fix(smart-match): limit 算法取 segments.length 下限，保证每片段至少 1 个素材

computeLimitFromSegments 原逻辑 Math.ceil(totalSeconds/15) 在短模板
（如 14s 模板 4 片段）下仅返回 1，导致后端只分配 1 个素材无法覆盖
全部片段。改为 Math.max(segments.length, ...) 保证每个片段至少能
分到 1 个素材。

.gitea/workflows/pr-auto-scan.yml

@@ -3,7 +3,7 @@ name: PR Auto Scan
 # 作为短作业模式的兜底，防止事件驱动遗漏
 on:
   schedule:
-    - cron: "*/10 * * * *"  # 每10分钟扫描一次（脚本自带240s墙钟上限，降频减负）
+    - cron: "*/15 * * * *"  # 每10分钟扫描一次（脚本自带240s墙钟上限，降频减负）
   workflow_dispatch:
 
 permissions:

README.md

@@ -263,4 +263,3 @@ pytest --cov=packages --cov-report=html
 ---
 
 **License**: MIT
-<!-- CI trigger: 1788229339 -->

alembic/versions/034_add_confirm_generation_fields.py

@@ -1,60 +0,0 @@
-"""Add confirm generation fields
-
-Revision ID: 034
-Revises: 033
-Create Date: 2026-07-08
-
-确认生成 API 改造：为 generation_tasks 表添加 is_preview、source_task_id、
-output_width、output_height、cover_url、custom_title 字段。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "034"
-down_revision = "033"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column("is_preview", sa.Boolean(), nullable=False, server_default=sa.true()),
-    )
-    op.add_column(
-        "generation_tasks",
-        sa.Column("source_task_id", sa.String(32), nullable=False, server_default=""),
-    )
-    op.add_column(
-        "generation_tasks",
-        sa.Column("output_width", sa.Integer(), nullable=False, server_default=sa.text("1280")),
-    )
-    op.add_column(
-        "generation_tasks",
-        sa.Column("output_height", sa.Integer(), nullable=False, server_default=sa.text("720")),
-    )
-    op.add_column(
-        "generation_tasks",
-        sa.Column("cover_url", sa.String(1000), nullable=False, server_default=""),
-    )
-    op.add_column(
-        "generation_tasks",
-        sa.Column("custom_title", sa.String(500), nullable=False, server_default=""),
-    )
-    op.create_index(
-        op.f("ix_generation_tasks_source_task_id"),
-        "generation_tasks",
-        ["source_task_id"],
-    )
-
-
-def downgrade() -> None:
-    op.drop_index(op.f("ix_generation_tasks_source_task_id"), table_name="generation_tasks")
-    op.drop_column("generation_tasks", "custom_title")
-    op.drop_column("generation_tasks", "cover_url")
-    op.drop_column("generation_tasks", "output_height")
-    op.drop_column("generation_tasks", "output_width")
-    op.drop_column("generation_tasks", "source_task_id")
-    op.drop_column("generation_tasks", "is_preview")

apps/web/src/pages/generate/GeneratePage.tsx

@@ -338,12 +338,15 @@ const GeneratePage: React.FC = () => {
                 size: titleSettings.size,
                 font: titleSettings.font,
                 color: titleSettings.color,
-                position: titleSettings.position as "top" | "center" | "bottom",
+                position: titleSettings.position as "top" | "center" | "bottom" | "custom",
                 bold: titleSettings.bold,
                 italic: titleSettings.italic,
                 stroke: titleSettings.stroke,
                 shadow: titleSettings.shadow,
+                posX: titleSettings.posX,
+                posY: titleSettings.posY,
               }}
+              onTitlePositionChange={styleUpdaters.updateTitlePosition}
             />
           )}
           {currentStep >= 5 && generated && finalVideo && (

apps/web/src/pages/generate/components/FrontendPreviewPlayer.tsx

@@ -32,12 +32,15 @@ interface FrontendPreviewPlayerProps {
     size: number
     font: string
     color: string
-    position: "top" | "center" | "bottom"
+    position: "top" | "center" | "bottom" | "custom"
     bold?: boolean
     italic?: boolean
     stroke?: boolean
     shadow?: boolean
+    posX?: number | null
+    posY?: number | null
   }
+  onTitlePositionChange?: (posX: number, posY: number) => void
 }
 
