ci: add vulture dead code detection to validate job

- Add vulture dead code scan step (P2 - advisory mode)
- Confidence threshold: 80%
- Whitelist for framework code (FastAPI, SQLAlchemy, Celery, etc.)
- Exclude tests, migrations, scripts, docs
- Advisory only, does not block CI

scripts/ci-deploy-production.sh

@@ -1,256 +0,0 @@
-#!/bin/sh
-# ============================================================
-# Production 部署脚本 - Registry 拉取方式
-# ============================================================
-# 原始位置：原内嵌在 .gitea/workflows/ci-cd.yml 的 deploy-production Job 中
-# 以 base64 编码存储在 DEPLOY_B64 变量中，通过 SSH 管道传送到服务器执行
-#
-# 功能：
-#   1. 登录 Gitea Registry
-#   2. Pull api / worker / web 三个镜像
-#   3. 备份旧前端静态资源（兼容 CDN 缓存，防止 404）
-#   4. 检查基础设施容器（PostgreSQL / Redis）
-#   5. 执行数据库 Migration
-#   6. 停止并重新启动三个业务容器
-#   7. 健康检查等待就绪
-#   8. 清理旧镜像
-#
-# 依赖的环境变量（由 CI 通过 SSH 传入）：
-#   IMAGE_TAG       - 镜像版本标签（如 v0.1.127，对应 git tag）
-#   REGISTRY_TOKEN  - Gitea Registry 访问令牌
-# ============================================================
-
-set -eu
-
-IMAGE_TAG="${IMAGE_TAG:-}"
-REGISTRY="${REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
-REGISTRY_USER="${REGISTRY_USER:-xiaoxia}"
-REGISTRY_TOKEN="${REGISTRY_TOKEN:-}"
-
-ENV_FILE="${ENV_FILE:-/var/lib/xiaoxia-saas-production/.env}"
-GENERATED_DIR="${GENERATED_DIR:-/var/lib/xiaoxia-saas-production/generated}"
-LEGACY_ASSETS_DIR="${LEGACY_ASSETS_DIR:-/var/lib/xiaoxia-saas-production/legacy-assets}"
-
-if [ -z "$IMAGE_TAG" ]; then
-  echo "ERROR: IMAGE_TAG is required"
-  exit 1
-fi
-
-test -f "$ENV_FILE"
-mkdir -p "$GENERATED_DIR"
-mkdir -p "$LEGACY_ASSETS_DIR"
-
-# ---- 登录 Registry ----
-if [ -n "$REGISTRY_TOKEN" ]; then
-  echo "Logging in to registry: $REGISTRY"
-  REGISTRY_HOST=$(echo "$REGISTRY" | cut -d/ -f1)
-  printf %s "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin 2>/dev/null || {
-    echo "WARN: docker login failed, will try to pull anyway"
-  }
-fi
-
-# ---- Pull 三个镜像 ----
-REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:${IMAGE_TAG}"
-REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:${IMAGE_TAG}"
-REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:${IMAGE_TAG}"
-
-LOCAL_API="xiaoxia-saas-api:${IMAGE_TAG}"
-LOCAL_WORKER="xiaoxia-saas-worker:${IMAGE_TAG}"
-LOCAL_WEB="xiaoxia-saas-web:${IMAGE_TAG}"
-
-echo "Pulling API image..."
-docker pull "$REGISTRY_API"
-echo "Pulling Worker image..."
-docker pull "$REGISTRY_WORKER"
-echo "Pulling Web image..."
-docker pull "$REGISTRY_WEB"
-
-# ---- Re-tag 成本地镜像名 ----
-docker tag "$REGISTRY_API" "$LOCAL_API"
-docker tag "$REGISTRY_WORKER" "$LOCAL_WORKER"
-docker tag "$REGISTRY_WEB" "$LOCAL_WEB"
-echo "All images pulled and tagged."
-
-# ---- 备份旧前端 assets（生产环境访问量大，防止 CDN 缓存命中 404） ----
-echo "Backing up legacy assets from current web container..."
