feihong-code 7.2.0 → 7.5.0

package/.github/workflows/ci.yml

@@ -1,140 +1,180 @@
-# 飞虹 Code CI
-# 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
-#
-# 全流程离线：不使用任何 API key / Secrets，PR 来自 fork 也能安全跑完。
-name: CI
-
-on:
-  push:
-    branches: [master, main]
-  pull_request:
-  workflow_dispatch:
-
-env:
-  FH_OFFLINE: 'true'
-  FH_PROVIDERS: '[]'
-
-jobs:
-  # ---------- 1. 构建与离线闭环冒烟（多 Node 版本矩阵） ----------
-  build:
-    name: 构建 · Node ${{ matrix.node }}
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        node: [18, 20, 22]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node }}
-      - run: npm install
-      - name: 类型检查
-        run: npm run typecheck
-      - name: 编译
-        run: npm run build
-      - name: CLI 可用性
-        run: node dist/cli/index.js --version
-      - name: 离线端到端闭环
-        run: node dist/cli/index.js "离线冒烟：创建一个说明文件"
-      - name: 只读技能
-        run: |
-          node dist/cli/index.js /plan "实现登录并且添加支付"
-          node dist/cli/index.js /grill src
-
-  # ---------- 2. M4 企业能力（权限 / 审计 / 多租户 / 配额） ----------
-  enterprise:
-    name: 企业能力冒烟 (M4)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: npm install
-      - run: npm run build
-      - name: M4 断言套件（RBAC / 审计链 / 多租户 / 配额）
-        run: node scripts/verify-m4.mjs
-      - name: CLI 企业命令冒烟
-        env:
-          FH_HOME: ${{ runner.temp }}/fhhome
-          FH_TENANT: ci-tenant
-          FH_USER: ci-bot
-          FH_ROLE: developer
-        run: |
-          node dist/cli/index.js whoami
-          node dist/cli/index.js policy
-          node dist/cli/index.js "CI 离线任务"
-          node dist/cli/index.js audit --limit 10
-          node dist/cli/index.js audit verify
-          node dist/cli/index.js tenants
-      - name: 租户隔离断言（beta 不得看到 ci-tenant 的会话）
-        env:
-          FH_HOME: ${{ runner.temp }}/fhhome
-          FH_TENANT: beta-tenant
-          FH_ROLE: viewer
-        run: |
-          out=$(node dist/cli/index.js sessions)
-          echo "$out"
-          if echo "$out" | grep -q "CI 离线任务"; then
-            echo "::error::租户隔离失效：beta-tenant 读到了 ci-tenant 的会话"
-            exit 1
-          fi
-
-  # ---------- 3. 供应链与密钥安全 ----------
-  security:
-    name: 发布包安全检查
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-      - run: npm install
-      - run: npm run build
-      - name: 发布包不得包含密钥或源码
-        run: |
-          npm pack --dry-run 2>&1 | tee pack.txt
-          for bad in ".env" "src/" ".workbuddy" "policy.json" "id_rsa"; do
-            if grep -q "$bad" pack.txt; then
-              echo "::error::发布包中检出敏感条目: $bad"
-              exit 1
-            fi
-          done
-          echo "发布包白名单校验通过"
-      - name: 仓库内不得提交明文密钥
-        run: |
-          if git grep -nIE "sk-[A-Za-z0-9_-]{16,}" -- . ':!*.md' ':!scripts/verify-m4.mjs' ':!tests/unit/redact.test.ts'; then
-            echo "::error::检出疑似明文 API Key"
-            exit 1
-          fi
-          echo "密钥扫描通过"
-      - run: npm audit --omit=dev --audit-level=high
-        continue-on-error: true
-
-  # ---------- 4. 容器镜像构建校验（稳定部署） ----------
-  docker:
-    name: Docker 镜像构建校验
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: 构建镜像（不推送）
-        run: docker build -t feihong-code:ci .