 function formatTime(seconds: number): string {
@@ -105,6 +108,7 @@ const FrontendPreviewPlayer: React.FC<FrontendPreviewPlayerProps> = ({
   serverClips,
   voiceAudioUrl,
   titleSettings,
+  onTitlePositionChange,
 }) => {
   const segments = useMemo(
     () => buildPlaybackSegments(assets, template, serverClips),
@@ -126,6 +130,55 @@ const FrontendPreviewPlayer: React.FC<FrontendPreviewPlayerProps> = ({
         return { width: 1080, height: 1920 }
     }
   })()
+  const customTitleXPct =
+    titleSettings?.posX != null && playRes.width > 0
+      ? (titleSettings.posX / playRes.width) * 100
+      : null
+  const customTitleYPct =
+    titleSettings?.posY != null && playRes.height > 0
+      ? (titleSettings.posY / playRes.height) * 100
+      : null
+
+  // ── 拖拽状态（用 ref 避免在每帧渲染中触发重渲染）──
+  const draggingTitleRef = useRef(false)
+  const handleTitlePointerDown = useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      if (!onTitlePositionChange || !playerContainerRef.current) return
+      e.preventDefault()
+      e.stopPropagation()
+      ;(e.target as Element).setPointerCapture(e.pointerId)
+      draggingTitleRef.current = true
+      ;(e.currentTarget as HTMLDivElement).style.cursor = "grabbing"
+    },
+    [onTitlePositionChange],
+  )
+  const handleTitlePointerMove = useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      if (!draggingTitleRef.current || !onTitlePositionChange || !playerContainerRef.current) return
+      e.preventDefault()
+      e.stopPropagation()
+      const rect = playerContainerRef.current.getBoundingClientRect()
+      const relX = Math.max(0, Math.min(rect.width, e.clientX - rect.left))
+      const relY = Math.max(0, Math.min(rect.height, e.clientY - rect.top))
+      const posX = Math.round((relX / rect.width) * playRes.width)
+      const posY = Math.round((relY / rect.height) * playRes.height)
+      onTitlePositionChange(posX, posY)
+    },
+    [onTitlePositionChange, playRes.width, playRes.height],
+  )
+  const handleTitlePointerUp = useCallback((e: React.PointerEvent<HTMLDivElement>) => {
+    if (!draggingTitleRef.current) return
+    draggingTitleRef.current = false
+    ;(e.currentTarget as HTMLDivElement).style.cursor = "grab"
+    try {
+      if ((e.currentTarget as Element).hasPointerCapture(e.pointerId)) {
+        ;(e.currentTarget as Element).releasePointerCapture(e.pointerId)
+      }
+    } catch {
+      /* ignore */
+    }
+  }, [])
+
   const playerContainerRef = useRef<HTMLDivElement>(null)
   const [containerHeight, setContainerHeight] = useState(0)
   useEffect(() => {
@@ -524,15 +577,34 @@ const FrontendPreviewPlayer: React.FC<FrontendPreviewPlayerProps> = ({
           <div
             style={{
               position: "absolute",
-              left: `${titleSidePct}%`,
-              right: `${titleSidePct}%`,
-              textAlign: "center",
-              ...(titleSettings.position === "top"
-                ? { top: `${titleTopPct}%` }
-                : titleSettings.position === "center"
-                  ? { top: "50%", transform: "translateY(-50%)" }
-                  : { bottom: `${titleBottomPct}%` }),
+              ...(customTitleXPct != null && customTitleYPct != null
+                ? {
+                    left: `${customTitleXPct}%`,
+                    top: `${customTitleYPct}%`,
+                    transform: "translate(-50%, -50%)",
+                    textAlign: "center" as const,
+                  }
+                : {
+                    left: `${titleSidePct}%`,
+                    right: `${titleSidePct}%`,
+                    textAlign: "center" as const,
+                    ...(titleSettings.position === "top"
+                      ? { top: `${titleTopPct}%` }
+                      : titleSettings.position === "center"
+                        ? { top: "50%", transform: "translateY(-50%)" }
+                        : { bottom: `${titleBottomPct}%` }),
+                  }),
+              cursor: onTitlePositionChange ? "grab" : "default",
+              touchAction: "none",
+              userSelect: "none",
+              WebkitUserSelect: "none",
+              padding: "8px 12px",
+              boxShadow: "inset 0 0 0 16px transparent",
             }}
+            onPointerDown={handleTitlePointerDown}
+            onPointerMove={handleTitlePointerMove}
+            onPointerUp={handleTitlePointerUp}
+            onPointerCancel={handleTitlePointerUp}
           >
             <span
               style={{

apps/web/src/pages/generate/constants.ts

@@ -42,6 +42,7 @@ export const POSITION_OPTIONS = [
   { value: "top", label: "顶部" },
   { value: "center", label: "居中" },
   { value: "bottom", label: "底部" },
+  { value: "custom", label: "自定义" },
 ]
 
