xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 8 Pull Requests 1 Actions Packages Projects Releases 7 Wiki Activity

fix(security): 移除敏感环境文件的版本追踪并清理硬编码Token
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Has been cancelled
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been cancelled
Details

Browse Source 
- 从版本控制中移除 .env.production 和 .env.staging（git rm --cached）
- 更新 .gitignore：移除 .env.staging 的例外规则，所有 .env 环境文件不再提交
- scripts/ci_failure_check.sh：硬编码 Gitea API Token 改为环境变量 GITEA_API_TOKEN
- scripts/auto_merge_prs.sh：硬编码 Gitea API Token 改为环境变量 GITEA_API_TOKEN

这是对 PR#53 的重新提交，补充了之前遗漏的脚本中硬编码凭证清理。
This commit is contained in:
Security Audit Bot
2026-06-28 09:20:55 +08:00
parent e2c68888e9
commit 1015bf2b13
5 changed files with 4 additions and 174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.production
-85
View File
@@ -1,85 +0,0 @@
# =======================
# 生产环境配置
# =======================
APP_ENV=production
APP_NAME=xiaoxia-saas
APP_VERSION=0.1.0
DEBUG=false
# =======================
# API 服务配置
# =======================
API_HOST=0.0.0.0
API_PORT=8000
API_PREFIX=/api/v1
# =======================
# Web 前端配置
# =======================
WEB_PORT=3000
WEB_URL=https://xiaoxiajianji.com
# =======================
# 数据库配置
# =======================
DATABASE_URL=postgresql+psycopg://postgres:CHANGE_ME@postgres:5432/xiaoxia_saas_production
DATABASE_POOL_SIZE=50
DATABASE_MAX_OVERFLOW=100
DATABASE_POOL_TIMEOUT=30
DATABASE_POOL_RECYCLE=3600
# =======================
# Redis 配置
# =======================
REDIS_URL=redis://redis:6379/0
REDIS_MAX_CONNECTIONS=100
# =======================
# Celery Worker 配置
# =======================
CELERY_BROKER_URL=redis://redis:6379/0
CELERY_RESULT_BACKEND=redis://redis:6379/1
CELERY_WORKER_CONCURRENCY=8
CELERY_WORKER_MAX_TASKS_PER_CHILD=1000
# =======================
# OSS 对象存储配置
# =======================
OSS_ENDPOINT=47.98.113.167:9000
OSS_ACCESS_KEY_ID=CHANGE_ME_PRODUCTION
OSS_ACCESS_KEY_SECRET=CHANGE_ME_PRODUCTION
OSS_BUCKET_NAME=xiaoxia-assets
OSS_SECURE=false
OSS_PUBLIC_URL=http://47.98.113.167:9000
# =======================
# 日志配置
# =======================
LOG_LEVEL=INFO
LOG_FORMAT=json
LOG_FILE=/var/log/xiaoxia-saas/app.log
# =======================
# CORS 配置
# =======================
CORS_ORIGINS=https://xiaoxiajianji.com,https://api.xiaoxiajianji.com
CORS_ALLOW_CREDENTIALS=true
# =======================
# 文件上传限制
# =======================
MAX_UPLOAD_SIZE_MB=2000
ALLOWED_FILE_TYPES=video/mp4,video/quicktime,video/x-msvideo,audio/mpeg,audio/wav,image/jpeg,image/png,image/gif
# =======================
# 安全配置
# =======================
SECRET_KEY=CHANGE_ME_TO_RANDOM_STRING_AT_LEAST_32_CHARS_IN_PRODUCTION
ACCESS_TOKEN_EXPIRE_MINUTES=60
REFRESH_TOKEN_EXPIRE_DAYS=7
# =======================
# 监控与追踪（可选）
# =======================
# SENTRY_DSN=
# PROMETHEUS_PORT=9090
.env.staging
-85
View File
