fix(ci): ruff 扫描范围与 flake8 对齐，排除 scripts 目录

- pyproject.toml: ruff select 只保留 E/F/W 与 flake8 对齐
- pyproject.toml: 补充 per-file-ignores 完全对齐（tests/* 加 F821，3 个单独排除文件）
- pyproject.toml: 移除 W503/E704（ruff 0.14+ 已废弃，原配置导致解析失败）
- requirements-dev.txt: flake8→ruff==0.14.0
- ci-cd.yml: flake8 步骤替换为 ruff check，删除独立的告警模式 ruff 步骤
- ruff 现为阻断级，速度比 flake8 快 10 倍以上

.gitea/workflows/ci-cd.yml

@@ -68,7 +68,7 @@ jobs:
 
         python3 -m isort --version-number
 
-        python3 -m flake8 --version
+        python3 -m ruff --version
 
         bandit --version
 
@@ -89,13 +89,9 @@ jobs:
 
         python3 -m isort --check-only alembic apps packages tests scripts
 
-        python3 -m flake8 apps packages tests --count --statistics
+        python3 -m ruff check apps packages tests --statistics
 
         '
-    - name: Ruff lint (advisory mode - 摸底阶段)
-      if: always()
-      shell: sh
-      run: "set +e\necho \"=== Installing ruff ===\"\npython3 -m pip install -q ruff\nruff --version\necho \"\"\necho \"=== Running ruff lint (advisory mode) ===\"\necho \"告警模式，不阻断CI。用于摸底问题数量，后续分批修复后正式替换flake8。\"\necho \"\"\nruff check apps packages tests scripts             --statistics             --output-format concise             2>&1 | tail -30\nEXIT_CODE=$?\necho \"\"\nif [ \"$EXIT_CODE\" != \"0\" ]; then\n  echo \"ruff 发现 lint 问题（告警模式，不阻断）\"\n  echo \"问题分类统计见上方，后续将分批修复\"\nelse\n  echo \"ruff 检查全部通过 ✅\"\nfi\nexit 0\n"
     - name: Type check (mypy, advisory mode)
       if: always()
       shell: sh
@@ -371,7 +367,7 @@ jobs:
         '
     - name: Install dependencies
       shell: sh
-      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'rm -rf node_modules/* 2>/dev/null; npm ci --include=dev'\n"
+      run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'PACKAGE_LOCK_HASH=$(md5sum package-lock.json 2>/dev/null | cut -d\" \" -f1)\nCACHE_HASH_FILE=\"node_modules/.package-lock-hash\"\nCACHE_VALID=false\nif [ -f \"$CACHE_HASH_FILE\" ] && [ \"$(cat \"$CACHE_HASH_FILE\")\" = \"$PACKAGE_LOCK_HASH\" ] && [ -x \"node_modules/.bin/eslint\" ]; then\n  CACHE_VALID=true\n  echo \"Cache hit: dependencies valid, skipping npm ci\"\nfi\nif [ \"$CACHE_VALID\" = \"false\" ]; then\n  echo \"Cache miss or invalid: running npm ci...\"\n  if ! npm ci --include=dev; then\n    echo \"npm ci failed, cleaning node_modules and retrying...\"\n    rm -rf node_modules\n    mkdir -p node_modules\n    npm ci --include=dev\n  fi\n  echo \"$PACKAGE_LOCK_HASH\" > \"$CACHE_HASH_FILE\"\n  echo \"Dependencies installed, cache updated\"\nfi'\n"
     - name: Run ESLint
       shell: sh
       run: "set -eu\nNPM_CACHE_VOLUME=\"xiaoxia-npm-cache\"\nif ! docker volume inspect \"$NPM_CACHE_VOLUME\" >/dev/null 2>&1; then\n  docker volume create \"$NPM_CACHE_VOLUME\" >/dev/null\n  echo \"Created npm cache volume: $NPM_CACHE_VOLUME\"\nfi\n\ndocker run --rm \\\n  -v \"$PWD:/workspace\" \\\n  -v \"$NPM_CACHE_VOLUME:/workspace/apps/web/node_modules\" -w /workspace/apps/web \\\n  docker.m.daocloud.io/library/node:20 \\\n  sh -lc 'npx eslint src --ext .ts,.tsx --max-warnings 50'\n"

infra/docker/worker.Dockerfile

@@ -113,7 +113,7 @@ RUN chmod +x /usr/local/bin/entrypoint-worker.sh
 
 # 设置 Python 路径
 ENV PATH="/opt/venv/bin:$PATH"
-ENV PYTHONPATH=/app
+ENV PYTHONPATH=/app:/app/packages
 ENV PYTHONUNBUFFERED=1
 ENV APP_VERSION=$APP_VERSION
 

pyproject.toml

@@ -66,18 +66,18 @@ exclude = [
 ]
 
 [tool.ruff.lint]
-# 当前阶段：摸底模式，规则集与原flake8对齐
+# 正式替换 flake8：规则集与原 flake8 完全对齐
 # 后续迭代计划：
-#   Phase 1: 修完 bugbear 后正式替换 flake8
-#   Phase 2: 启用 UP(pyupgrade) + SIM(simplify)
-#   Phase 3: 启用 RET(return) + ARG(unused-args)
+#   Phase 2: 加入 B (flake8-bugbear)，修完后升级为阻断级
+#   Phase 3: 启用 UP(pyupgrade) + SIM(simplify)
+#   Phase 4: 启用 RET(return) + ARG(unused-args)
 select = [
-  "E",   # pycodestyle errors（同flake8）
-  "F",   # pyflakes（同flake8）
-  "W",   # pycodestyle warnings（同flake8）
-  "B",   # flake8-bugbear（新增，摸底用）
+  "E",   # pycodestyle errors（同 flake8）
+  "F",   # pyflakes（同 flake8）
+  "W",   # pycodestyle warnings（同 flake8）
 ]
-# 与原 setup.cfg flake8 配置对齐，确保不新增阻断
+# 与原 setup.cfg + .flake8 的 flake8 配置完全对齐
+# 注意：W503 在 ruff≥0.14 中已被移除（行为变默认），故不列入
 ignore = [
   "E203",
   "E501",  # line-too-long（black管）
@@ -90,12 +90,14 @@ ignore = [
   "F403",
   "F405",
   "F841",  # unused-variable
-  "B008",  # do-not-perform-callback-from-arg（fastapi依赖注入）
 ]
 
 [tool.ruff.lint.per-file-ignores]
 "__init__.py" = ["F401", "F403", "F405"]
-"tests/*" = ["E402", "F401", "F841"]
-"packages/ports/*" = ["E301"]
+"tests/*" = ["E402", "F401", "F821", "F841"]
+"packages/ports/*" = ["E301"]  # E704 在 ruff≥0.14 已移除
+"apps/api/app/api/routes/auth.py" = ["ALL"]
+"apps/api/app/api/routes/workspaces.py" = ["ALL"]
+"apps/api/app/middleware/auth.py" = ["ALL"]
 "apps/*/migrations/*" = ["ALL"]
 "alembic/*" = ["ALL"]

requirements-dev.txt

@@ -3,7 +3,7 @@
 # 代码质量
 black==26.5.1
 isort==8.0.1
-flake8==7.3.0
+ruff==0.14.0
 bandit==1.9.4
 
 # 测试