From 72f47592a92f21d93cc27bd4d9ac2efaf1e929df Mon Sep 17 00:00:00 2001
From: xiaoxia <xiaoxia@xiaoxiajianji.com>
Date: Mon, 31 Aug 2026 20:16:34 +0800
Subject: [PATCH] =?UTF-8?q?fix(ci):=20=E5=AE=89=E5=85=A8/=E9=A3=8E?=
 =?UTF-8?q?=E6=A0=BC=E6=A3=80=E6=9F=A5=20pip=20install=20=E5=8A=A0?=
 =?UTF-8?q?=E5=9B=BA=E2=80=94=E2=80=94=E9=98=B2=E7=BC=93=E5=AD=98=E6=8D=9F?=
 =?UTF-8?q?=E5=9D=8F=E5=AF=BC=E8=87=B4=20CI=20=E5=A4=B1=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

问题：Gitea Actions cache 返回损坏归档时（cache EOF/deserialization failed），
pip install pip-audit/detect-secrets/vulture 因 hash mismatch 直接 exit 1，
导致 validate-security/validate-style 整体失败。

修复：
- detect-secrets/pip-audit/vulture 安装加 --no-cache-dir
- pip-audit 安装失败后 graceful skip（本身是 advisory-only）
- detect-secrets 安装失败后重试一次 --no-binary
- vulture 安装失败后 skip 死代码检测（本身是 advisory-only）
---
 scripts/ci/validate_security.sh | 40 +++++++++++++++++++++++----------
 scripts/ci/validate_style.sh    |  2 +-
 2 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/scripts/ci/validate_security.sh b/scripts/ci/validate_security.sh
index b08904327..e6d3c566d 100755
--- a/scripts/ci/validate_security.sh
+++ b/scripts/ci/validate_security.sh
@@ -8,7 +8,13 @@ echo "=== CI Validate: 安全扫描 ==="
 # --- 密钥检测 ---
 echo ""
 echo "=== [1/4] Secret detection (detect-secrets) ==="
-python3 -m pip install -q detect-secrets
+python3 -m pip install -q --no-cache-dir detect-secrets || {
+  echo "⚠️  detect-secrets install failed, retrying without cache..."
+  python3 -m pip install -q --no-cache-dir --no-binary :all: detect-secrets || {
+    echo "❌ detect-secrets install failed after retry"
+    exit 1
+  }
+}
 detect-secrets --version
 
 detect-secrets scan \
@@ -72,17 +78,27 @@ fi
 # --- Pip-audit 依赖漏洞扫描（仅告警）---
 echo ""
 echo "=== [3/4] Python dependency vulnerability scan (pip-audit, advisory only) ==="
-python3 -m pip install -q pip-audit
-pip-audit --version
-EXIT_CODE=0
-for req_file in requirements.txt requirements-base.txt requirements-dev.txt; do
-  if [ -f "$req_file" ]; then
-    echo "--- Scanning $req_file ---"
-    pip-audit -r "$req_file" --desc on 2>&1 | head -40 || EXIT_CODE=$?
-    echo ""
-  fi
-done
-echo "pip-audit scan completed (advisory mode - warnings only, not blocking CI)"
+python3 -m pip install -q --no-cache-dir pip-audit || {
+  echo "⚠️  pip-audit install failed (cache issue?), retrying..."
+  python3 -m pip install -q --no-cache-dir pip-audit || {
+    echo "⚠️  pip-audit unavailable, skipping dependency vulnerability scan (advisory)"
+    pip-audit --version 2>/dev/null || true
+  }
+}
+if command -v pip-audit >/dev/null 2>&1 || python3 -m pip show pip-audit >/dev/null 2>&1; then
+  pip-audit --version
+  EXIT_CODE=0
+  for req_file in requirements.txt requirements-base.txt requirements-dev.txt; do
+    if [ -f "$req_file" ]; then
+      echo "--- Scanning $req_file ---"
+      pip-audit -r "$req_file" --desc on 2>&1 | head -40 || EXIT_CODE=$?
+      echo ""
+    fi
+  done
+  echo "pip-audit scan completed (advisory mode - warnings only, not blocking CI)"
+else
+  echo "⚠️  pip-audit not available, skipping dependency vulnerability scan (advisory)"
+fi
 
 # --- CI脚本语法校验 ---
 echo ""
diff --git a/scripts/ci/validate_style.sh b/scripts/ci/validate_style.sh
index c87ec7f3c..79ee31da9 100755
--- a/scripts/ci/validate_style.sh
+++ b/scripts/ci/validate_style.sh
@@ -24,7 +24,7 @@ echo "✅ Code formatting checks passed"
 echo ""
 echo "=== [3/3] Dead code detection (vulture, advisory only) ==="
 set +e
-python3 -m pip install -q vulture
+python3 -m pip install -q --no-cache-dir vulture || echo "⚠️  vulture install failed, skipping dead code detection"
 vulture --version
 echo "告警模式，不阻断CI。置信度>=90%建议尽快确认。"
 echo ""
-- 
2.54.0