fix: #7936 - #7940
fix: #7936#7940diegomodolo wants to merge 15 commits into
Conversation
… workflow for package publishing.
Removed the 'Test' step from the workflow.
…` and introduce base class for endpoints without input models.
|
PR author is not in the allowed authors list. |
|
@dotnet-policy-service agree [company="Néctar Sistemas"] |
|
@dotnet-policy-service agree @dotnet-policy-service agree company="Néctar Sistemas" |
|
@copilot resolve the merge conflicts in this pull request |
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 35183230 | Triggered | Generic High Entropy Secret | 233d15f | src/apps/Elsa.ModularServer.Web/appsettings.json | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
# Conflicts: # src/apps/Elsa.Server.Web/Program.cs
|
Hello @sfmskywalker , there seem to be a problem with my pull request because of a secret uncovered, but I've checked my source code and could not find this secret. |
|
@copilot resolve the merge conflicts in this pull request |
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved critical test compatibility and workflow security findings block approval.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This PR updates FastEndpoints compatibility for .NET 10 and central package management, adapts the resume endpoint to use EmptyRequest, and adds package publishing automation.
Changes:
- Adds an empty-request endpoint abstraction and updates runtime resume.
- Updates package versions and logging references.
- Adjusts Swagger middleware setup.
- Adds a manual package publishing workflow.
File summaries
| File | Summary | Review findings |
|---|---|---|
src/modules/Elsa.Workflows.Api/Endpoints/RuntimeAdmin/Resume/Endpoint.cs |
Uses the new empty-request endpoint base. | Critical: Authorization test endpoint discovery does not support the new generic base. |
src/modules/Elsa.AI.Host/Elsa.AI.Host.csproj |
Adjusts package reference formatting. | No specific final comment. |
src/modules/Elsa.AI.Copilot/Elsa.AI.Copilot.csproj |
Updates logging abstractions version. | No specific final comment. |
src/common/Elsa.Api.Common/Abstractions/Endpoints.cs |
Adds the new endpoint abstraction. | Critical: Authorization test endpoint discovery does not support the new generic base. |
src/apps/Elsa.Server.Web/Program.cs |
Configures Swagger. | Moderate: Registers Swagger middleware twice. |
Directory.Packages.props |
Updates conditional package versions. | No specific final comment. |
.github/workflows/manual_package.yml |
Adds manual package publishing and release automation. | Critical: Unsanitized workflow input permits shell command injection. Moderate: Hard-coded package owner targets an unrelated feed. Nit: Unrelated privileged release automation is included. |
Review details
Suppressed comments (1)
.github/workflows/manual_package.yml:16
- This new publisher is hard-coded to the
nectar-sistemasGitHub Packages owner, while the repository metadata identifieselsa-workflows/elsa-core(Directory.Build.props:6-7) and the existing package workflow publishes to the Elsa feeds (.github/workflows/packages.yml:22-23). Running this workflow for Elsa Core will target an unrelated registry and can fail with the repository-scoped credentials or publish packages to the wrong owner; use the repository's official feed/owner or remove this workflow.
NUGET_SOURCE: https://nuget.pkg.github.com/nectar-sistemas/index.json
- Files reviewed: 6/7 changed files
- Comments generated: 5
- Review effort level: Lite (auto)
Note
Copilot is running an experiment and ran this review at Lite.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| run: > | ||
| dotnet build | ||
| --configuration Release | ||
| -p:Version=${{ github.event.inputs.version }} |
| } | ||
| } | ||
|
|
||
| public abstract class ElsaEndpointWithoutRequest<TRequest, TResponse> : Endpoint<TRequest, TResponse> where TRequest : notnull where TResponse : notnull |
| /// </summary> | ||
| [PublicAPI] | ||
| internal sealed class ResumeEndpoint(IWorkflowRuntimeAdminService admin) : ElsaEndpoint<ResumeRequest, StatusResponse> | ||
| internal sealed class ResumeEndpoint(IWorkflowRuntimeAdminService admin) : ElsaEndpointWithoutRequest<EmptyRequest, StatusResponse> |
| app.UseSwaggerGen(); | ||
| app.UseSwaggerUI(); |
| name: Publish NuGet Packages | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| version: | ||
| description: 'NuGet package version (e.g. 2.0.0)' | ||
| required: true | ||
|
|
||
| permissions: | ||
| contents: write | ||
| packages: write | ||
|
|
||
| env: | ||
| DOTNET_VERSION: "10.0.x" | ||
| NUGET_SOURCE: https://nuget.pkg.github.com/nectar-sistemas/index.json |
|
Triage: needs review — community/non-draft PR on main with no review decision yet. |
Purpose
This PR updates the FastEndpoints package version to fix versions mismatches when using FastEndpoints in a solution with central package management.
Scope
Select one primary concern:
Description
Problem
Elsa was using an old version of FastEndpoints, and when using central package management in a solution it would not work with newer versions.
Besides that, the newer versions of FastEndpoints will throw an exception when using a Request with no public properties, so this PR also addresses that.
Solution
Update the FastEndpoints package version, create another abstract endpoint that will get an EmptyRequest (FastEndpoints solution for request without public properties).
Verification
Steps:
Expected outcome:
Swagger UI with all the endpoints.
Screenshots / Recordings (if applicable)
Commit Convention
We recommend using conventional commit prefixes:
fix:– Bug fixes (behavior change)feat:– New featuresrefactor:– Code changes without behavior changedocs:– Documentation updateschore:– Maintenance, tooling, or dependency updatestest:– Test additions or modificationsClear commit messages make reviews easier and history more meaningful.
Checklist