From 53c31d435d0cd6d72ab998e7fd55c498fda87cd2 Mon Sep 17 00:00:00 2001
From: xiaoxia <dev@xiaoxiajianji.com>
Date: Mon, 13 Jul 2026 15:20:52 +0800
Subject: [PATCH] feat(ci): add npm audit (high) to frontend-lint job (warning
 mode)

---
 .gitea/workflows/ci-cd.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 90caef5ae..fdfcde4ea 100755
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -266,6 +266,28 @@ jobs:
             -w /workspace/apps/web \
             docker.m.daocloud.io/library/node:20 \
             sh -lc 'npx vitest run src/test'
+
+      - name: Run npm audit (high severity)
+        continue-on-error: true
+        shell: sh
+        run: |
+          set +e
+          echo "=== npm audit 检查 (high 级别及以上) ==="
+          docker run --rm \
+            -v "$PWD:/workspace" \
+            -w /workspace/apps/web \
+            docker.m.daocloud.io/library/node:20 \
+            sh -lc 'npm audit --audit-level=high'
+          AUDIT_EXIT=$?
+          if [ "$AUDIT_EXIT" -ne 0 ]; then
+            echo ""
+            echo "⚠️  npm audit 发现 high 级别漏洞，请关注（当前为告警模式，不阻断 CI）"
+            echo "建议后续根据存量漏洞情况决定是否设置为阻断"
+          else
+            echo "✅ npm audit 未发现 high 级别漏洞"
+          fi
+          exit 0
+
   deploy-staging:
     name: Build & Push Staging (Watchtower auto-deploy)
     runs-on: saas