ci: add dependency audit workflow
This commit is contained in:
Your Name
parent
574e4e4c70
commit
0768f84802
42
.github/workflows/dependency-audit.yml
vendored
Normal file
42
.github/workflows/dependency-audit.yml
vendored
Normal file
@ -0,0 +1,42 @@
|
||||
name: Dependency Audit
|
||||
|
||||
on:
|
||||
push:
|
||||
pull_request:
|
||||
schedule:
|
||||
- cron: "17 3 * * 1"
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
concurrency:
|
||||
group: dependency-audit-${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
audit:
|
||||
runs-on: ubuntu-22.04
|
||||
timeout-minutes: 10
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Install pnpm
|
||||
uses: pnpm/action-setup@v4
|
||||
with:
|
||||
version: 9.12.3
|
||||
run_install: false
|
||||
|
||||
- name: Use Node.js 20
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: 20
|
||||
cache: "pnpm"
|
||||
|
||||
- name: Install dependencies
|
||||
run: pnpm install --frozen-lockfile
|
||||
|
||||
- name: Audit high and critical dependency advisories
|
||||
run: pnpm audit:security
|
||||
@ -104,7 +104,7 @@ components/home/lovart/ Lovart home focused render sections
|
||||
lib/ DB, AI providers, storage, observability, domain logic
|
||||
docs/ Deployment, operations, architecture and feature notes
|
||||
tests/ Playwright e2e and route-level tests
|
||||
.github/workflows/ Quality gates and Playwright CI
|
||||
.github/workflows/ Quality gates, dependency audit and Playwright CI
|
||||
```
|
||||
|
||||
## 部署与运维
|
||||
@ -112,6 +112,7 @@ tests/ Playwright e2e and route-level tests
|
||||
- 生产部署建议使用受控反向代理，并只在 Host 头可信时设置 `AUTH_TRUST_HOST=true`。
|
||||
- 首页公开接口应保持快速返回，慢数据库或外部服务异常时返回缓存或 fallback。
|
||||
- 生产日志默认通过 `LOG_LEVEL=info` 控制，敏感字段会被 `lib/observability` 脱敏。
|
||||
- Dependency Audit workflow 独立守住 high/critical 依赖审计基线，避免安全回归只靠人工发现。
|
||||
- Playwright workflow 独立于基础质量门禁，避免把密钥依赖和 e2e 成本混入每次 lint/typecheck。
|
||||
|
||||
详细说明：
|
||||
|
||||
@ -17,6 +17,8 @@ pnpm --silent audit:security:json > audit-security.json
|
||||
The explicit registry is intentional. Some mirrors do not implement the npm audit endpoint, which makes audit fail for infrastructure reasons rather than project reasons.
|
||||
Use `pnpm --silent audit:security:json` when another script needs machine-readable JSON without pnpm's script header.
|
||||
|
||||
GitHub Actions also runs `.github/workflows/dependency-audit.yml` on push, pull request, weekly schedule and manual dispatch. Keep that workflow independent from the fast quality gate so registry or network issues do not hide lint/typecheck feedback.
|
||||
|
||||
## Current Snapshot
|
||||
|
||||
`pnpm --silent audit:security:json` currently reports:
|
||||
@ -40,7 +42,7 @@ The previous local baseline was Critical: 2 / High: 31. The remediation batches
|
||||
|
||||
## Release Policy
|
||||
|
||||
- Keep `pnpm audit:security` as a pre-release and PR review command rather than embedding it in `pnpm check:quality`; the registry-backed audit endpoint can fail for network or mirror reasons.
|
||||
- Keep `pnpm audit:security` in the independent Dependency Audit workflow and as a pre-release review command rather than embedding it in `pnpm check:quality`; the registry-backed audit endpoint can fail for network or mirror reasons.
|
||||
- New direct dependencies should be checked with `pnpm audit:security` before merging.
|
||||
- Critical advisories in runtime dependencies should block production release unless they are proven unreachable and documented here.
|
||||
- High advisories should have either a remediation PR or an explicit risk acceptance note before commercial deployment.