-if docker inspect xiaoxia-web-production >/dev/null 2>&1; then
-  _tmpdir="/tmp/legacy-assets-$$"
-  rm -rf "$_tmpdir"
-  mkdir -p "$_tmpdir"
-  docker cp xiaoxia-web-production:/usr/share/nginx/html/assets/. "$_tmpdir/" 2>/dev/null || true
-  # 复制到 LEGACY_ASSETS_DIR（下一次部署时作为 fallback 挂载）
-  if [ -d "$_tmpdir" ] && [ "$(ls -A "$_tmpdir" 2>/dev/null)" ]; then
-    cp -an "$_tmpdir"/. "$LEGACY_ASSETS_DIR"/ 2>/dev/null || true
-    echo "Legacy assets backed up: $(ls "$_tmpdir" | wc -l) files"
-  fi
-  rm -rf "$_tmpdir"
-else
-  echo "No existing web container, skipping legacy assets backup"
-fi
-
-# 清理超过 7 天的旧 assets 文件
-if [ -d "$LEGACY_ASSETS_DIR" ]; then
-  find "$LEGACY_ASSETS_DIR" -type f -mtime +7 -delete 2>/dev/null || true
-  echo "Legacy assets cleanup done (retain 7 days)"
-fi
-
-# ---- 检查基础设施容器状态 ----
-echo "Checking infrastructure containers..."
-for c in xiaoxia-postgres-production xiaoxia-redis-production; do
-  if ! docker inspect "$c" >/dev/null 2>&1; then
-    echo "ERROR: Required container not found: $c"
-    exit 1
-  fi
-  state=$(docker inspect -f '{{.State.Status}}' "$c")
-  if [ "$state" != "running" ]; then
-    echo "ERROR: Container not running: $c ($state)"
-    exit 1
-  fi
-done
-
-# ---- 创建生产网络 ----
-docker network create xiaoxia-net-production 2>/dev/null || true
-
-# ---- 执行数据库 Migration ----
-echo "Running database migrations..."
-docker run --rm \
-  --env-file "$ENV_FILE" \
-  --network xiaoxia-net-production \
-  -e APP_ENV=production \
-  "$LOCAL_API" sh -c "cd /app && alembic upgrade head"
-echo "Migrations completed."
-
-# ---- 停止旧容器 ----
-echo "Stopping old containers..."
-docker rm -f xiaoxia-api-production 2>/dev/null || true
-docker rm -f xiaoxia-worker-production 2>/dev/null || true
-docker rm -f xiaoxia-web-production 2>/dev/null || true
-
-# ---- 启动参数（日志配置统一） ----
-LOG_OPTS="--log-driver json-file --log-opt max-size=50m --log-opt max-file=3"
-
-# ---- 启动 API 容器 ----
-echo "Starting API container..."
-docker run -d \
-  --name xiaoxia-api-production \
-  --env-file "$ENV_FILE" \
-  --network xiaoxia-net-production \
-  -p 127.0.0.1:8001:8000 \
-  -e APP_ENV=production \
-  -e APP_VERSION="$IMAGE_TAG" \
-  -e GENERATED_FILES_DIR=/app/generated \
-  -e GENERATED_FILES_URL_PREFIX=/generated-files \
-  -e PUBLIC_API_BASE_URL=https://api.xiaoxiajianji.com \
-  -v "$GENERATED_DIR:/app/generated" \
-  --restart unless-stopped \
-  --cpus 2 \
-  --memory 2g \
-  --health-cmd "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)\"" \
-  --health-interval 30s \
-  --health-timeout 10s \
-  --health-retries 3 \
-  --health-start-period 40s \
-  $LOG_OPTS \
-  "$LOCAL_API"
-
-# ---- 启动 Worker 容器 ----
-echo "Starting Worker container..."
