mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-10-07 16:48:45 +08:00
feeeei
cbe258fd12
- go.mod 1.26.6 → 1.27.0；backend-ci/release/security-scan 的 go version 断言、
三个 Dockerfile 的 golang 镜像、README 徽章与 DEV_GUIDE 同步
- golangci-lint-action v2.9 → v2.13（v2.9 由 go1.26 构建，拒绝 go.mod 1.27 目标）；
新规则按最小方式处理：排除 G703/G704 污点分析（网关按配置转发/写文件，
与既有 G304 排除策略一致）、reflect.Ptr → reflect.Pointer、
ResetQuota 恒返回错误的 SA4023 与 OIDC EC JWK 的 SA1019 加 nolint
- ent 生成代码按 Go 1.27 默认 jsonv2 引擎重新生成：json.RawMessage 字段
生成为同类型别名 jsontext.Value（group.model_pricing / usage_cleanup_task.filters）
- x/net v0.56 在 go1.27 下包装标准库 HTTP/2：ConfigureTransports 经
RegisterProtocol("http/2") 打开 Protocols.HTTP2 而不再写 TLSNextProto，
ReadIdleTimeout/PingTimeout 建连时映射为 HTTP2Config.SendPingTimeout/PingTimeout；
keepalive 测试改断言 Protocols.HTTP2()，并补真实 HTTP/2 协商用例
59 lines
1.5 KiB
YAML
59 lines
1.5 KiB
YAML
name: Security Scan
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
schedule:
|
|
- cron: '0 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
backend-security:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: backend/go.mod
|
|
check-latest: false
|
|
cache-dependency-path: backend/go.sum
|
|
- name: Verify Go version
|
|
run: |
|
|
go version | grep -q 'go1.27.0'
|
|
- name: Run govulncheck
|
|
working-directory: backend
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
govulncheck ./...
|
|
|
|
frontend-security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v6
|
|
with:
|
|
version: 9
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v6
|
|
with:
|
|
node-version: '20'
|
|
cache: 'pnpm'
|
|
cache-dependency-path: frontend/pnpm-lock.yaml
|
|
- name: Install dependencies
|
|
working-directory: frontend
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Run pnpm audit
|
|
working-directory: frontend
|
|
run: |
|
|
pnpm audit --prod --audit-level=high --json > audit.json || true
|
|
- name: Check audit exceptions
|
|
run: |
|
|
python tools/check_pnpm_audit_exceptions.py \
|
|
--audit frontend/audit.json \
|
|
--exceptions .github/audit-exceptions.yml
|