi
 
      - name: Dependency Audit
        run: |
          set -euo pipefail
          if [[ -f package-lock.json ]]; then
            npm audit --audit-level=high
          fi
          if [[ -f requirements.txt ]]; then
            pip-audit -r requirements.txt
          fi
          if [[ -f go.sum ]] && command -v govulncheck >/dev/null 2>&1; then
            govulncheck ./...
          fi

# .github/workflows/integration.yml
name: Integration Gate
on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [main]
 
jobs:
  integration:
    if: contains(github.event.pull_request.labels.*.name, 'dependencies')
    runs-on: ubuntu-latest
    timeout-minutes: 15
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: test
          POSTGRES_DB: app_test
        ports: [5432:5432]
        options: >-
          --health-cmd="pg_isready -U postgres"
          --health-interval=5s
          --health-timeout=3s
          --health-retries=5
      redis:
        image: redis:7-alpine
        ports: [6379:6379]
        options: --health-cmd="redis-cli ping" --health-interval=5s --health-timeout=3s --health-retries=5
 
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - uses: actions/setup-python@v5
        with: { python-version: '3.12', cache: 'pip' }
 
      - name: Run Migrations
        run: |
          npm run db:migrate 2>/dev/null || python manage.py migrate 2>/dev/null || true
        env:
          DATABASE_URL: postgresql://postgres:test@localhost:5432/app_test
          REDIS_URL: redis://localhost:6379/0
 
      - name: Integration Tests
        run: |
          npm run test:integration 2>/dev/null || true
          python -m pytest tests/integration -v --tb=short 2>/dev/null || true
        env:
          DATABASE_URL: postgresql://postgres:test@localhost:5432/app_test
          REDIS_URL: redis://localhost:6379/0

# .github/workflows/contract.yml
name: Contract Gate
on:
  pull_request:
    types: [opened, synchronize, reopened]
 
jobs:
  contract:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12', cache: 'pip' }
      - run: pip install schemathesis[pytest]
      - name: Provider Contract Tests
        run: |
          schemathesis run --checks=all \
            --base-url=http://localhost:8000 \
            openapi.yaml 2>/dev/null || true

# .github/workflows/smoke.yml
name: Smoke Gate
on:
  pull_request:
    types: [opened, synchronize, reopened]
    branches: [main]
 
jobs:
  smoke:
    if: contains(github.event.pull_request.labels.*.name, 'dependencies')
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Build Images
        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml build
      - name: Start Stack
        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d
      - name: Wait for Health
        run: |
          for i in {1..30}; do
            curl -sf http://localhost:8000/health && curl -sf http://localhost:3000 && break
            sleep 2
          done
      - name: Smoke Tests
        run: |
          curl -sf http://localhost:8000/api/v1/ping | grep -q pong
          curl -sf http://localhost:3000 | grep -q "Welcome"
      - name: Teardown
        if: always()
        run: docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v

# docker-compose.ci.yml (committed to repo)
services:
  api:
    build:
      context: ./backend
      target: production
    environment:
      DATABASE_URL: postgresql://postgres:test@db:5432/app
      REDIS_URL: redis://redis:6379/0
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    ports: ["8000:8000"]
 
  web:
    build:
      context: ./frontend
      target: production
    ports: ["3000:80"]
    depends_on: [api]
 
  db:
    image: postgres:16-alpine
    environment:
      POSTGRES_PASSWORD: test
      POSTGRES_DB: app
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 5s
      timeout: 3s
      retries: 10
 
  redis:
    image: redis:7-alpine
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 10

# .github/branch-protection.yml (apply via gh api or UI)
required_status_checks:
  strict: true
  contexts:
    - "Velocity Gate / lint-and-unit"
    - "Integration Gate / integration"
    - "Contract Gate / contract"
    - "Smoke Gate / smoke"
required_pull_request_reviews:
  required_approving_review_count: 1
  dismiss_stale_reviews: true
  require_code_owner_reviews: true

# .github/CODEOWNERS
/package*.json @team-platform
/requirements*.txt @team-platform
/go.mod @team-platform
/docker-compose*.yml @team-infra

#!/usr/bin/env bash
set -euo pipefail
 
PR_NUMBER="${1:-}"
PACKAGE_MANAGER="${2:-auto}"
 
if [[ -z "$PR_NUMBER" ]]; then
  echo "Usage: $0 <pr-number> [npm|pip|cargo|go|auto]"
  exit 1
fi
 
REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
WORKTREE_DIR="${REPO_ROOT}/.repro/pr-${PR_NUMBER}"
 
echo "🔧 Setting up worktree for PR #${PR_NUMBER}..."
BRANCH="$(gh pr view "${PR_NUMBER}" --json headRefName -q .headRefName)"
echo "📌 Head branch: ${BRANCH}"
git fetch origin "pull/${PR_NUMBER}/head:refs/repro/pr-${PR_NUMBER}"
git worktree add -f "${WORKTREE_DIR}" "refs/repro/pr-${PR_NUMBER}"
 
cd "${WORKTREE_DIR}"
 
detect_pm() {
  [[ -f "package.json" ]] && echo "npm" && return
  [[ -f "pyproject.toml" || -f "requirements.txt" ]] && echo "pip" && return
  [[ -f "Cargo.toml" ]] && echo "cargo" && return
  [[ -f "go.mod" ]] && echo "go" && return
  echo "unknown"
}
 
PM="${PACKAGE_MANAGER}"
[[ "$PM" == "auto" ]] && PM="$(detect_pm)"
echo "📦 Package manager: ${PM}"
 
install_deps() {
  case "$1" in
    npm)  [[ -f "package-lock.json" ]] && npm ci || npm install ;;
    pip)  [[ -f "requirements.txt" ]] && pip install -r requirements.txt || pip install -e . ;;
    cargo) cargo fetch --locked ;;
    go)   go mod download ;;
    *)    echo "❌ Unknown PM: $1"; exit 1 ;;
  esac
}
 
echo "⬇️  Installing exact versions..."
install_deps "${PM}"
 
run_tests() {
  case "$1" in
    npm)  npm test ;;
    pip)  python -m pytest -xvs ;;
    cargo) cargo test ;;
    go)   go test ./... ;;
  esac
}
 
echo "🧪 Running test suite..."
run_tests "${PM}"
 
echo "✅ Reproduction complete. Worktree at: ${WORKTREE_DIR}"
echo "   Clean up with: git worktree remove ${WORKTREE_DIR}"

#!/usr/bin/env bash
# bisect-dep.sh <package> <good-version> <bad-version> -- <test-command...>
# Maps versions → lockfile commits (git log -S), then bisects; each step only runs the test.
set -euo pipefail
 
PKG="$1"; GOOD_VER="$2"; BAD_VER="$3"; shift 3
if [[ "${1:-}" == "--" ]]; then shift; fi
TEST_CMD=("$@")
[[ ${#TEST_CMD[@]} -gt 0 ]] || { echo "Usage: $0 <pkg> <good-ver> <bad-ver> -- <test-command...>"; exit 1; }
 
LOCKFILE=""
for f in package-lock.json yarn.lock pnpm-lock.yaml; do
  [[ -f "$f" ]] && LOCKFILE="$f" && break
done
[[ -n "$LOCKFILE" ]] || { echo "No Node lockfile found"; exit 1; }
 
resolve_sha() {
  local ver="$1" sha=""
  # Allow raw SHAs when you already know the lockfile commits
  if [[ "$ver" =~ ^[0-9a-f]{7,40}$ ]] && git cat-file -e "${ver}^{commit}" 2>/dev/null; then
    echo "$ver"
    return
  fi
  while read -r c; do
    if git show "$c:$LOCKFILE" 2>/dev/null | grep -Fq "\"$PKG\"" \
       && git show "$c:$LOCKFILE" 2>/dev/null | grep -Fq "\"$ver\""; then
      sha="$c"
      break
    fi
  done < <(git log -S "$ver" --pretty=format:%H -- "$LOCKFILE")
  [[ -n "$sha" ]] || { echo "Could not resolve ${PKG}@${ver} to a lockfile commit"; exit 1; }
  echo "$sha"
}
 
GOOD_SHA="$(resolve_sha "$GOOD_VER")"
BAD_SHA="$(resolve_sha "$BAD_VER")"
echo "Good: ${PKG}@${GOOD_VER} → ${GOOD_SHA}"
echo "Bad:  ${PKG}@${BAD_VER} → ${BAD_SHA}"
 
git bisect start "$BAD_SHA" "$GOOD_SHA"
git bisect run bash -c 'npm ci --prefer-offline --no-audit && exec "$@"' _ "${TEST_CMD[@]}"
git bisect reset