 /* ── 标题字体选项 ── */

apps/web/src/pages/generate/hooks/step2-materials/useSmartMatch.ts

@@ -20,13 +20,14 @@ const SECONDS_PER_ASSET = 15
 /**
  * 根据模板 segments 计算所需素材数量上限。
  * 取每个 segment 的 duration_min 之和作为目标视频总时长，
- * 再按 15 秒/素材估算需要多少个素材；结果钳制到 [1, 200] 区间（后端 limit 上限 200）。
+ * 再按 15 秒/素材估算需要多少个素材，且保证不少于片段数（每个片段至少 1 个素材）；
+ * 结果钳制到 [1, 200] 区间（后端 limit 上限 200）。
  */
 function computeLimitFromSegments(segments?: TemplateSegment[]): number {
   if (!segments || segments.length === 0) return DEFAULT_LIMIT
   const totalSeconds = segments.reduce((sum, seg) => sum + (seg.duration_min || 0), 0)
   if (totalSeconds <= 0) return DEFAULT_LIMIT
-  const limit = Math.ceil(totalSeconds / SECONDS_PER_ASSET)
+  const limit = Math.max(segments.length, Math.ceil(totalSeconds / SECONDS_PER_ASSET))
   return Math.max(1, Math.min(limit, 200))
 }
 

apps/web/src/pages/generate/hooks/useCanvasPlayer.ts

@@ -233,7 +233,7 @@ export function useCanvasPlayer(
     fontSize: number
     fontFamily: string
     color: string
-    position: "top" | "center" | "bottom"
+    position: "top" | "center" | "bottom" | "custom"
     bold?: boolean
     stroke?: boolean
     shadow?: boolean

apps/web/src/pages/generate/hooks/useGenerateFormState/index.ts

@@ -27,6 +27,8 @@ const DEFAULT_TITLE_SETTINGS: TitleSettings = {
   stroke: true,
   shadow: false,
   color: "#ffffff",
+  posX: null,
+  posY: null,
 }
 
 export interface GenerateFormState {

apps/web/src/pages/generate/hooks/useGenerateVideo.ts

@@ -117,6 +117,14 @@ export function useGenerateVideo(props: UseGenerateVideoProps) {
                   font_size: props.titleSettings.size,
                   font_color: props.titleSettings.color,
                   position: props.titleSettings.position,
+                  ...(props.titleSettings.position === "custom" &&
+                  props.titleSettings.posX != null &&
+                  props.titleSettings.posY != null
+                    ? {
+                        pos_x: Math.round(props.titleSettings.posX),
+                        pos_y: Math.round(props.titleSettings.posY),
+                      }
+                    : {}),
                   bold: props.titleSettings.bold,
                   stroke: props.titleSettings.stroke,
                   shadow: props.titleSettings.shadow,

apps/web/src/pages/generate/hooks/useStep4Title/useTitleStyleUpdaters.ts

@@ -46,7 +46,16 @@ export function useTitleStyleUpdaters({
 
   const updatePosition = useCallback(
     (position: string) => {
-      onTitleSettingsChange({ ...titleSettings, position })
+      // 切回三档预设时清掉自定义坐标
+      onTitleSettingsChange({ ...titleSettings, position, posX: null, posY: null })
+    },
+    [titleSettings, onTitleSettingsChange],
+  )
+
+  /** 拖拽更新自定义位置（由预览播放器调用） */
+  const updateTitlePosition = useCallback(
+    (posX: number, posY: number) => {
+      onTitleSettingsChange({ ...titleSettings, position: "custom", posX, posY })
     },
     [titleSettings, onTitleSettingsChange],
   )
@@ -111,6 +120,7 @@ export function useTitleStyleUpdaters({
     updateTitle,
     toggleAiAutoSelect,
     updatePosition,
+    updateTitlePosition,
     updateFont,
     updateSize,
     updateColor,

apps/web/src/pages/generate/types.ts

@@ -16,6 +16,9 @@ export interface TitleSettings {
   stroke: boolean
   shadow: boolean
   color: string
+  /** 自由位置坐标（PlayRes 像素），仅当 position="custom" 时有效 */
+  posX: number | null
+  posY: number | null
 }
 
