feat: portal de producto, saneamiento e integridad #21
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| # GitGuardian — plantillas de instalación (no son secretos de producción) | ||
| version: 2 | ||
| path_exclusions: | ||
| - configs/*.json | ||
| secret_exclusions: | ||
| - name: Install profile placeholders | ||
| matches: | ||
| - name: Generic Password | ||
| paths: | ||
| - configs/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -101,6 +101,40 @@ jobs: | |
| - name: Run frontend tests | ||
| run: cd portal/frontend && npm test | ||
|
|
||
| - name: Install axe-core for a11y smoke | ||
| run: cd portal/frontend && npm install --no-save axe-core jsdom | ||
|
|
||
| - name: Accessibility smoke (axe on landing markup) | ||
| run: | | ||
| cd portal/frontend | ||
| node <<'NODE' | ||
| const { JSDOM } = require('jsdom'); | ||
| const fs = require('fs'); | ||
| const axeSource = fs.readFileSync(require.resolve('axe-core/axe.js'), 'utf8'); | ||
| const html = `<!DOCTYPE html><html lang="es"><head><title>NEUBAT</title></head> | ||
| <body class="dark"> | ||
| <a href="#contenido" class="skip-link">Saltar al contenido</a> | ||
| <header><nav aria-label="Principal"><a href="/">Inicio</a></nav></header> | ||
| <main id="contenido"><h1>NEUBAT: tu Arch, tu ISO, tu red</h1> | ||
| <p>Configura desde el navegador una instalación desatendida.</p> | ||
| <a href="/configurar">Configurar instalación</a></main> | ||
| <footer>NEUBAT</footer> | ||
| </body></html>`; | ||
| const dom = new JSDOM(html, { runScripts: 'dangerously', pretendToBeVisual: true }); | ||
| const { window } = dom; | ||
| window.eval(axeSource); | ||
| window.axe.run(window.document, { runOnly: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'] }) | ||
|
Comment on lines
+123
to
+126
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift Use a browser to check landing-page color contrast. The landing page’s OKLCH/WCAG objective includes contrast, but axe documents that its 🧰 Tools🪛 zizmor (1.30.0)[warning] 1-156: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) [warning] 85-136: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block (excessive-permissions) 🤖 Prompt for AI Agents |
||
| .then((results) => { | ||
| const serious = results.violations.filter(v => ['critical', 'serious'].includes(v.impact)); | ||
| if (serious.length) { | ||
| console.error(JSON.stringify(serious, null, 2)); | ||
| process.exit(1); | ||
| } | ||
| console.log('axe: sin violaciones critical/serious'); | ||
| }) | ||
| .catch((err) => { console.error(err); process.exit(1); }); | ||
| NODE | ||
|
|
||
| build-frontend: | ||
| runs-on: ubuntu-latest | ||
| needs: validate | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,30 @@ | ||||||
| { | ||||||
| "version": "1.0.0", | ||||||
| "hostname": "neubat-min", | ||||||
| "username": "neubat", | ||||||
| "password": "", | ||||||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🛡️ Detected with Advanced Tier | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: set -eu
printf '%s\n' '--- changed profile hunks ---'
git diff --unified=20 e2cb5f7f7359fbbfb08e448ee6ee080aebbaf458 566dfd3f16c0460f94116ecb1ad34b313eb6ab12 -- configs/minimal.json configs/vm-luks.json
printf '%s\n' '--- final profile files ---'
git show 566dfd3f16c0460f94116ecb1ad34b313eb6ab12:configs/minimal.json
git show 566dfd3f16c0460f94116ecb1ad34b313eb6ab12:configs/vm-luks.json
printf '%s\n' '--- bound symbols and calls ---'
rg -n -C 8 'password|PASSWORD|chpasswd|default-password|neubat' portal/routes/install.js portal/lib/archinstall.js scripts/20-archinstall.shRepository: Alexendros/neubat Length of output: 15812 🏁 Script executed: set -eu
printf '%s\n' '--- password consumers ---'
rg -n -C 12 'chpasswd|passwd[[:space:]]|PASSWORD|USER(NAME)?' scripts portal --glob '!20-archinstall.sh' --glob '20-archinstall.sh'
printf '%s\n' '--- shell script continuation ---'
sed -n '145,260p' scripts/20-archinstall.sh
printf '%s\n' '--- config reader definition ---'
rg -n -C 12 'cfg_get[[:space:]]*\(' scriptsRepository: Alexendros/neubat Length of output: 7689 🏁 Script executed: set -eu
printf '%s\n' '--- exact credential-setting bindings ---'
rg -n -C 8 'chpasswd|passwd[[:space:]]|useradd|usermod|root_enc_password|!password|PASSWORD' --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' .Repository: Alexendros/neubat Length of output: 6495 Broken Authentication Reachability: Internal Use the default password placeholder in both profiles. The manual post-install path passes Use the existing default-password placeholder--- a/configs/minimal.json
+++ b/configs/minimal.json
@@
- "password": "",
+ "password": "neubat",--- a/configs/vm-luks.json
+++ b/configs/vm-luks.json
@@
- "password": "",
+ "password": "neubat",📝 Committable suggestion
Suggested change
📍 Affects 2 files
🤖 Prompt for AI Agents |
||||||
| "disk": "/dev/sda", | ||||||
| "desktop": "none", | ||||||
| "packages": [ | ||||||
| "vim", | ||||||
| "htop" | ||||||
| ], | ||||||
| "aur_packages": [], | ||||||
| "services": [ | ||||||
| "NetworkManager", | ||||||
| "sshd" | ||||||
| ], | ||||||
| "timezone": "Europe/Madrid", | ||||||
| "locale": "es_ES.UTF-8", | ||||||
| "keyboard": "es", | ||||||
| "encryption": { | ||||||
| "enabled": false, | ||||||
| "method": "keyfile", | ||||||
| "passphrase": "", | ||||||
| "cipher": "aes-xts-plain64", | ||||||
| "key_size": 512 | ||||||
| }, | ||||||
| "snapshots": { | ||||||
| "enabled": false | ||||||
| } | ||||||
| } | ||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| { | ||
| "version": "1.0.0", | ||
| "hostname": "neubat-vm-luks", | ||
| "username": "neubat", | ||
| "password": "", | ||
| "disk": "/dev/nvme0n1", | ||
| "desktop": "none", | ||
| "packages": [ | ||
| "htop", | ||
| "git", | ||
| "curl", | ||
| "openssh" | ||
| ], | ||
| "services": [ | ||
| "NetworkManager", | ||
| "sshd" | ||
| ], | ||
| "timezone": "Europe/Madrid", | ||
| "locale": "es_ES.UTF-8", | ||
| "keyboard": "es", | ||
| "encryption": { | ||
| "enabled": true, | ||
| "method": "keyfile", | ||
| "passphrase": "", | ||
| "cipher": "aes-xts-plain64", | ||
| "key_size": 512 | ||
| }, | ||
| "snapshots": { | ||
| "enabled": true, | ||
| "cleanup": { | ||
| "hourly": 2, | ||
| "daily": 3, | ||
| "weekly": 1, | ||
| "monthly": 1 | ||
| } | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Test the rendered landing page, not a fixed HTML sample.
This HTML does not come from
LandingPage. A change to the landing page can introduce an accessibility violation while this CI step continues to pass. Render the component or load the built page before running axe.🧰 Tools
🪛 zizmor (1.30.0)
[warning] 1-156: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[warning] 85-136: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents