gewuyou/GFramework
1
0
Fork 0
mirror of https://github.com/GeWuYou/GFramework.git synced 2026-03-22 10:34:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore(ci): 更新CI工作流配置以集成MegaLinter和SARIF报告

Browse Source 
- 在.gitleaks.toml中添加测试凭证白名单注释说明
- 为MegaLinter步骤添加代码质量检查和安全扫描功能
- 配置FAIL_ON_ERROR环境变量在main分支上失败时停止
- 添加SARIF报告上传步骤到GitHub安全中心
- 更新TruffleHog扫描步骤的中文注释说明
This commit is contained in:
GeWuYou 2026-02-02 12:20:56 +08:00
parent b4b26517ad
commit 5c8de84256
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/ci.yml vendored
View File

@ -23,11 +23,19 @@ jobs:
with: with:
fetch-depth: 0 fetch-depth: 0
# MegaLinter扫描步骤 # MegaLinter扫描步骤
# 执行代码质量检查和安全扫描，生成SARIF格式报告
- name: MegaLinter - name: MegaLinter
uses: oxsecurity/megalinter@v9.3.0 uses: oxsecurity/megalinter@v9.3.0
continue-on-error: true continue-on-error: true
env: env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
FAIL_ON_ERROR: ${{ github.ref == 'refs/heads/main' }}
# 上传SARIF格式的安全和代码质量问题报告到GitHub安全中心
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: megalinter-reports/sarif
# TruffleHog OSS 扫描步骤 # TruffleHog OSS 扫描步骤
# 使用 TruffleHog 工具扫描代码库中的敏感信息泄露，如API密钥、密码等 # 使用 TruffleHog 工具扫描代码库中的敏感信息泄露，如API密钥、密码等
# 该步骤会比较基础分支和当前提交之间的差异，检测新增内容中是否包含敏感数据 # 该步骤会比较基础分支和当前提交之间的差异，检测新增内容中是否包含敏感数据

2
.gitleaks.toml
View File

@ -1,3 +1,5 @@
# Allowlist for fake/test/demo secrets only
# DO NOT add real credentials here
[allowlist] [allowlist]
description = "Ignore test/demo secrets" description = "Ignore test/demo secrets"