 /* ── 智能匹配结果 ── */

scripts/ci/auto_approve.sh

@@ -28,15 +28,12 @@ if [ "$SKIP_BACKEND" = "true" ]; then
   CONTEXTS=("CI/CD Pipeline / Frontend Lint (pull_request)")
 else
   CONTEXTS=(
-    "CI/CD Pipeline / Validate - Code Quality (pull_request)"
-    "CI/CD Pipeline / Validate - Type Check (mypy) (pull_request)"
-    "CI/CD Pipeline / Validate - Migration (alembic) (pull_request)"
+    # CI 优化后 job 名称（2026-08）：Code Quality 拆分为 Style+Security，Type Check+Migration 合并为 Python
+    # 与 pr_auto_scan.py 的 REQUIRED_CONTEXTS_APPROVE 保持一致
+    "CI/CD Pipeline / Validate - Style (pull_request)"
+    "CI/CD Pipeline / Validate - Security (pull_request)"
+    "CI/CD Pipeline / Validate - Python (mypy + alembic) (pull_request)"
     "CI/CD Pipeline / Frontend Lint (pull_request)"
-    "CI/CD Pipeline / Unit Tests (pull_request)"
-    "CI/CD Pipeline / Frontend Unit Tests (pull_request)"
-    "CI/CD Pipeline / PR Build API Image (pull_request)"
-    "CI/CD Pipeline / PR Build Web Image (pull_request)"
-    "CI/CD Pipeline / PR Build Worker Image (pull_request)"
   )
 fi
 
@@ -153,4 +150,4 @@ done
 
 echo
 echo "⏰ 快速检查超时（2分钟），CI尚未完成，退出等待下次触发（workflow_run事件或5分钟定时扫描）"
-exit 0
+exit 0

scripts/ci/pr_auto_scan.py

@@ -303,9 +303,10 @@ def main():
         "CI/CD Pipeline / CI Gate (pull_request)",
     ]
     REQUIRED_CONTEXTS_APPROVE = [
-        "CI/CD Pipeline / Validate - Code Quality (pull_request)",
-        "CI/CD Pipeline / Validate - Type Check (mypy) (pull_request)",
-        "CI/CD Pipeline / Validate - Migration (alembic) (pull_request)",
+        # CI 优化后 job 名称（2026-08）：Code Quality 拆分为 Style+Security，Type Check+Migration 合并为 Python
+        "CI/CD Pipeline / Validate - Style (pull_request)",
+        "CI/CD Pipeline / Validate - Security (pull_request)",
+        "CI/CD Pipeline / Validate - Python (mypy + alembic) (pull_request)",
         "CI/CD Pipeline / Frontend Lint (pull_request)",
     ]
     FRONTEND_ONLY_CONTEXT = [

scripts/ci/run_integration_tests.sh

@@ -197,8 +197,8 @@ if [ "$USE_SHARED_PG" = "true" ]; then
   # 创建主数据库（xdist 模式下各 worker 会创建自己的数据库，主库作为 fallback）
   echo "创建主测试数据库: $CI_DB_NAME"
   PGPASSWORD="$SHARED_PG_PASSWORD" python3 -c "
-import psycopg2
-conn = psycopg2.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
+import psycopg
+conn = psycopg.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
 conn.autocommit = True
 cur = conn.cursor()
 cur.execute(f'DROP DATABASE IF EXISTS \"$CI_DB_NAME\" WITH (FORCE)')
@@ -304,8 +304,8 @@ if [ "$USE_SHARED_PG" = "true" ]; then
 
   # 清理所有以 CI_DB_NAME 开头的数据库（主库 + worker 库）
   PGPASSWORD="${SHARED_PG_PASSWORD}" python3 -c "
-import psycopg2
-conn = psycopg2.connect(host='${SHARED_PG_HOST}', port=${SHARED_PG_PORT}, user='${SHARED_PG_USER}', password='${SHARED_PG_PASSWORD}', dbname='postgres')
+import psycopg
+conn = psycopg.connect(host='${SHARED_PG_HOST}', port=${SHARED_PG_PORT}, user='${SHARED_PG_USER}', password='${SHARED_PG_PASSWORD}', dbname='postgres')
 conn.autocommit = True
 cur = conn.cursor()
 
