xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 11 Pull Requests 2 Actions 2 Packages Projects Releases 7 Wiki Activity

fix(ci): 重新加回gitleaks/pip-audit/vulture扫描步骤 #318

Merged
xiaoxia merged 4 commits from fix/ci-security-scans-reapply into develop 2026-07-14 16:25:08 +08:00
Conversation 0 Commits 4 Files Changed 4
+101 -145
xiaoxia commented 2026-07-14 15:25:40 +08:00
Owner
Copy Link
Copy Source

PR #311合并了三个安全扫描步骤到Validate阶段，但被后续并行构建PR #314覆盖。

本次重新加回：

  • gitleaks（P0密钥检测，阻断模式）
  • pip-audit（P1依赖漏洞，告警模式）
  • vulture（P2死代码，告警模式）
PR #311合并了三个安全扫描步骤到Validate阶段，但被后续并行构建PR #314覆盖。 本次重新加回： - gitleaks（P0密钥检测，阻断模式） - pip-audit（P1依赖漏洞，告警模式） - vulture（P2死代码，告警模式）
xiaoxia added 1 commit 2026-07-14 15:25:41 +08:00
fix(ci): 重新加回gitleaks/pip-audit/vulture扫描步骤（被并行构建PR覆盖）
CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m26s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 2m7s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m25s
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m9s
Details
d642f65028
xiaoxia added 1 commit 2026-07-14 15:31:09 +08:00
fix(ci): 修复三个安全扫描的问题
CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m31s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 1m57s
Details
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 3m4s
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m8s
Details
bcb9f868ee 
- gitleaks: 增加ghproxy镜像源，解决下载失败问题
- pip-audit: 去掉--format text（不支持），用默认columns格式
- vulture: 改用命令行参数，移除有问题的toml配置文件和白名单文件
xiaoxia added 1 commit 2026-07-14 15:38:15 +08:00
fix(ci): 密钥检测改用detect-secrets（pip安装，解决CI网络问题）
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Failing after 22s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m46s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m25s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m7s
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
33d7e417c1 
- 用detect-secrets替代gitleaks，pip安装无需下载二进制
- 排除测试/文档/node_modules/高熵字符串等误报源
- 发现密钥直接阻断CI（P0级别）
- 移除不再使用的gitleaks.toml/vulture.conf/vulture_whitelist.py
xiaoxia added 1 commit 2026-07-14 15:43:44 +08:00
fix(ci): detect-secrets禁用高误报插件，排除e2e/测试文件
CI/CD Pipeline / Validate Code Quality And Tests (pull_request) Successful in 1m18s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m26s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m10s
Details
CI/CD Pipeline / Frontend Lint (pull_request) Successful in 2m36s
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
aca345fb75 
- 禁用BasicAuthDetector/KeywordDetector/IPPublicDetector（误报多）
- 排除e2e/__tests__/spec目录及spec.ts/test.ts/test.py文件
- 保留AWS/GitHub/JWT/PrivateKey/Stripe等特异性高的检测
xiaoxia merged commit a7d942f705 into develop 2026-07-14 16:25:08 +08:00
xiaoxia deleted branch fix/ci-security-scans-reapply 2026-07-14 16:25:08 +08:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot xiaoxia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#318
Delete Branch "fix/ci-security-scans-reapply"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?