From 1015bf2b135288bdea257e48bea5c289fd685dd4 Mon Sep 17 00:00:00 2001 From: Security Audit Bot Date: Sun, 28 Jun 2026 09:20:55 +0800 Subject: [PATCH] =?UTF-8?q?fix(security):=20=E7=A7=BB=E9=99=A4=E6=95=8F?= =?UTF-8?q?=E6=84=9F=E7=8E=AF=E5=A2=83=E6=96=87=E4=BB=B6=E7=9A=84=E7=89=88?= =?UTF-8?q?=E6=9C=AC=E8=BF=BD=E8=B8=AA=E5=B9=B6=E6=B8=85=E7=90=86=E7=A1=AC?= =?UTF-8?q?=E7=BC=96=E7=A0=81Token?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 从版本控制中移除 .env.production 和 .env.staging（git rm --cached） - 更新 .gitignore：移除 .env.staging 的例外规则，所有 .env 环境文件不再提交 - scripts/ci_failure_check.sh：硬编码 Gitea API Token 改为环境变量 GITEA_API_TOKEN - scripts/auto_merge_prs.sh：硬编码 Gitea API Token 改为环境变量 GITEA_API_TOKEN 这是对 PR#53 的重新提交，补充了之前遗漏的脚本中硬编码凭证清理。 --- .env.production | 85 ------------------------------------- .env.staging | 85 ------------------------------------- .gitignore | 4 +- scripts/auto_merge_prs.sh | 2 +- scripts/ci_failure_check.sh | 2 +- 5 files changed, 4 insertions(+), 174 deletions(-) delete mode 100644 .env.production delete mode 100755 .env.staging diff --git a/.env.production b/.env.production deleted file mode 100644 index 770f9e93c..000000000 --- a/.env.production +++ /dev/null @@ -1,85 +0,0 @@ -# ======================= -# 生产环境配置 -# ======================= -APP_ENV=production -APP_NAME=xiaoxia-saas -APP_VERSION=0.1.0 -DEBUG=false - -# ======================= -# API 服务配置 -# ======================= -API_HOST=0.0.0.0 -API_PORT=8000 -API_PREFIX=/api/v1 - -# ======================= -# Web 前端配置 -# ======================= -WEB_PORT=3000 -WEB_URL=https://xiaoxiajianji.com - -# ======================= -# 数据库配置 -# ======================= -DATABASE_URL=postgresql+psycopg://postgres:CHANGE_ME@postgres:5432/xiaoxia_saas_production -DATABASE_POOL_SIZE=50 -DATABASE_MAX_OVERFLOW=100 -DATABASE_POOL_TIMEOUT=30 -DATABASE_POOL_RECYCLE=3600 - -# ======================= -# Redis 配置 -# ======================= -REDIS_URL=redis://redis:6379/0 -REDIS_MAX_CONNECTIONS=100 - -# ======================= -# Celery Worker 配置 -# ======================= -CELERY_BROKER_URL=redis://redis:6379/0 -CELERY_RESULT_BACKEND=redis://redis:6379/1 -CELERY_WORKER_CONCURRENCY=8 -CELERY_WORKER_MAX_TASKS_PER_CHILD=1000 - -# ======================= -# OSS 对象存储配置 -# ======================= -OSS_ENDPOINT=47.98.113.167:9000 -OSS_ACCESS_KEY_ID=CHANGE_ME_PRODUCTION -OSS_ACCESS_KEY_SECRET=CHANGE_ME_PRODUCTION -OSS_BUCKET_NAME=xiaoxia-assets -OSS_SECURE=false -OSS_PUBLIC_URL=http://47.98.113.167:9000 - -# ======================= -# 日志配置 -# ======================= -LOG_LEVEL=INFO -LOG_FORMAT=json -LOG_FILE=/var/log/xiaoxia-saas/app.log - -# ======================= -# CORS 配置 -# ======================= -CORS_ORIGINS=https://xiaoxiajianji.com,https://api.xiaoxiajianji.com -CORS_ALLOW_CREDENTIALS=true - -# ======================= -# 文件上传限制 -# ======================= -MAX_UPLOAD_SIZE_MB=2000 -ALLOWED_FILE_TYPES=video/mp4,video/quicktime,video/x-msvideo,audio/mpeg,audio/wav,image/jpeg,image/png,image/gif - -# ======================= -# 安全配置 -# ======================= -SECRET_KEY=CHANGE_ME_TO_RANDOM_STRING_AT_LEAST_32_CHARS_IN_PRODUCTION -ACCESS_TOKEN_EXPIRE_MINUTES=60 -REFRESH_TOKEN_EXPIRE_DAYS=7 - -# ======================= -# 监控与追踪（可选） -# ======================= -# SENTRY_DSN= -# PROMETHEUS_PORT=9090 diff --git a/.env.staging b/.env.staging deleted file mode 100755 index d35a2461c..000000000 --- a/.env.staging +++ /dev/null @@ -1,85 +0,0 @@ -# ======================= -# Staging 环境配置 -# ======================= -APP_ENV=staging -APP_NAME=xiaoxia-saas -APP_VERSION=0.1.0 -DEBUG=true - -# ======================= -# API 服务配置 -# ======================= -API_HOST=0.0.0.0 -API_PORT=8000 -API_PREFIX=/api/v1 - -# ======================= -# Web 前端配置 -# ======================= -WEB_PORT=3000 -WEB_URL=http://47.98.113.167:3001 - -# ======================= -# 数据库配置 -# ======================= -DATABASE_URL=postgresql+psycopg://postgres:CHANGE_ME_STAGING_DB_PASSWORD@postgres:5432/xiaoxia_saas_staging -DATABASE_POOL_SIZE=20 -DATABASE_MAX_OVERFLOW=40 -DATABASE_POOL_TIMEOUT=30 -DATABASE_POOL_RECYCLE=3600 - -# ======================= -# Redis 配置 -# ======================= -REDIS_URL=redis://redis:6379/1 -REDIS_MAX_CONNECTIONS=50 - -# ======================= -# Celery Worker 配置 -# ======================= -CELERY_BROKER_URL=redis://redis:6379/1 -CELERY_RESULT_BACKEND=redis://redis:6379/2 -CELERY_WORKER_CONCURRENCY=4 -CELERY_WORKER_MAX_TASKS_PER_CHILD=1000 - -# ======================= -# OSS 对象存储配置 -# ======================= -OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com -OSS_ACCESS_KEY_ID=CHANGE_ME_STAGING -OSS_ACCESS_KEY_SECRET=CHANGE_ME_STAGING -OSS_BUCKET_NAME=xiaoxia-assets -OSS_SECURE=false -OSS_PUBLIC_URL=http://47.98.113.167:9000 - -# ======================= -# 日志配置 -# ======================= -LOG_LEVEL=DEBUG -LOG_FORMAT=json -LOG_FILE=/var/log/xiaoxia-saas/staging.log - -# ======================= -# CORS 配置 -# ======================= -CORS_ORIGINS=http://47.98.113.167:3001,http://47.98.113.167:8001 -CORS_ALLOW_CREDENTIALS=true - -# ======================= -# 文件上传限制 -# ======================= -MAX_UPLOAD_SIZE_MB=1000 -ALLOWED_FILE_TYPES=video/mp4,video/quicktime,video/x-msvideo,audio/mpeg,audio/wav,image/jpeg,image/png,image/gif - -# ======================= -# 安全配置 -# ======================= -SECRET_KEY=CHANGE_ME_STAGING_SECRET_KEY -ACCESS_TOKEN_EXPIRE_MINUTES=60 -REFRESH_TOKEN_EXPIRE_DAYS=7 - -# ======================= -# 监控与追踪（可选） -# ======================= -# SENTRY_DSN= -# PROMETHEUS_PORT=9090 diff --git a/.gitignore b/.gitignore index d66e7eb58..cc8c9de84 100644 --- a/.gitignore +++ b/.gitignore @@ -20,9 +20,9 @@ ruff_cache/ .env .env.local .env.development -.env.production # 生产环境配置不提交（包含敏感信息） +.env.production +.env.staging !.env.example -!.env.staging # staging 配置可以提交 # OS / editor .DS_Store diff --git a/scripts/auto_merge_prs.sh b/scripts/auto_merge_prs.sh index e078ee05d..720b865a7 100755 --- a/scripts/auto_merge_prs.sh +++ b/scripts/auto_merge_prs.sh @@ -3,7 +3,7 @@ # 用法: ./scripts/auto_merge_prs.sh [target_branch] GITEA_API="https://git.xiaoxiajianji.com/api/v1" -TOKEN="1f8058d097e3942a9ed31c44382baf7f08311272" +TOKEN="${GITEA_API_TOKEN:?Please set GITEA_API_TOKEN environment variable}" REPO="xiaoxia/xiaoxia-saas" TARGET_BRANCH="${1:-develop}" diff --git a/scripts/ci_failure_check.sh b/scripts/ci_failure_check.sh index d109e6310..913b49583 100755 --- a/scripts/ci_failure_check.sh +++ b/scripts/ci_failure_check.sh @@ -1,7 +1,7 @@ #!/bin/bash # 检查最近 CI 运行状态，失败时输出告警 GITEA_API="https://git.xiaoxiajianji.com/api/v1" -TOKEN="1f8058d097e3942a9ed31c44382baf7f08311272" +TOKEN="${GITEA_API_TOKEN:?Please set GITEA_API_TOKEN environment variable}" REPO="xiaoxia/xiaoxia-saas" echo "=== CI Status Check ===" -- 2.54.0