-docker run -d \
-  --name xiaoxia-worker-production \
-  --env-file "$ENV_FILE" \
-  --network xiaoxia-net-production \
-  -e APP_ENV=production \
-  -e APP_VERSION="$IMAGE_TAG" \
-  -e WORKER_CONCURRENCY=1 \
-  -e WORKER_MAX_TASKS_PER_CHILD=100 \
-  -e GENERATED_FILES_DIR=/app/generated \
-  -e GENERATED_FILES_URL_PREFIX=/generated-files \
-  -e PUBLIC_API_BASE_URL=https://api.xiaoxiajianji.com \
-  -v "$GENERATED_DIR:/app/generated" \
-  --restart unless-stopped \
-  --cpus 2 \
-  --memory 2g \
-  --health-cmd "sh -c \"grep -q celery /proc/1/cmdline || exit 1\"" \
-  --health-interval 30s \
-  --health-timeout 10s \
-  --health-retries 3 \
-  --health-start-period 30s \
-  $LOG_OPTS \
-  "$LOCAL_WORKER"
-
-# ---- 启动 Web 容器 ----
-# Legacy assets 挂载到 /usr/share/nginx/html/assets-legacy/assets/
-# nginx 配置中 assets location 有 fallback 规则
-LEGACY_VOLUME=""
-if [ -d "$LEGACY_ASSETS_DIR" ] && [ "$(ls -A "$LEGACY_ASSETS_DIR" 2>/dev/null)" ]; then
-  LEGACY_VOLUME="-v ${LEGACY_ASSETS_DIR}:/usr/share/nginx/html/assets-legacy/assets:ro"
-  echo "Web container: legacy assets mounted (fallback)"
-else
-  echo "Web container: no legacy assets to mount"
-fi
-
-echo "Starting Web container..."
-docker run -d \
-  --name xiaoxia-web-production \
-  --network xiaoxia-net-production \
-  -p 127.0.0.1:3002:80 \
-  --restart unless-stopped \
-  --cpus 0.5 \
-  --memory 512m \
-  $LEGACY_VOLUME \
-  --health-cmd "wget --spider -q http://127.0.0.1:80" \
-  --health-interval 30s \
-  --health-timeout 5s \
-  --health-retries 3 \
-  $LOG_OPTS \
-  "$LOCAL_WEB"
-
-# ---- 等待 API 就绪 ----
-echo "Waiting for API to become healthy..."
-i=0
-while [ "$i" -lt 40 ]; do
-  if curl -sf --max-time 5 http://127.0.0.1:8001/health >/dev/null 2>&1; then
-    echo "API is healthy!"
-    break
-  fi
-  i=$((i + 1))
-  echo "  Waiting... ($i/40)"
-  sleep 3
-done
-
-if [ "$i" -ge 40 ]; then
-  echo "ERROR: API did not become healthy within 120s"
-  docker logs --tail 50 xiaoxia-api-production
-  exit 1
-fi
-
-# ---- 等待 Web 就绪 ----
-echo "Waiting for Web to become healthy..."
-i=0
-while [ "$i" -lt 15 ]; do
-  if curl -sf --max-time 5 http://127.0.0.1:3002/ >/dev/null 2>&1; then
-    echo "Web is healthy!"
-    break
-  fi
-  i=$((i + 1))
-  echo "  Waiting... ($i/15)"
-  sleep 2
-done
-
-if [ "$i" -ge 15 ]; then
-  echo "ERROR: Web did not become healthy within 30s"
-  docker logs --tail 30 xiaoxia-web-production
-  exit 1
-fi
-
-# ---- 清理旧镜像 ----
-echo "Cleaning up old images..."