@@ -344,4 +344,4 @@ python3 scripts/ci_coverage_summary.py
 set -e
 
 echo ""
-echo "=== CI Integration Tests 全部通过 ✅ ==="
+echo "=== CI Integration Tests 全部通过 ✅ ==="

scripts/ci/run_validate.sh

@@ -409,8 +409,8 @@ except:
 
     echo "创建测试数据库: $CI_DB_NAME"
     PGPASSWORD="$SHARED_PG_PASSWORD" python3 -c "
-import psycopg2
-conn = psycopg2.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
+import psycopg
+conn = psycopg.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
 conn.autocommit = True
 cur = conn.cursor()
 cur.execute(f'DROP DATABASE IF EXISTS \"$CI_DB_NAME\" WITH (FORCE)')
@@ -431,8 +431,8 @@ conn.close()
       # 清理数据库
       echo "清理测试数据库: $CI_DB_NAME"
       PGPASSWORD="$SHARED_PG_PASSWORD" python3 -c "
-import psycopg2
-conn = psycopg2.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
+import psycopg
+conn = psycopg.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
 conn.autocommit = True
 cur = conn.cursor()
 cur.execute(f'DROP DATABASE IF EXISTS \"$CI_DB_NAME\" WITH (FORCE)')

scripts/ci/sync_base_images.sh

@@ -1,103 +0,0 @@
-#!/bin/bash
-# ============================================
-# 基础镜像同步脚本 - 从公共镜像源同步到私有ACR
-# 用法:
-#   ACR_USERNAME=xxx ACR_PASSWORD=yyy bash scripts/ci/sync_base_images.sh
-# ============================================
-
-set -euo pipefail
-
-ACR_REGISTRY="${ACR_REGISTRY:-xiaoxia-registry.cn-hangzhou.cr.aliyuncs.com/xiaoxiakeji}"
-ACR_USERNAME="${ACR_USERNAME:-}"
-ACR_PASSWORD="${ACR_PASSWORD:-}"
-SOURCE_PREFIX="${SOURCE_PREFIX:-docker.m.daocloud.io/library}"
-
-# 需要同步的镜像列表 (源镜像名:tag => ACR目标名:tag)
-IMAGES=(
-    "python:3.12-slim-bookworm"
-    "python:3.12-slim"
-    "node:20"
-    "nginx:alpine"
-)
-
-echo "============================================"
-echo "  基础镜像同步到 ACR"
-echo "  ACR: $ACR_REGISTRY"
-echo "  源: $SOURCE_PREFIX"
-echo "============================================"
-echo ""
-
-# 登录 ACR
-if [ -n "$ACR_PASSWORD" ] && [ -n "$ACR_USERNAME" ]; then
-    echo "登录 ACR..."
-    ACR_HOST=$(echo "$ACR_REGISTRY" | cut -d/ -f1)
-    printf '%s' "$ACR_PASSWORD" | docker login "$ACR_HOST" -u "$ACR_USERNAME" --password-stdin
-    echo "ACR 登录成功"
-    echo ""
-fi
-
-success=0
-failed=0
-
-for image in "${IMAGES[@]}"; do
-    source_image="${SOURCE_PREFIX}/${image}"
-    target_image="${ACR_REGISTRY}/base/${image}"
-
-    echo "--- 同步: $image ---"
-    echo "  源: $source_image"
-    echo "  目标: $target_image"
-
-    # Pull 源镜像（带重试）
-    pulled=0
-    for attempt in 1 2 3; do
-        echo "  Pull 尝试 $attempt/3..."
-        if docker pull "$source_image"; then
-            pulled=1
-            break
-        fi
-        echo "  Pull 失败，5s 后重试..."
-        sleep 5
-    done
-
-    if [ "$pulled" -eq 0 ]; then
-        echo "  ❌ Pull 失败: $image"
-        failed=$((failed + 1))
-        continue
-    fi
-
-    # Tag
-    docker tag "$source_image" "$target_image"
-    echo "  Tag 完成"
-
-    # Push 到 ACR
-    pushed=0
-    for attempt in 1 2 3; do
-        echo "  Push 尝试 $attempt/3..."
-        if docker push "$target_image"; then
-            pushed=1
-            break
-        fi
-        echo "  Push 失败，5s 后重试..."
-        sleep 5
-    done
-
-    if [ "$pushed" -eq 1 ]; then
-        echo "  ✅ 同步成功: $image"
-        success=$((success + 1))
-    else
-        echo "  ❌ Push 失败: $image"
-        failed=$((failed + 1))
-    fi
-
-    echo ""
-done
-
-echo "============================================"
-echo "  同步完成"
-echo "  成功: $success"
-echo "  失败: $failed"
-echo "============================================"
-
-if [ "$failed" -gt 0 ]; then
-    exit 1
-fi