|
||||
|
||||
@ -37,6 +37,8 @@ pnpm check:quality
|
||||
|
||||
CI 和本地提交前检查复用同一个入口，避免规则漂移。
|
||||
|
||||
`.github/workflows/dependency-audit.yml` 独立运行 `pnpm audit:security`，在 push、pull request、每周定时任务和手动触发时守住 high/critical 依赖审计基线。它不依赖任何 secret，避免开源 PR 因环境变量缺失误失败。
|
||||
|
||||
Playwright workflow 独立运行，避免 e2e 依赖、浏览器安装和 secrets 影响基础门禁反馈速度。
|
||||
|
||||
Dependabot 每周检查 npm/pnpm 依赖和 GitHub Actions。依赖 PR 仍需按 PR 模板运行 `pnpm check:quality` 和路由烟测，不应自动合并。
|
||||
@ -48,7 +50,7 @@ pnpm audit:security
|
||||
pnpm audit:security:json
|
||||
```
|
||||
|
||||
`pnpm audit:security` 显式使用官方 npm registry，避免镜像源缺少 audit endpoint 导致误失败。当前依赖安全债务记录在 [dependency-risk-register.md](dependency-risk-register.md)。在 critical/high baseline 清零或形成正式例外策略前，不把 audit 纳入 `pnpm check:quality`。
|
||||
`pnpm audit:security` 显式使用官方 npm registry，避免镜像源缺少 audit endpoint 导致误失败。当前依赖安全债务记录在 [dependency-risk-register.md](dependency-risk-register.md)。本命令不嵌入 `pnpm check:quality`，而是由独立 Dependency Audit workflow 持续执行，避免网络型 registry 故障拖垮基础 lint/typecheck 反馈。
|
||||
|
||||
## 日志治理
|
||||
|
||||
|
||||
@ -15,7 +15,7 @@ SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
|
||||
预期：
|
||||
|
||||
- `pnpm check:quality` 通过 lint、日志脱敏门禁、公开交付面品牌治理、CI hygiene、环境变量示例卫生、secret hygiene、package metadata、测试门禁卫生、轻量 helper 回归测试、类型检查、diff hygiene 和 tracked 污染物检查。
|
||||
- `pnpm audit:security` 输出已审计；若仍有 critical/high，必须在 [dependency-risk-register.md](dependency-risk-register.md) 中记录 remediation 或风险接受状态。
|
||||
- `pnpm audit:security` 输出已审计，Dependency Audit workflow 也应通过；若仍有 critical/high，必须在 [dependency-risk-register.md](dependency-risk-register.md) 中记录 remediation 或风险接受状态。
|
||||
- `pnpm smoke:routes` 验证 `/` 返回 200。
|
||||
- `/classic` 和 `/chat/test-id` 重定向到 `/`。
|
||||
- `/settings` 未登录重定向到 `/login?callbackUrl=%2Fsettings`。
|
||||
@ -26,7 +26,7 @@ SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
|
||||
- `/settings` 本地 AI 设置已组件化，保存 key、SWR key 和业务 API 保持稳定。
|
||||
- 首页采用轻量壳优先渲染，个性化和公开数据渐进加载。
|
||||
- 高风险日志链路已纳入 `pnpm check:logs`，禁止回流裸 `console.*`。
|
||||
- CI 基础门禁与本地 `pnpm check:quality` 使用同一套污染物检查脚本。
|
||||
- CI 基础门禁与本地 `pnpm check:quality` 使用同一套污染物检查脚本；Dependency Audit workflow 独立守住 high/critical 依赖审计基线。
|
||||
- 安全披露、敏感信息和日志规则以根目录 `SECURITY.md` 为准。
|
||||
- 分支、提交、PR 和验证要求以根目录 `CONTRIBUTING.md` 为准。
|
||||
|
||||
@ -40,7 +40,7 @@ SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
|
||||
## 已知后续专项
|
||||
|
||||
- 远端 GitHub Actions 实跑结果需要在 push/PR 后确认。
|
||||
- 当前依赖 audit baseline 仍需分批 remediation；详见 [dependency-risk-register.md](dependency-risk-register.md)。
|
||||
- 当前依赖 audit baseline 已清除 critical/high；moderate/low 和未来 advisories 继续通过 [dependency-risk-register.md](dependency-risk-register.md) 跟踪。
|
||||
- Enhance、Angle Edit、Prompt Optimizer 等历史接口仍可继续分批纳入日志门禁。
|
||||
- Canvas/Agent 少数大型历史模块仍可继续领域化拆分，但不阻塞当前交付基线。
|
||||
- License 以仓库根目录 `LICENSE` 为准；如商业分发策略变化，应单独进行法律审查。
|
||||
|
||||
@ -23,6 +23,7 @@ const governedFiles = [
|
||||
".github/ISSUE_TEMPLATE/bug_report.yml",
|
||||
".github/ISSUE_TEMPLATE/config.yml",
|
||||
".github/ISSUE_TEMPLATE/feature_request.yml",
|
||||
".github/workflows/dependency-audit.yml",
|
||||
".github/workflows/lint.yml",
|
||||
".github/workflows/playwright.yml",
|
||||
];
|
||||
|
||||
@ -2,7 +2,11 @@
|
||||
|
||||
import { readFileSync } from "node:fs";
|
||||
|
||||
const workflowFiles = [".github/workflows/lint.yml", ".github/workflows/playwright.yml"];
|
||||
const workflowFiles = [
|
||||
".github/workflows/dependency-audit.yml",
|
||||
".github/workflows/lint.yml",
|
||||
".github/workflows/playwright.yml",
|
||||
];
|
||||
const violations = [];
|
||||
|
||||
const assertIncludes = (file, source, expected, reason) => {
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user