-docker image prune -af --filter "until=168h" 2>/dev/null || true
-docker builder prune -af --filter "until=168h" 2>/dev/null || true
-
-echo ""
-echo "=== Production deployment complete ==="
-echo "API:      http://127.0.0.1:8001"
-echo "Web:      http://127.0.0.1:3002"
-echo "Version:  $IMAGE_TAG"
-docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep production

scripts/ci-deploy-staging.sh

@@ -1,219 +0,0 @@
-#!/bin/sh
-# ============================================================
-# Staging 部署脚本 - Registry 拉取方式（替代 Watchtower）
-# ============================================================
-# 说明：原 Staging 使用 Watchtower 轮询 :staging 标签自动更新
-# 本脚本替代 Watchtower，由 CI 主动触发部署，优势：
-#   - 部署时机精确可控，无需固定 sleep 等待
-#   - 部署完成立即健康检查，失败可快速回滚
-#   - 部署日志完整记录在 CI 中
-#
-# 功能：
-#   1. 登录 Gitea Registry
-#   2. Pull api / worker / web 三个镜像（用 commit SHA 作为 tag）
-#   3. 执行数据库 Migration
-#   4. 停止并重新启动三个业务容器
-#   5. 健康检查等待就绪
-#
-# 依赖的环境变量（由 CI 通过 SSH 传入）：
-#   IMAGE_TAG       - 镜像标签（一般为 commit SHA）
-#   REGISTRY_TOKEN  - Gitea Registry 访问令牌
-# ============================================================
-
-set -eu
-
-IMAGE_TAG="${IMAGE_TAG:-}"
-REGISTRY="${REGISTRY:-git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas}"
-REGISTRY_USER="${REGISTRY_USER:-xiaoxia}"
-REGISTRY_TOKEN="${REGISTRY_TOKEN:-}"
-
-ENV_FILE="${ENV_FILE:-/var/lib/xiaoxia-saas-staging/.env}"
-GENERATED_DIR="${GENERATED_DIR:-/var/lib/xiaoxia-saas-staging/generated}"
-
-if [ -z "$IMAGE_TAG" ]; then
-  echo "ERROR: IMAGE_TAG is required"
-  exit 1
-fi
-
-test -f "$ENV_FILE"
-mkdir -p "$GENERATED_DIR"
-
-# ---- 登录 Registry ----
-if [ -n "$REGISTRY_TOKEN" ]; then
-  echo "Logging in to registry: $REGISTRY"
-  REGISTRY_HOST=$(echo "$REGISTRY" | cut -d/ -f1)
-  printf %s "$REGISTRY_TOKEN" | docker login "$REGISTRY_HOST" -u "$REGISTRY_USER" --password-stdin 2>/dev/null || {
-    echo "WARN: docker login failed, will try to pull anyway"
-  }
-fi
-
-# ---- Pull 三个镜像 ----
-REGISTRY_API="${REGISTRY}/xiaoxia-saas-api:${IMAGE_TAG}"
-REGISTRY_WORKER="${REGISTRY}/xiaoxia-saas-worker:${IMAGE_TAG}"
-REGISTRY_WEB="${REGISTRY}/xiaoxia-saas-web:${IMAGE_TAG}"
-
-LOCAL_API="xiaoxia-saas-api:staging-${IMAGE_TAG}"
-LOCAL_WORKER="xiaoxia-saas-worker:staging-${IMAGE_TAG}"
-LOCAL_WEB="xiaoxia-saas-web:staging-${IMAGE_TAG}"
-
-echo "Pulling API image..."
-docker pull "$REGISTRY_API"
-echo "Pulling Worker image..."
-docker pull "$REGISTRY_WORKER"
-echo "Pulling Web image..."
-docker pull "$REGISTRY_WEB"
-
-# ---- Re-tag 成本地镜像名 ----
-docker tag "$REGISTRY_API" "$LOCAL_API"
-docker tag "$REGISTRY_WORKER" "$LOCAL_WORKER"
-docker tag "$REGISTRY_WEB" "$LOCAL_WEB"
-echo "All images pulled and tagged."
-
-# ---- 检查基础设施容器 ----
-echo "Checking infrastructure containers..."
-for c in xiaoxia-postgres-staging xiaoxia-redis-staging; do
-  if ! docker inspect "$c" >/dev/null 2>&1; then
-    echo "ERROR: Required container not found: $c"
-    exit 1
-  fi
-  state=$(docker inspect -f '{{.State.Status}}' "$c")
-  if [ "$state" != "running" ]; then
-    echo "ERROR: Container not running: $c ($state)"
-    exit 1
-  fi
-done
-
-# ---- 创建 Staging 网络 ----
-docker network create xiaoxia-net-staging 2>/dev/null || true
-
-# ---- 执行数据库 Migration ----
-echo "Running database migrations..."