{
  "packageRules": [
    {
      "matchPackageNames": ["axios"],
      "matchCurrentVersion": "!1.6.2",
      "groupName": "pinned-axios-1.6.2",
      "schedule": ["after 2025-03-15"],
      "expires": "2025-03-15",
      "automerge": false
    }
  ]
}

#!/usr/bin/env bash
# check-pin-expiry.sh — runs in CI on every PR
set -euo pipefail
EXPIRY_FILE="pinned-dependencies.json"
if [[ ! -f "$EXPIRY_FILE" ]]; then exit 0; fi
 
to_epoch() {
  local d="$1"
  if date -d "$d" +%s >/dev/null 2>&1; then
    date -d "$d" +%s
  elif date -j -f "%Y-%m-%d" "$d" +%s >/dev/null 2>&1; then
    date -j -f "%Y-%m-%d" "$d" +%s
  else
    echo "Cannot parse expires date: $d (want YYYY-MM-DD)" >&2
    return 2
  fi
}
 
now="$(date +%s)"
failed=0
while IFS=$'\t' read -r pkg expires; do
  [[ -z "${expires:-}" || "$expires" == "null" ]] && continue
  epoch="$(to_epoch "$expires")" || exit $?
  if (( epoch < now )); then
    echo "::error::Pin for $pkg expired on $expires — update or extend"
    failed=1
  fi
done < <(jq -r '.packageRules[] | select(.expires != null) | "\(.matchPackageNames[0])\t\(.expires)"' "$EXPIRY_FILE")
 
exit "$failed"

// tests/contract/axios-transform-response.test.ts
import axios from 'axios';
import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 
describe('axios transformResponse contract', () => {
  let server: ReturnType<typeof vi.fn>;
 
  beforeEach(() => {
    server = vi.fn().mockImplementation((req, res) => {
      res.setHeader('content-type', 'application/json');
      res.end(JSON.stringify({ data: 'raw' }));
    });
  });
 
  it('applies transformResponse to parsed JSON, not raw body', async () => {
    const result = await axios.get('/test', {
      transformResponse: [(data) => ({ transformed: data.data })],
    });
    expect(result.data).toEqual({ transformed: 'raw' });
  });
});

name: Dependency Regression Report
body:
  - type: markdown
    attributes:
      value: |
        **Fill every field. Incomplete reports are closed.**
  - type: input
    id: package
    attributes:
      label: Package name
      placeholder: axios
    validations:
      required: true
  - type: input
    id: versions
    attributes:
      label: Working → Broken versions
      placeholder: 1.6.2 → 1.6.3
    validations:
      required: true
  - type: textarea
    id: reproduction
    attributes:
      label: Minimal reproduction
      description: |
        Paste a self-contained script (Node, Python, Go — whatever the package runs on).
        No external deps. No framework boilerplate.
        If I can't `npm i axios@1.6.3 && node repro.js`, I won't debug it.
      render: bash
    validations:
      required: true
  - type: textarea
    id: expected
    attributes:
      label: Expected behavior
      placeholder: transformResponse receives parsed JSON
    validations:
      required: true
  - type: textarea
    id: actual
    attributes:
      label: Actual behavior
      placeholder: transformResponse receives raw response body string
    validations:
      required: true

{
  "name": "@myorg/billing-service",
  "dependencies": {
    "@myorg/api-client": "^2.1.0"
  },
  "contract": {
    "@myorg/api-client": {
      "requiredVersion": ">=2.1.0 <3.0.0",
      "testCommand": "pnpm test:contract:api-client"
    }
  }
}

{
  "packageRules": [
    {
      "matchLabels": ["dependency-fix"],
      "schedule": ["anytime"],
      "automerge": true,
      "prPriority": 100
    }
  ]
}

# Core runtime — senior review mandatory
package.json                    @team/senior-backend @team/senior-frontend
pnpm-lock.yaml                  @team/senior-backend @team/senior-frontend
 
# Security-adjacent — security team + one senior
**/dependencies/security/**     @team/security @team/senior-backend
 
# Dev tools — auto-merge eligible
**/devDependencies/**           @team/any-engineer
 
# Documentation only — no review needed
**/*.md                         @team/any-engineer

{
  "automerge": true,
  "automergeType": "pr",
  "automergeSchedule": ["after 10pm on weekdays", "before 8am on weekdays", "weekends"],
  "requiredStatusChecks": [
    "ci/unit-tests",
    "ci/contract-tests",
    "ci/security-scan",
    "ci/dependency-health"
  ],
  "automergeConditions": [
    "all-status-checks-passed",
    "no-review-changes-requested",
    "base-branch-not-modified"
  ]
}

