xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 11 Pull Requests 3 Actions 3 Packages Projects Releases 7 Wiki Activity

feat(ci): 集成gitleaks + pip-audit + vulture安全扫描到Validate阶段 #311

Merged
xiaoxia merged 1 commits from feat/ci-security-scans into develop 2026-07-14 14:55:58 +08:00
Conversation 0 Commits 1 Files Changed 4
+236 -1
xiaoxia commented 2026-07-14 11:36:03 +08:00
Owner
Copy Link
Copy Source

集成三项安全/质量扫描到CI的Validate阶段：

1. gitleaks 密钥检测（P0 - 阻断模式）

  • PR模式：增量扫描（只扫描PR改动）
  • Push模式：全量扫描
  • 发现密钥直接阻断合并
  • 双源下载（GitHub + Gitee镜像），网络问题时优雅降级
  • 配置白名单排除示例配置、测试文件等误报

2. pip-audit 依赖漏洞扫描（P1 - 告警模式）

  • 扫描所有requirements文件
  • 当前仅告警不阻断，待稳定后可升级

3. vulture 死代码检测（P2 - 告警模式）

  • 置信度80%
  • 排除tests/migrations/docs等目录
  • FastAPI/SQLAlchemy/Celery等框架代码白名单
  • 仅供参考，不阻断CI
集成三项安全/质量扫描到CI的Validate阶段： ## 1. gitleaks 密钥检测（P0 - 阻断模式） - PR模式：增量扫描（只扫描PR改动） - Push模式：全量扫描 - 发现密钥直接阻断合并 - 双源下载（GitHub + Gitee镜像），网络问题时优雅降级 - 配置白名单排除示例配置、测试文件等误报 ## 2. pip-audit 依赖漏洞扫描（P1 - 告警模式） - 扫描所有requirements文件 - 当前仅告警不阻断，待稳定后可升级 ## 3. vulture 死代码检测（P2 - 告警模式） - 置信度80% - 排除tests/migrations/docs等目录 - FastAPI/SQLAlchemy/Celery等框架代码白名单 - 仅供参考，不阻断CI
xiaoxia added 1 commit 2026-07-14 11:36:03 +08:00
feat(ci): 集成gitleaks + pip-audit + vulture安全扫描到Validate阶段
CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m13s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 1m13s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 9m35s
Details
CI/CD Pipeline / Build & Push Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Runtime Images (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 2m26s
Details
a248883c8e 
- gitleaks: 密钥检测（P0，阻断模式）
  - PR模式：增量扫描
  - Push模式：全量扫描
  - 双源下载（GitHub + Gitee镜像），失败优雅降级
- pip-audit: 依赖漏洞扫描（P1，告警模式，不阻断）
  - 扫描所有requirements文件
- vulture: 死代码检测（P2，告警模式，不阻断）
  - 置信度80%
  - 排除tests/migrations/scripts等
  - 框架代码白名单
xiaoxia merged commit 23d2406c27 into develop 2026-07-14 14:55:58 +08:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#311
Delete Branch "feat/ci-security-scans"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?