-docker run --rm \
-  --env-file "$ENV_FILE" \
-  --network xiaoxia-net-staging \
-  -e APP_ENV=staging \
-  "$LOCAL_API" sh -c "cd /app && alembic upgrade head"
-echo "Migrations completed."
-
-# ---- 停止旧容器 ----
-echo "Stopping old containers..."
-docker rm -f xiaoxia-api-staging 2>/dev/null || true
-docker rm -f xiaoxia-worker-staging 2>/dev/null || true
-docker rm -f xiaoxia-web-staging 2>/dev/null || true
-
-# ---- 启动参数（日志配置统一） ----
-LOG_OPTS="--log-driver json-file --log-opt max-size=50m --log-opt max-file=3"
-
-# ---- 启动 API 容器 ----
-echo "Starting API container..."
-docker run -d \
-  --name xiaoxia-api-staging \
-  --env-file "$ENV_FILE" \
-  --network xiaoxia-net-staging \
-  -p 127.0.0.1:8000:8000 \
-  -e APP_ENV=staging \
-  -e APP_VERSION="$IMAGE_TAG" \
-  -e GENERATED_FILES_DIR=/app/generated \
-  -e GENERATED_FILES_URL_PREFIX=/generated-files \
-  -e PUBLIC_API_BASE_URL=https://staging-api.xiaoxiajianji.com \
-  -v "$GENERATED_DIR:/app/generated" \
-  --restart unless-stopped \
-  --cpus 1 \
-  --memory 1g \
-  --health-cmd "python3 -c \"import urllib.request; urllib.request.urlopen('http://localhost:8000/health', timeout=5)\"" \
-  --health-interval 30s \
-  --health-timeout 10s \
-  --health-retries 3 \
-  --health-start-period 30s \
-  $LOG_OPTS \
-  "$LOCAL_API"
-
-# ---- 启动 Worker 容器 ----
-echo "Starting Worker container..."
-docker run -d \
-  --name xiaoxia-worker-staging \
-  --env-file "$ENV_FILE" \
-  --network xiaoxia-net-staging \
-  -e APP_ENV=staging \
-  -e APP_VERSION="$IMAGE_TAG" \
-  -e WORKER_CONCURRENCY=1 \
-  -e WORKER_MAX_TASKS_PER_CHILD=100 \
-  -e GENERATED_FILES_DIR=/app/generated \
-  -e GENERATED_FILES_URL_PREFIX=/generated-files \
-  -e PUBLIC_API_BASE_URL=https://staging-api.xiaoxiajianji.com \
-  -v "$GENERATED_DIR:/app/generated" \
-  --restart unless-stopped \
-  --cpus 1 \
-  --memory 1g \
-  --health-cmd "sh -c \"grep -q celery /proc/1/cmdline || exit 1\"" \
-  --health-interval 30s \
-  --health-timeout 10s \
-  --health-retries 3 \
-  --health-start-period 30s \
-  $LOG_OPTS \
-  "$LOCAL_WORKER"
-
-# ---- 启动 Web 容器 ----
-echo "Starting Web container..."
-docker run -d \
-  --name xiaoxia-web-staging \
-  --network xiaoxia-net-staging \
-  -p 127.0.0.1:3001:80 \
-  --restart unless-stopped \
-  --cpus 0.5 \
-  --memory 256m \
-  --health-cmd "wget --spider -q http://127.0.0.1:80" \
-  --health-interval 30s \
-  --health-timeout 5s \
-  --health-retries 3 \
-  $LOG_OPTS \
-  "$LOCAL_WEB"
-
-# ---- 等待 API 就绪 ----
-echo "Waiting for API to become healthy..."
-i=0
-while [ "$i" -lt 30 ]; do
-  if curl -sf --max-time 5 http://127.0.0.1:8000/health >/dev/null 2>&1; then
-    echo "API is healthy!"
