lixi
8e1fe2f754
CI / docs-build (push) Successful in 44s
- 新增 scripts/check-secrets.sh 与 scripts/hooks/pre-commit（与 api/flutter 同构，规则单一来源） - ci.yml 在 checkout 后新增 Secret scan step；mkdocs build --strict 通过 - git-workflow.md 新增「凭证防泄漏检查」节：两层机制、启用命令、允许清单边界、真凭证轮换优先原则 - 验收：全仓 74 个已跟踪文件扫描零误报 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
36 lines
1.3 KiB
YAML
36 lines
1.3 KiB
YAML
# Gitea Actions 门禁：与 docs/development/git-workflow.md 的本地门禁同一条命令。
|
||
# 零外部 action / 零 GitHub 依赖；pip 走腾讯云 PyPI 镜像。
|
||
name: CI
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
pull_request:
|
||
|
||
concurrency:
|
||
group: ci-${{ github.ref }}
|
||
cancel-in-progress: true
|
||
|
||
jobs:
|
||
docs-build:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- name: Checkout (manual)
|
||
run: |
|
||
git init -q .
|
||
AUTH_URL=$(echo "${{ github.server_url }}" | sed "s#https://#https://oauth2:${{ github.token }}@#")
|
||
git remote add origin "$AUTH_URL/${{ github.repository }}.git"
|
||
git fetch -q --depth 1 origin "+${{ github.ref }}:refs/ci-head"
|
||
git checkout -q refs/ci-head
|
||
# 凭证防泄漏兜底（ADR-021）：与本地 pre-commit 同一脚本、同一规则表，
|
||
# 扫全部已跟踪文件（覆盖本次 push 变更的超集），纯 shell 零外部依赖。
|
||
- name: Secret scan
|
||
run: sh scripts/check-secrets.sh --all
|
||
- name: Install mkdocs
|
||
run: |
|
||
apt-get update -qq
|
||
apt-get install -y -qq --no-install-recommends mkdocs
|
||
# 与本地门禁同一命令；exit 0 且零 warning 方可合入（git-workflow.md）
|
||
- name: Build docs (strict)
|
||
run: mkdocs build --strict -d /tmp/site
|