johnQ
b390c29af3
skill-gate / gate (pull_request) Waiting to run
- scan-skill.sh: loopback 不算风险、命中走允许清单 - 11 个文件的 /Users/<机器名> 绝对路径去环境化（脚本 $HOME、文档 ~） - 允许清单登记运维环境地址与示例占位符（非凭据），附理由 - scan: 57 warns -> 0 warns / 0 high - 新增 .gitea/workflows/skill-gate.yml（validate --strict + scan + catalog --check + 测试）
31 lines
731 B
YAML
31 lines
731 B
YAML
name: skill-gate
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- "skills-**"
|
|
- "scripts/**"
|
|
- "install-skills.sh"
|
|
- "catalog.json"
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- "skills-**"
|
|
- "scripts/**"
|
|
- "install-skills.sh"
|
|
- "catalog.json"
|
|
|
|
jobs:
|
|
gate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: 规范校验（strict：警告也算失败）
|
|
run: python3 scripts/validate-skills.py --strict
|
|
- name: 安全扫描（禁止高危项）
|
|
run: ./scripts/scan-skill.sh
|
|
- name: catalog 是否最新
|
|
run: python3 scripts/generate-catalog.py --check
|
|
- name: 安装器测试
|
|
run: bash tests/install-skills.test.sh
|