xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 16 Pull Requests 12 Actions 34.2k Packages Projects Releases 7 Wiki Activity

feat(ci): integrate gitleaks (P0) and pip-audit (P1) into validate job #256

Closed
xiaoxia wants to merge 9 commits from feat/ci-security-scanning into develop
pull from: feat/ci-security-scanning
merge into: xiaoxia:develop
Conversation 1 Commits 9 Files Changed 4
+443

9 Commits

Author SHA1 Message Date
代码审计 b4890da58c fix(ci): use triple-quoted strings in gitleaks.toml to avoid quote parsing errors
CI/CD Pipeline / Unit Tests (pull_request) Failing after 15s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Failing after 14s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 17s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 8s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Failing after 1558h33m24s
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Failing after 1558h33m24s
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Failing after 1558h33m24s
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Failing after 1558h33m25s
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Failing after 1558h33m25s
Details
CI/CD Pipeline / Deploy Production (pull_request) Failing after 1559h4m59s
Details
2026-07-13 16:56:40 +08:00
代码审计 a141cd56ff fix(ci): fix gitleaks.toml regex syntax - glob to regex patterns
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 10s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Failing after 10s
Details
CI/CD Pipeline / Unit Tests (pull_request) Failing after 18s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 25s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Failing after 1558h35m52s
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Failing after 1558h35m53s
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Failing after 1558h35m53s
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Failing after 1558h35m54s
Details
CI/CD Pipeline / Deploy Production (pull_request) Failing after 1559h7m28s
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Failing after 1559h7m29s
Details
2026-07-13 16:54:20 +08:00
代码审计 90f3c0694c docs(ci): update security scan briefing with gitleaks fix details + PR264 review
CI/CD Pipeline / Unit Tests (pull_request) Failing after 9s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 10s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 26s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Failing after 1558h36m40s
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Failing after 1558h36m41s
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Failing after 1558h36m41s
Details
CI/CD Pipeline / Deploy Production (pull_request) Failing after 1558h36m41s
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Failing after 1558h36m41s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Failing after 1559h8m16s
Details
2026-07-13 16:51:46 +08:00
代码审计 10cb082560 fix(ci): add more Chinese mirrors for gitleaks download + graceful degradation
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 9s
Details
CI/CD Pipeline / Unit Tests (pull_request) Failing after 5s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Failing after 7s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 7s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Failing after 1558h39m20s
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Failing after 1558h39m22s
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Failing after 1558h39m22s
Details
CI/CD Pipeline / Deploy Production (pull_request) Failing after 1558h39m21s
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Failing after 1558h39m21s
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Failing after 1559h10m56s
Details
2026-07-13 16:50:45 +08:00
xiaoxia cd66aace5b docs(ci): add first security scan briefing report
CI/CD Pipeline / Unit Tests (pull_request) Failing after 16s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Failing after 17s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 2m37s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 25s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Failing after 1558h38m45s
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Failing after 1558h38m45s
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Failing after 1558h38m45s
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Failing after 1558h38m46s
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Failing after 1558h38m46s
Details
CI/CD Pipeline / Deploy Production (pull_request) Failing after 1559h10m20s
Details 
- Overview of gitleaks, pip-audit, vulture status
- Known issues: new runner stuck, black format failure
- Next steps and action items
 2026-07-13 16:39:44 +08:00
xiaoxia e9ad12e072 docs(ci): add security scanning roadmap document
CI/CD Pipeline / Unit Tests (pull_request) Failing after 18s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 21m53s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 16s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Failing after 1558h41m56s
Details
CI/CD Pipeline / Deploy Production (pull_request) Failing after 1558h41m58s
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Failing after 1558h41m59s
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Failing after 1558h42m1s
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Failing after 1558h42m1s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Failing after 1559h13m34s
Details 
- Phase 0: baseline (bandit, black, isort, flake8) - existing
- Phase 1: security foundation (gitleaks P0, pip-audit P1) - in progress
- Phase 2: quality & frontend (npm audit P1, vulture P2) - planned
- Phase 3: deep quality (mypy, semgrep, dep auto-update) - future
- Access principles, progress tracking table
 2026-07-13 16:26:26 +08:00
xiaoxia e557da4d98 fix(ci): add Chinese mirror for gitleaks download
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 2m12s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 24s
Details
CI/CD Pipeline / Unit Tests (pull_request) Failing after 21m1s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Failing after 1559h2m7s
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Failing after 1559h2m10s
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Failing after 1559h2m12s
Details
CI/CD Pipeline / Deploy Production (pull_request) Failing after 1559h2m10s
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Failing after 1559h2m12s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Failing after 1559h33m44s
Details 
- Gitea runner servers cannot reach GitHub directly (connection timeout)
- Add ghproxy mirror as primary download source
- Add multiple fallback URLs for reliability
- Fix pip-audit exit code handling
- Improve error messages
 2026-07-13 16:25:06 +08:00
xiaoxia cef402f88d ci: integrate gitleaks and pip-audit into validate job
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 1m36s
Details
CI/CD Pipeline / Unit Tests (pull_request) Failing after 40s
Details
CI/CD Pipeline / Integration Tests (pull_request) Failing after 31s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Failing after 1560h0m54s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Failing after 1560h0m49s
Details
CI/CD Pipeline / Deploy Production (pull_request) Failing after 1560h32m26s
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Failing after 1560h32m29s
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Failing after 1560h0m51s
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Failing after 1560h0m51s
Details 
- Add gitleaks secret detection step (P0 - blocking)
  - PR mode: incremental scan (only changed files)
  - Push mode: full repository scan
  - Block merge if secrets detected
- Add pip-audit dependency vulnerability scan (P1 - advisory)
  - Scan all requirements files
  - Advisory mode only, no blocking
- Steps placed early in validate job for fast feedback
 2026-07-13 15:12:15 +08:00
xiaoxia c29297a032 ci: add gitleaks allowlist configuration 
- Exclude env examples, test files, docs, node_modules, site-packages
- Add regex patterns for common placeholder values
- Exclude generated lock files and CI config
 2026-07-13 15:11:55 +08:00