wangziqi
c6e1d94510
- fix(server): getCourseClock 固定 UTC+8（Asia/Shanghai），与 attendance-settlement 保持一致， 修复 CI（UTC 容器）下 attendance.lesson-session.spec.ts 失败 - chore(deps): @ant-design/x 2.9.0 / @ant-design/x-markdown 2.9.0 / mermaid 11.16.1； 直接依赖 dompurify 3.4.13（修复生产依赖 audit 漏洞，mermaid/x-markdown 复用同一份） - ci: 新增 dependency-check workflow（生产依赖 moderate+ / 全局 critical 失败，outdated 报告）
45 lines
1.3 KiB
YAML
45 lines
1.3 KiB
YAML
name: Dependency Check
|
||
|
||
# 依赖安全检查：生产依赖 moderate+ 或全局 critical 漏洞即失败；
|
||
# npm outdated 作为信息输出，不阻断。
|
||
# 注意：npmmirror 未实现 audit 接口，audit 必须显式指定官方 registry。
|
||
|
||
env:
|
||
NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
|
||
NPM_CONFIG_AUDIT: "false"
|
||
NPM_CONFIG_FUND: "false"
|
||
NPM_CONFIG_REPLACE_REGISTRY_HOST: always
|
||
CI: "true"
|
||
|
||
on:
|
||
pull_request:
|
||
branches: [main]
|
||
schedule:
|
||
- cron: '30 2 * * 1' # 每周一 02:30 复查已发布的新漏洞
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
check:
|
||
runs-on: ubuntu-latest
|
||
container: node:22.22.0-bookworm
|
||
timeout-minutes: 20
|
||
|
||
steps:
|
||
- name: Checkout
|
||
uses: https://gitee.com/mirrors_actions/checkout@v4
|
||
with:
|
||
github-server-url: https://git.gongxue100.com
|
||
fetch-depth: 1
|
||
|
||
- name: Install dependencies
|
||
run: npm ci
|
||
|
||
- name: Audit production dependencies (moderate+)
|
||
run: npm audit --registry=https://registry.npmjs.org --omit=dev --audit-level=moderate
|
||
|
||
- name: Audit all dependencies (critical only)
|
||
run: npm audit --registry=https://registry.npmjs.org --audit-level=critical
|
||
|
||
- name: Outdated report (informational)
|
||
run: npm outdated --registry=https://registry.npmjs.org || true
|