scripts/ci/validate_code_quality.sh

@@ -1,157 +0,0 @@
-#!/bin/bash
-# CI Validate: 代码质量与安全扫描（并行Job 1/3）
-# 包含：密钥扫描、格式检查、安全扫描、依赖漏洞、死代码检测、脚本语法校验
-set -eu
-
-echo "=== CI Validate: 代码质量与安全扫描 ==="
-
-# --- 密钥检测 ---
-echo ""
-echo "=== [1/6] Secret detection (detect-secrets) ==="
-python3 -m pip install -q detect-secrets
-detect-secrets --version
-
-detect-secrets scan \
-  --all-files \
-  --exclude-files '(^|/)(tests|test|e2e|__tests__|spec|docs|node_modules|site-packages|migrations|alembic|.gitea|.git|.pytest_cache|.next|dist|build)/' \
-  --exclude-files '\.(md|rst|txt|lock|example|sample|min\.js|min\.css|spec\.ts|test\.ts|test\.py)$' \
-  --exclude-files '(package-lock|yarn\.lock|poetry\.lock|Pipfile\.lock)$' \
-  --disable-plugin Base64HighEntropyString \
-  --disable-plugin HexHighEntropyString \
-  --disable-plugin BasicAuthDetector \
-  --disable-plugin KeywordDetector \
-  --disable-plugin IPPublicDetector \
-  > /tmp/secrets-scan.json 2>&1
-
-FOUND=$(python3 -c "
-import json
-try:
-    with open('/tmp/secrets-scan.json') as f:
-        data = json.load(f)
-    results = data.get('results', {})
-    total = sum(len(v) for v in results.values())
-    print(total)
-except Exception:
-    print('error')
-")
-
-echo "Secrets detected: $FOUND"
-if [ "$FOUND" != "0" ] && [ "$FOUND" != "error" ]; then
-  echo ""
-  echo "=== Secret details ==="
-  python3 -c "
-import json
-with open('/tmp/secrets-scan.json') as f:
-    data = json.load(f)
-for fpath, items in data.get('results', {}).items():
-    for item in items:
-        line = item.get('line_number', '?')
-        stype = item.get('type', '?')
-        hashed = item.get('hashed_secret', '')[:16]
-        print(f'  {fpath}:{line} [{stype}] {hashed}...')
-"
-  echo ""
-  echo "ERROR: Potential secrets detected in code!"
-  exit 1
-fi
-echo "✅ Secret scan passed"
-
-# --- 代码质量检查（全量，PR 和 push 统一标准）---
-# 历史：PR 侧用增量检查以加速，但会导致 push 侧全量检查失败时 PR 侧感知不到
-# 现在统一全量检查，确保 CI 真正保护主分支（black/isort/ruff 全量仅多几十秒）
-echo ""
-echo "=== [2/6] Code quality checks (full scan) ==="
-SCAN_MODE="full"
-echo "Full scan mode"
-python3 -m compileall -q alembic apps packages tests scripts
-python3 -m black --check --fast alembic apps packages tests scripts
-python3 -m isort --check-only alembic apps packages tests scripts
-python3 -m ruff check apps packages tests --statistics
-
-echo "✅ Code quality checks passed"
-
-# --- Bandit 安全扫描（仅告警） ---
-echo ""
-echo "=== [3/6] Security scan (bandit, advisory only) ==="
-set +e
-bandit -r apps packages -q -ll
-BANDIT_EXIT=$?
-set -e
-if [ "$BANDIT_EXIT" -ne 0 ]; then
-  echo "⚠️  Bandit found security issues (advisory mode - not blocking CI)"
-else
-  echo "✅ Bandit security scan passed"
-fi
-
-# --- Pip-audit 依赖漏洞扫描（仅告警） ---
-echo ""
-echo "=== [4/6] Python dependency vulnerability scan (pip-audit, advisory only) ==="
-python3 -m pip install -q pip-audit
-pip-audit --version
-EXIT_CODE=0
-for req_file in requirements.txt requirements-base.txt requirements-dev.txt; do
-  if [ -f "$req_file" ]; then
-    echo "--- Scanning $req_file ---"
-    pip-audit -r "$req_file" --desc on 2>&1 | head -40 || EXIT_CODE=$?
-    echo ""
-  fi
-done
-echo "pip-audit scan completed (advisory mode - warnings only, not blocking CI)"
-
-# --- Vulture 死代码检测（仅告警） ---
-echo ""
-echo "=== [5/6] Dead code detection (vulture, advisory only) ==="
-set +e
-python3 -m pip install -q vulture
-vulture --version
-echo "告警模式，不阻断CI。置信度>=90%建议尽快确认。"
-echo ""
-vulture apps packages scripts \
-  --exclude "tests,test,migrations,.gitea,docs,node_modules,site-packages,*/test_*.py,*/conftest.py" \
-  --min-confidence 70 \
-  2>&1 | sort -t'(' -k2 -rn | head -80
-echo ""
-echo "=== vulture scan summary ==="
-echo "发现潜在死代码（可能包含框架装饰器注册的函数，为误报）"
-echo "建议：定期人工审查高置信度（>=90%）条目"
-set -e
-
-# --- CI脚本语法校验 ---
-echo ""
-echo "=== [6/6] CI & shell scripts syntax validation ==="
-SYNTAX_ERROR=0
-# 检查所有 CI shell 脚本
-for script in scripts/ci/*.sh; do
-  if [ -f "$script" ]; then
-    if ! bash -n "$script" 2>&1; then
-      echo "❌ 语法错误: $script"
-      SYNTAX_ERROR=1
-    fi
-  fi
-done
-# 检查所有 CI Python 脚本语法
-for script in scripts/ci/*.py; do
-  if [ -f "$script" ]; then
-    if ! python3 -m py_compile "$script" 2>&1; then
-      echo "❌ Python语法错误: $script"
-      SYNTAX_ERROR=1
-    fi
-  fi
-done
-# 检查 .gitea/workflows 下的脚本（如果有）
-for script in .gitea/workflows/*.sh; do
-  if [ -f "$script" ]; then
-    if ! bash -n "$script" 2>&1; then
-      echo "❌ 语法错误: $script"
-      SYNTAX_ERROR=1
-    fi
-  fi
-done
-if [ "$SYNTAX_ERROR" -ne 0 ]; then
-  echo "❌ CI脚本语法校验失败，见上方错误"
-  exit 1
-fi
-echo "✅ All CI scripts syntax OK"
-
-echo ""
-echo "=== CI Validate: 代码质量与安全扫描 全部通过 ✅ ==="

scripts/ci/validate_migration.sh

@@ -169,8 +169,8 @@ if [ "$USE_SHARED_PG" = "true" ]; then
 
   echo "创建测试数据库: $CI_DB_NAME"
   PGPASSWORD="$SHARED_PG_PASSWORD" python3 -c "
-import psycopg2
-conn = psycopg2.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
+import psycopg
+conn = psycopg.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
 conn.autocommit = True
 cur = conn.cursor()
 cur.execute(f'DROP DATABASE IF EXISTS \"$CI_DB_NAME\" WITH (FORCE)')
@@ -185,8 +185,8 @@ conn.close()
     echo ""
     echo "清理测试数据库: $CI_DB_NAME"
     PGPASSWORD="$SHARED_PG_PASSWORD" python3 -c "
-import psycopg2
-conn = psycopg2.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
+import psycopg
+conn = psycopg.connect(host='$SHARED_PG_HOST', port=$SHARED_PG_PORT, user='$SHARED_PG_USER', password='$SHARED_PG_PASSWORD', dbname='postgres')
 conn.autocommit = True
 cur = conn.cursor()
 cur.execute(f'DROP DATABASE IF EXISTS \"$CI_DB_NAME\" WITH (FORCE)')