@@ -1,85 +0,0 @@
# =======================
# Staging 环境配置
# =======================
APP_ENV=staging
APP_NAME=xiaoxia-saas
APP_VERSION=0.1.0
DEBUG=true
# =======================
# API 服务配置
# =======================
API_HOST=0.0.0.0
API_PORT=8000
API_PREFIX=/api/v1
# =======================
# Web 前端配置
# =======================
WEB_PORT=3000
WEB_URL=http://47.98.113.167:3001
# =======================
# 数据库配置
# =======================
DATABASE_URL=postgresql+psycopg://postgres:CHANGE_ME_STAGING_DB_PASSWORD@postgres:5432/xiaoxia_saas_staging
DATABASE_POOL_SIZE=20
DATABASE_MAX_OVERFLOW=40
DATABASE_POOL_TIMEOUT=30
DATABASE_POOL_RECYCLE=3600
# =======================
# Redis 配置
# =======================
REDIS_URL=redis://redis:6379/1
REDIS_MAX_CONNECTIONS=50
# =======================
# Celery Worker 配置
# =======================
CELERY_BROKER_URL=redis://redis:6379/1
CELERY_RESULT_BACKEND=redis://redis:6379/2
CELERY_WORKER_CONCURRENCY=4
CELERY_WORKER_MAX_TASKS_PER_CHILD=1000
# =======================
# OSS 对象存储配置
# =======================
OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
OSS_ACCESS_KEY_ID=CHANGE_ME_STAGING
OSS_ACCESS_KEY_SECRET=CHANGE_ME_STAGING
OSS_BUCKET_NAME=xiaoxia-assets
OSS_SECURE=false
OSS_PUBLIC_URL=http://47.98.113.167:9000
# =======================
# 日志配置
# =======================
LOG_LEVEL=DEBUG
LOG_FORMAT=json
LOG_FILE=/var/log/xiaoxia-saas/staging.log
# =======================
# CORS 配置
# =======================
CORS_ORIGINS=http://47.98.113.167:3001,http://47.98.113.167:8001
CORS_ALLOW_CREDENTIALS=true
# =======================
# 文件上传限制
# =======================
MAX_UPLOAD_SIZE_MB=1000
ALLOWED_FILE_TYPES=video/mp4,video/quicktime,video/x-msvideo,audio/mpeg,audio/wav,image/jpeg,image/png,image/gif
# =======================
# 安全配置
# =======================
SECRET_KEY=CHANGE_ME_STAGING_SECRET_KEY
ACCESS_TOKEN_EXPIRE_MINUTES=60
REFRESH_TOKEN_EXPIRE_DAYS=7
# =======================
# 监控与追踪（可选）
# =======================
# SENTRY_DSN=
# PROMETHEUS_PORT=9090
.gitignore
+2 -2
View File
@@ -20,9 +20,9 @@ ruff_cache/
.env
.env.local
.env.development
.env.production # 生产环境配置不提交（包含敏感信息）
.env.production
.env.staging
!.env.example
!.env.staging # staging 配置可以提交
# OS / editor
.DS_Store
scripts/auto_merge_prs.sh
+1 -1
View File
@@ -3,7 +3,7 @@
# 用法: ./scripts/auto_merge_prs.sh [target_branch]
GITEA_API="https://git.xiaoxiajianji.com/api/v1"
TOKEN="1f8058d097e3942a9ed31c44382baf7f08311272"
TOKEN="${GITEA_API_TOKEN:?Please set GITEA_API_TOKEN environment variable}"
REPO="xiaoxia/xiaoxia-saas"
TARGET_BRANCH="${1:-develop}"
scripts/ci_failure_check.sh
+1 -1
View File
@@ -1,7 +1,7 @@
#!/bin/bash
# 检查最近 CI 运行状态，失败时输出告警
GITEA_API="https://git.xiaoxiajianji.com/api/v1"
TOKEN="1f8058d097e3942a9ed31c44382baf7f08311272"
TOKEN="${GITEA_API_TOKEN:?Please set GITEA_API_TOKEN environment variable}"
REPO="xiaoxia/xiaoxia-saas"
echo "=== CI Status Check ==="