-      - name: 冒烟：容器内企业命令可用
-        run: |
-          docker run --rm \
-            -e FH_ENTERPRISE=true -e FH_TENANT=ci -e FH_USER=ci -e FH_ROLE=developer \
-            feihong-code:ci whoami
-      - name: 冒烟：Web 控制台可启动
-        run: |
-          docker run --rm -d --name fhcode-smoke -p 8099:8080 \
-            -e FH_ENTERPRISE=true -e FH_WEB_TOKEN=ci-token -e FH_WEB_PORT=8080 \
-            feihong-code:ci serve --port 8080
-          sleep 3
-          code=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ci-token" http://localhost:8099/api/health)
-          docker rm -f fhcode-smoke
-          if [ "$code" != "200" ]; then
-            echo "::error::Web 控制台健康检查失败，HTTP=$code"
-            exit 1
-          fi
-          echo "Web 控制台健康检查通过 (HTTP 200)"
+# 飞虹 Code CI
+# 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+#
+# 全流程离线：不使用任何 API key / Secrets，PR 来自 fork 也能安全跑完。
+name: CI
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+  workflow_dispatch:
+
+env:
+  FH_OFFLINE: 'true'
+  FH_PROVIDERS: '[]'
+
+jobs:
+  # ---------- 1. 构建与离线闭环冒烟（多 Node 版本矩阵） ----------
+  build:
+    name: 构建 · Node ${{ matrix.node }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [18, 20, 22]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+      - run: npm install
+      - name: 类型检查
+        run: npm run typecheck
+      - name: 编译
+        run: npm run build
+      - name: CLI 可用性
+        run: node dist/cli/index.js --version
+      - name: 离线端到端闭环
+        run: node dist/cli/index.js "离线冒烟：创建一个说明文件"
+      - name: 只读技能
+        run: |
+          node dist/cli/index.js /plan "实现登录并且添加支付"
+          node dist/cli/index.js /grill src
+
+  # ---------- 2. M4 企业能力（权限 / 审计 / 多租户 / 配额） ----------
+  enterprise:
+    name: 企业能力冒烟 (M4)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm install
+      - run: npm run build
+      - name: M4 断言套件（RBAC / 审计链 / 多租户 / 配额）
+        run: node scripts/verify-m4.mjs
+      - name: CLI 企业命令冒烟
+        env:
+          FH_HOME: ${{ runner.temp }}/fhhome
+          FH_TENANT: ci-tenant
+          FH_USER: ci-bot
+          FH_ROLE: developer
+        run: |
+          node dist/cli/index.js whoami
+          node dist/cli/index.js policy
+          node dist/cli/index.js "CI 离线任务"
+          node dist/cli/index.js audit --limit 10
+          node dist/cli/index.js audit verify
+          node dist/cli/index.js tenants
+      - name: 租户隔离断言（beta 不得看到 ci-tenant 的会话）
+        env:
+          FH_HOME: ${{ runner.temp }}/fhhome
+          FH_TENANT: beta-tenant
+          FH_ROLE: viewer
+        run: |
+          out=$(node dist/cli/index.js sessions)
+          echo "$out"
+          if echo "$out" | grep -q "CI 离线任务"; then
+            echo "::error::租户隔离失效：beta-tenant 读到了 ci-tenant 的会话"
+            exit 1
+          fi
+
+  # ---------- 3. 供应链与密钥安全 ----------
+  security:
+    name: 发布包安全检查
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm install
+      - run: npm run build
+      - name: 发布包不得包含密钥或源码
+        run: |
+          npm pack --dry-run 2>&1 | tee pack.txt
+          for bad in ".env" "src/" ".workbuddy" "policy.json" "id_rsa"; do
+            if grep -q "$bad" pack.txt; then
+              echo "::error::发布包中检出敏感条目: $bad"
+              exit 1
+            fi
+          done
+          echo "发布包白名单校验通过"
+      - name: 仓库内不得提交明文密钥
+        run: |
+          if git grep -nIE "sk-[A-Za-z0-9_-]{16,}" -- . ':!*.md' ':!scripts/verify-m4.mjs' ':!tests/unit/redact.test.ts'; then
+            echo "::error::检出疑似明文 API Key"
+            exit 1
+          fi
+          echo "密钥扫描通过"
+      - run: npm audit --omit=dev --audit-level=high
+        continue-on-error: true
+
+  # ---------- 3b. 供应链安全：依赖漏洞 + SBOM（P0-2） ----------
+  supplychain:
+    name: 供应链安全 · 依赖扫描 + SBOM
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - run: npm install
+      # 1) npm audit：生产依赖 high 及以上漏洞视为失败（供应链准入证据）
+      - name: npm audit（生产依赖 high+）
+        run: npm audit --omit=dev --audit-level=high
+      # 2) osv-scanner：OSV 数据库全量扫描 lockfile
+      - name: osv-scanner（OSV 全量漏洞库）
+        uses: google/osv-scanner/actions/scanner@v2
+        with:
+          scan-args: |-
+            --format=sarif
+            --output=osv-scanner.sarif
+            .
+      - name: 上传 osv-scanner 结果
+        uses: actions/upload-artifact@v4
+        with:
+          name: osv-scanner.sarif
+          path: osv-scanner.sarif
+      # 3) SBOM 生成（CycloneDX，随版本发布的供应链物料清单）
+      - name: 生成 SBOM（CycloneDX）
+        run: |
+          npx --yes @cyclonedx/cyclonedx-npm --output-file sbom.cdx.json --omit dev
+          echo "SBOM 已生成"
+      - name: 上传 SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom.cdx.json
+          path: sbom.cdx.json
+      - name: SBOM 冒烟（非空 + 合法 JSON）
+        run: |
+          node -e "const s=require('./sbom.cdx.json'); if(!s.components||s.components.length===0){process.exit(1)} console.log('SBOM 组件数:', s.components.length)"
+
+  # ---------- 4. 容器镜像构建校验（稳定部署） ----------
+  docker:
+    name: Docker 镜像构建校验
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: 构建镜像（不推送）
+        run: docker build -t feihong-code:ci .
+      - name: 冒烟：容器内企业命令可用
+        run: |
+          docker run --rm \
+            -e FH_ENTERPRISE=true -e FH_TENANT=ci -e FH_USER=ci -e FH_ROLE=developer \
+            feihong-code:ci whoami
+      - name: 冒烟：Web 控制台可启动
+        run: |
+          docker run --rm -d --name fhcode-smoke -p 8099:8080 \
+            -e FH_ENTERPRISE=true -e FH_WEB_TOKEN=ci-token -e FH_WEB_PORT=8080 \
+            feihong-code:ci serve --port 8080
+          sleep 3
+          code=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: Bearer ci-token" http://localhost:8099/api/health)
+          docker rm -f fhcode-smoke
+          if [ "$code" != "200" ]; then
+            echo "::error::Web 控制台健康检查失败，HTTP=$code"
+            exit 1
+          fi
+          echo "Web 控制台健康检查通过 (HTTP 200)"