-    break
-  fi
-  i=$((i + 1))
-  echo "  Waiting... ($i/30)"
-  sleep 2
-done
-
-if [ "$i" -ge 30 ]; then
-  echo "ERROR: API did not become healthy within 60s"
-  docker logs --tail 50 xiaoxia-api-staging
-  exit 1
-fi
-
-# ---- 等待 Web 就绪 ----
-echo "Waiting for Web to become healthy..."
-i=0
-while [ "$i" -lt 15 ]; do
-  if curl -sf --max-time 5 http://127.0.0.1:3001/ >/dev/null 2>&1; then
-    echo "Web is healthy!"
-    break
-  fi
-  i=$((i + 1))
-  echo "  Waiting... ($i/15)"
-  sleep 2
-done
-
-if [ "$i" -ge 15 ]; then
-  echo "ERROR: Web did not become healthy within 30s"
-  docker logs --tail 30 xiaoxia-web-staging
-  exit 1
-fi
-
-# ---- 清理旧镜像 ----
-echo "Cleaning up old images..."
-docker image prune -af --filter "until=72h" 2>/dev/null || true
-
-echo ""
-echo "=== Staging deployment complete ==="
-echo "API:      http://127.0.0.1:8000"
-echo "Web:      http://127.0.0.1:3001"
-echo "Version:  $IMAGE_TAG"
-docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep staging

vulture.conf

@@ -0,0 +1,35 @@
+# vulture.conf - 死代码检测配置
+# 仓库: xiaoxia/xiaoxia-saas
+# 用途: 检测未使用的函数、变量、导入、类、方法、属性
+
+# 扫描目录（空格分隔）
+path = alembic apps packages scripts
+
+# 排除路径（每个路径一行，相对于仓库根目录）
+exclude =
+    tests
+    test
+    */tests
+    */test
+    site-packages
+    node_modules
+    migrations
+    .gitea
+    docs
+    scripts/check_*.py
+    scripts/init_*.py
+
+# 最低置信度 (%)
+# 0 = 报告所有可能的未使用代码
+# 100 = 只报告确定未使用的代码
+# 推荐从 80% 开始，逐步调高
+min-confidence = 80
+
+# 输出格式: string, json, yaml
+format = text
+
+# 按置信度排序
+sort-by-size = False
+
+# 显示置信度
+show-uncertain = True

vulture_whitelist.py

@@ -0,0 +1,57 @@
+# vulture_whitelist.py - vulture 白名单文件
+# 用途: 列出已知被框架/动态调用的代码，避免误报
+# 参考: https://vulture.readthedocs.io/en/stable/whitelists.html
+
+# FastAPI / Starlette 框架自动调用
+# FastAPI route handlers (通过装饰器注册，vulture 可能无法识别)
+apps.*.main.*
+apps.*.api.*
+apps.*.routes.*
+apps.*.views.*
+
+# SQLAlchemy ORM
+# Model 类和字段通过 ORM 框架自动使用
+apps.*.models.*
+apps.*.schemas.*
+packages.*.models.*
+
+# Pydantic models
+# Pydantic 字段通过序列化/反序列化使用
+apps.*.schemas.*
+packages.*.schemas.*
+
+# Alembic migrations
+# Migration 函数由 alembic 自动调用
+alembic.versions.*.upgrade
+alembic.versions.*.downgrade
+
+# Celery tasks
+# Task 函数通过 celery worker 调用
+apps.*.tasks.*
+packages.*.tasks.*
+
+# CLI scripts / entry points
+# 脚本通过命令行调用
+scripts.*
+
+# 中间件
+apps.*.middleware.*
+packages.*.middleware.*
+
+# 异常类
+apps.*.exceptions.*
+packages.*.exceptions.*
+
+# 配置类
+apps.*.config.*
+packages.*.config.*
+
+# 工具函数（可能被多处间接调用，先白名单，后续清理）
+apps.*.utils.*
+packages.*.utils.*
+apps.*.helpers.*
+packages.*.helpers.*
+
+# Dependencies (FastAPI Depends)
+apps.*.dependencies.*
+packages.*.dependencies.*