smail
f60d3b0880
Some checks are pending
Security Checks / security (push) Waiting to run
统一 frontend、backend、test、test-log 和 out 目录，更新构建、部署及测试入口；纳入配置管理兼容与首次安全引导修复；排除本机配置、密钥和测试产物。
61 lines
1.8 KiB
YAML
61 lines
1.8 KiB
YAML
name: Security Checks
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
|
|
- name: Reject committed private keys
|
|
shell: bash
|
|
run: |
|
|
if git grep -n -E -- '-----BEGIN ([A-Z0-9 ]+ )?PRIVATE KEY-----'; then
|
|
echo 'Committed private key detected.'
|
|
exit 1
|
|
fi
|
|
- name: Setup Go environment
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
|
|
with:
|
|
go-version: '1.26.6'
|
|
- name: Setup Node.js for test runner
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version: 24
|
|
- name: Prepare frontend and Go embedded assets
|
|
run: |
|
|
npm install --global yarn@1.22.22
|
|
cd frontend
|
|
yarn install --frozen-lockfile
|
|
yarn test
|
|
yarn build
|
|
- name: Verify Go dependencies
|
|
run: cd backend && go mod verify
|
|
- name: Run Go tests
|
|
run: node test/run.mjs backend
|
|
- name: Run Go static analysis
|
|
run: cd backend && go vet ./...
|
|
- name: Run Go race tests
|
|
run: node test/run.mjs backend -race ./...
|
|
- name: Run Go security analysis
|
|
run: |
|
|
go install github.com/securego/gosec/v2/cmd/gosec@v2.22.10
|
|
cd backend && gosec ./...
|
|
- name: Scan Go vulnerabilities
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
|
|
cd backend && govulncheck ./...
|
|
- name: Verify frontend dependencies and lint
|
|
run: |
|
|
cd frontend
|
|
yarn audit --groups dependencies
|
|
yarn eslint . --ext .vue,.js,.jsx,.cjs,.mjs --ignore-path .gitignore
|