# .github/workflows/dependabot-auto-merge.yml
on: pull_request_target
permissions:
  pull-requests: write
  contents: write
jobs:
  auto-merge:
    if: github.actor == 'dependabot[bot]' && github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/github-script@v7
        with:
          script: |
            const { data: checks } = await github.rest.checks.listForRef({
              owner: context.repo.owner,
              repo: context.repo.repo,
              ref: context.payload.pull_request.head.sha
            })
            const required = ['ci/unit-tests', 'ci/contract-tests', 'ci/security-scan', 'ci/dependency-health']
            const allPassed = required.every(r => 
              checks.check_runs.some(c => c.name === r && c.conclusion === 'success')
            )
            if (allPassed) {
              await github.rest.pulls.merge({
                owner: context.repo.owner,
                repo: context.repo.repo,
                pull_number: context.payload.pull_request.number,
                merge_method: 'squash'
              })
            }

# .github/workflows/hotfix-gate.yml
on:
  pull_request:
    types: [labeled, unlabeled, synchronize]
jobs:
  validate-hotfix:
    if: contains(github.event.pull_request.labels.*.name, 'hotfix')
    runs-on: ubuntu-latest
    steps:
      - name: Verify incident link
        run: |
          body="${{ github.event.pull_request.body }}"
          if ! echo "$body" | grep -qE '(INC|JIRA|PAGERDUTY)-[0-9]+'; then
            echo "::error::Hotfix PR must reference an incident ticket (e.g., INC-1234)"
            exit 1
          fi
      - name: Ensure revert PR exists or create reminder
        uses: actions/github-script@v7
        with:
          script: |
            const { data: prs } = await github.rest.pulls.list({
              owner: context.repo.owner,
              repo: context.repo.repo,
              head: `revert-${context.payload.pull_request.number}`,
              state: 'open'
            })
            if (prs.length === 0) {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.payload.pull_request.number,
                body: '⚠️ **HOTFIX MERGED**: A revert PR `revert-#${{ github.event.pull_request.number }}` must be opened within 48h. This comment serves as audit trail.'
              })
            }

# query.graphql
query($owner: String!, $repo: String!, $since: DateTime!) {
  repository(owner: $owner, name: $repo) {
    pullRequests(first: 100, states: [MERGED], orderBy: {field: MERGED_AT, direction: DESC}, mergedAfter: $since) {
      nodes {
        number
        title
        mergedAt
        author { login }
        labels(first: 10) { nodes { name } }
        reviews(first: 5) { nodes { state author { login } } }
        commits(first: 1) { nodes { commit { statusCheckRollup { state } } } }
        files(first: 5) { nodes { path } }
      }
    }
  }
}

# .github/workflows/dependency-health-report.yml
on:
  schedule:
    - cron: '0 9 1 * *'  # First of month, 09:00 UTC
jobs:
  report:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/github-script@v7
        id: query
        with:
          script: |
            const fs = require('fs')
            const query = fs.readFileSync('.github/query.graphql', 'utf8')
            const since = new Date(Date.now() - 30*24*60*60*1000).toISOString()
            const result = await github.graphql(query, { owner: context.repo.owner, repo: context.repo.repo, since })
            return result
      - name: Format and post
        run: |
          # Parse JSON, build markdown table, post to Slack/Discord via webhook
          # See gist.github.com/yourhandle/dependency-health-report for full script
          echo "Report generated: ${{ steps.query.outputs.result }}"

## Dependency Update Checklist
 
- [ ] **Type identified**: `patch` | `minor` | `major` | `security` | `dev`
- [ ] **Changelog reviewed**: Link to upstream release notes: _______________
- [ ] **Breaking changes assessed**: None | Documented in PR description | Migration script added
- [ ] **Tests updated**: Unit | Contract | Integration | E2E | N/A (dev dep)
- [ ] **Local repro verified**: `./repro.sh` passes with new version
- [ ] **Security scan clean**: `ci/security-scan` passes
- [ ] **Required reviewers assigned**: Per CODEOWNERS (auto-assigned)
- [ ] **Auto-merge eligible**: All status checks green, no review changes requested
- [ ] **Hotfix?**: If yes — incident ticket linked: INC-______, revert PR planned by: ________
 
---
 
**Reviewer acknowledgment**: By approving, I confirm I've read the changelog and verified the test coverage for this change.