ci: add vulture dead code detection to validate job

- Add vulture dead code scan step (P2 - advisory mode)
- Confidence threshold: 80%
- Whitelist for framework code (FastAPI, SQLAlchemy, Celery, etc.)
- Exclude tests, migrations, scripts, docs
- Advisory only, does not block CI

.gitea/workflows/ci-cd.yml

@@ -112,6 +112,39 @@ jobs:
           set -eu
           bandit -r apps packages -q -ll
 
+
+      - name: Dead code detection (vulture)
+        shell: sh
+        run: |
+          set -eu
+          echo "=== Installing vulture ==="
+          python3 -m pip install -q vulture
+          vulture --version
+          echo ""
+          echo "=== Running vulture dead code scan ==="
+          echo "Confidence threshold: 80%"
+          echo "Mode: advisory (not blocking CI)"
+          echo ""
+          # 运行 vulture，使用配置文件和白名单
+          set +e
+          vulture             --config vulture.conf             --min-confidence 80             --sort-by-size             > /tmp/vulture-report.txt
+          VULTURE_EXIT=$?
+          set -e
+          # 显示结果
+          cat /tmp/vulture-report.txt
+          echo ""
+          # 统计
+          DEAD_CODE_COUNT=$(grep -c ':' /tmp/vulture-report.txt 2>/dev/null || echo 0)
+          echo "=== Summary ==="
+          echo "Total findings: $DEAD_CODE_COUNT"
+          echo ""
+          # 告警模式，不阻断
+          echo "vulture scan completed (advisory mode - not blocking CI)"
+          if [ "$VULTURE_EXIT" != "0" ]; then
+            echo "WARNING: Dead code detected. Review the report above."
+            echo "This is currently advisory only."
+          fi
+          exit 0
       - name: Validate release scripts syntax
         shell: sh
         run: |

vulture.conf

@@ -0,0 +1,35 @@
+# vulture.conf - 死代码检测配置
+# 仓库: xiaoxia/xiaoxia-saas
+# 用途: 检测未使用的函数、变量、导入、类、方法、属性
+
+# 扫描目录（空格分隔）
+path = alembic apps packages scripts
+
+# 排除路径（每个路径一行，相对于仓库根目录）
+exclude =
+    tests
+    test
+    */tests
+    */test
+    site-packages
+    node_modules
+    migrations
+    .gitea
+    docs
+    scripts/check_*.py
+    scripts/init_*.py
+
+# 最低置信度 (%)
+# 0 = 报告所有可能的未使用代码
+# 100 = 只报告确定未使用的代码
+# 推荐从 80% 开始，逐步调高
+min-confidence = 80
+
+# 输出格式: string, json, yaml
+format = text
+
+# 按置信度排序
+sort-by-size = False
+
+# 显示置信度
+show-uncertain = True

vulture_whitelist.py

@@ -0,0 +1,57 @@
+# vulture_whitelist.py - vulture 白名单文件
+# 用途: 列出已知被框架/动态调用的代码，避免误报
+# 参考: https://vulture.readthedocs.io/en/stable/whitelists.html
+
+# FastAPI / Starlette 框架自动调用
+# FastAPI route handlers (通过装饰器注册，vulture 可能无法识别)
+apps.*.main.*
+apps.*.api.*
+apps.*.routes.*
+apps.*.views.*
+
+# SQLAlchemy ORM
+# Model 类和字段通过 ORM 框架自动使用
+apps.*.models.*
+apps.*.schemas.*
+packages.*.models.*
+
+# Pydantic models
+# Pydantic 字段通过序列化/反序列化使用
+apps.*.schemas.*
+packages.*.schemas.*
+
+# Alembic migrations
+# Migration 函数由 alembic 自动调用
+alembic.versions.*.upgrade
+alembic.versions.*.downgrade
+
+# Celery tasks
+# Task 函数通过 celery worker 调用
+apps.*.tasks.*
+packages.*.tasks.*
+
+# CLI scripts / entry points
+# 脚本通过命令行调用
+scripts.*
+
+# 中间件
+apps.*.middleware.*
+packages.*.middleware.*
+
+# 异常类
+apps.*.exceptions.*
+packages.*.exceptions.*
+
+# 配置类
+apps.*.config.*
+packages.*.config.*
+
+# 工具函数（可能被多处间接调用，先白名单，后续清理）
+apps.*.utils.*
+packages.*.utils.*
+apps.*.helpers.*
+packages.*.helpers.*
+
+# Dependencies (FastAPI Depends)
+apps.*.dependencies.*
+packages.*.dependencies.*