feat: fundação cívica (eventos/evidências/fluxos) + bot anti-vazamento - #36
Conversation
Protege a chave da API do Portal da Transparência (e qualquer segredo) de vazar pro GitHub, em três camadas: 1. .githooks/pre-commit — bloqueia na máquina, antes do push (zero dependência) 2. .gitleaks.toml + job 'secrets' no CI — varre todo PR; regra custom da chave do Portal + regras padrão (AWS, GitHub, etc); bloqueia o merge se achar 3. (já ativo no repo) GitHub secret scanning + push protection CONTRIBUTING documenta `git config core.hooksPath .githooks`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Modelo canônico de transparência (codex/fundacao-civica-eventos): - db: civic_events, evidence, entity_relationships, money_flows, source_coverage + enums; migration 0004; sources inclui camara-americana - PNCP: transform com type guard compra/contrato; mapper no payload real (niFornecedor, numeroControlePNCP); 578 contratos → eventos/evidências/fluxos - TCE-SP: adapter na API oficial atual (despesas/receitas), ingestMany em lote; 124.795 despesas + 4.074 receitas → 128.865 eventos/evidências; PF comum não vira entidade pública (só CNPJ completo) - Diário/átomos: segmentação indefinido + extração de território; 273 eventos - source_coverage: 12 linhas (PNCP, TCE-SP, Diário, Querido Diário, Transparência, Câmara, CEIS/CNEP, BrasilAPI/QSA, TSE) - Linguagem pública: sai "família no poder", entra "vínculos documentados" Validado local com Docker/Postgres: migrate, seed, check, typecheck, lint, build. Co-Authored-By: Codex <noreply@openai.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| name: secrets | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 # histórico completo para o gitleaks varrer todos os commits | ||
|
|
||
| - name: Gitleaks (varredura de segredos) | ||
| uses: gitleaks/gitleaks-action@v2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| # Grátis para repositórios públicos e pessoais (não precisa de licença). | ||
| GITLEAKS_CONFIG: .gitleaks.toml |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 389b4919ee
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| eq(sanctions.sourceId, "cgu-transparencia"), | ||
| eq(sanctions.cadastro, cadastro.toUpperCase()), | ||
| eq(sanctions.documento, doc), | ||
| eq(sanctions.tipoSancao, it.tipoSancao?.descricaoResumida ?? ""), |
There was a problem hiding this comment.
When a supplier has multiple CEIS/CNEP sanctions in the same cadastro with the same tipoSancao but different start dates or sanctioning bodies, this coarse existence check treats the later records as duplicates and skips inserting them into sanctions. The event key above already includes date and órgão, so the sanctions table should use equivalent fields (or a stored source key) to avoid dropping official sanction records.
Useful? React with 👍 / 👎.
| .where(eq(evidence.evidenceKey, input.evidenceKey)) | ||
| .limit(1); | ||
|
|
||
| if (existing[0]) return existing[0].id; |
There was a problem hiding this comment.
If an upstream record changes under the same natural key, raw_records intentionally appends a new version and upsertCivicEvent updates the event, but this early return leaves the existing evidence pointing at the old rawRecordId, sourceUrl, and excerpt. In that re-ingest scenario the public evidence trail becomes stale even though the event was refreshed, so existing evidence should be updated with the new input before returning.
Useful? React with 👍 / 👎.
2 participants
O que muda
Duas entregas que vão juntas para o
main:🛡️ Bot anti-vazamento de segredos (3 camadas)
.githooks/pre-commit— bloqueia segredos na máquina, antes do push.gitleaks.toml+ jobsecretsno CI — varre cada PR (regra custom da chave do Portal da Transparência)🏛️ Fundação cívica (modelo canônico de transparência)
civic_events,evidence,entity_relationships,money_flows,source_coverage+ enums; migration 0004source_coverageValidação
Codex validou local com Docker/Postgres: migrate, seed, check, typecheck, lint, build.
Pendências conhecidas (próximos PRs)
partial(exige modalidade no endpoint)Tipo