Skip to content

Commit 9dfed48

Browse files
BaronChainBaronChain
committed
Merge remote-tracking branch 'upstream/main'
# Conflicts: # .gitattributes
2 parents 93ca665 + e34ad2b commit 9dfed48

2,354 files changed

Lines changed: 879369 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# =============================================================================
2+
# Docker Ignore File for Sub2API
3+
# =============================================================================
4+
5+
# Git
6+
.git
7+
.gitignore
8+
.gitattributes
9+
10+
# Documentation
11+
*.md
12+
!deploy/DOCKER.md
13+
docs/
14+
15+
# IDE
16+
.idea/
17+
.vscode/
18+
*.swp
19+
*.swo
20+
21+
# OS files
22+
.DS_Store
23+
Thumbs.db
24+
25+
# Build artifacts
26+
dist/
27+
build/
28+
29+
# Node modules (will be installed in container)
30+
frontend/node_modules/
31+
node_modules/
32+
33+
# Go build cache (will be built in container)
34+
backend/vendor/
35+
36+
# Test files
37+
*_test.go
38+
**/*.test.js
39+
coverage/
40+
.nyc_output/
41+
42+
# Environment files
43+
.env
44+
.env.*
45+
!.env.example
46+
47+
# Local config
48+
config.yaml
49+
config.local.yaml
50+
51+
# Logs
52+
*.log
53+
logs/
54+
55+
# Temporary files
56+
tmp/
57+
temp/
58+
*.tmp
59+
60+
# Deploy files (not needed in image)
61+
deploy/install.sh
62+
deploy/sub2api.service
63+
deploy/sub2api-sudoers
64+
deploy/data/
65+
deploy/postgres_data/
66+
deploy/redis_data/
67+
68+
# GoReleaser
69+
.goreleaser.yaml
70+
71+
# GitHub
72+
.github/
73+
74+
# Claude files
75+
.claude/
76+
issues/
77+
CLAUDE.md

‎.gitattributes‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,25 @@
11
# Auto detect text files and perform LF normalization
22
* text=auto
3+
4+
# 确保所有 SQL 迁移文件使用 LF 换行符
5+
backend/migrations/*.sql text eol=lf
6+
7+
# Go 源代码文件
8+
*.go text eol=lf
9+
10+
# 前端 源代码文件
11+
*.ts text eol=lf
12+
*.tsx text eol=lf
13+
*.js text eol=lf
14+
*.jsx text eol=lf
15+
*.vue text eol=lf
16+
17+
# Shell 脚本
18+
*.sh text eol=lf
19+
20+
# YAML/YML 配置文件
21+
*.yaml text eol=lf
22+
*.yml text eol=lf
23+
24+
# Dockerfile
25+
Dockerfile text eol=lf

‎.github/audit-exceptions.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
version: 1
2+
exceptions:
3+
- package: xlsx
4+
advisory: "GHSA-4r6h-8v6p-xvw6"
5+
severity: high
6+
reason: "Admin export only; switched to dynamic import to reduce exposure (CVE-2023-30533)"
7+
mitigation: "Load only on export; restrict export permissions and data scope"
8+
expires_on: "2026-07-06"
9+
owner: "security@your-domain"
10+
- package: xlsx
11+
advisory: "GHSA-5pgg-2g8v-p4x9"
12+
severity: high
13+
reason: "Admin export only; switched to dynamic import to reduce exposure (CVE-2024-22363)"
14+
mitigation: "Load only on export; restrict export permissions and data scope"
15+
expires_on: "2026-07-06"
16+
owner: "security@your-domain"
17+
- package: lodash
18+
advisory: "GHSA-r5fr-rjxr-66jc"
19+
severity: high
20+
reason: "lodash _.template not used with untrusted input; only internal admin UI templates"
21+
mitigation: "No user-controlled template strings; plan to migrate to lodash-es tree-shaken imports"
22+
expires_on: "2026-07-02"
23+
owner: "security@your-domain"
24+
- package: lodash-es
25+
advisory: "GHSA-r5fr-rjxr-66jc"
26+
severity: high
27+
reason: "lodash-es _.template not used with untrusted input; only internal admin UI templates"
28+
mitigation: "No user-controlled template strings; plan to migrate to native JS alternatives"
29+
expires_on: "2026-07-02"
30+
owner: "security@your-domain"
31+
- package: axios
32+
advisory: "GHSA-3p68-rc4w-qgx5"
33+
severity: critical
34+
reason: "NO_PROXY bypass not exploitable; all API calls go to known endpoints via server-side proxy"
35+
mitigation: "Proxy configuration not user-controlled; upgrade when axios releases fix"
36+
expires_on: "2026-07-10"
37+
owner: "security@your-domain"

‎.github/workflows/backend-ci.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
pull_request:
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
test:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v6
15+
- uses: actions/setup-go@v6
16+
with:
17+
go-version-file: backend/go.mod
18+
check-latest: false
19+
cache: true
20+
cache-dependency-path: backend/go.sum
21+
- name: Verify Go version
22+
run: |
23+
go version | grep -q 'go1.26.4'
24+
- name: Unit tests
25+
working-directory: backend
26+
run: make test-unit
27+
- name: Integration tests
28+
working-directory: backend
29+
run: make test-integration
30+
31+
frontend:
32+
runs-on: ubuntu-latest
33+
steps:
34+
- uses: actions/checkout@v6
35+
- name: Setup pnpm
36+
uses: pnpm/action-setup@v4
37+
with:
38+
version: 9
39+
- name: Setup Node.js
40+
uses: actions/setup-node@v6
41+
with:
42+
node-version: '20'
43+
cache: 'pnpm'
44+
cache-dependency-path: frontend/pnpm-lock.yaml
45+
- name: Install frontend dependencies
46+
working-directory: frontend
47+
run: pnpm install --frozen-lockfile
48+
- name: Frontend typecheck and critical vitest
49+
run: make test-frontend
50+
51+
golangci-lint:
52+
runs-on: ubuntu-latest
53+
steps:
54+
- uses: actions/checkout@v6
55+
- uses: actions/setup-go@v6
56+
with:
57+
go-version-file: backend/go.mod
58+
check-latest: false
59+
cache: true
60+
cache-dependency-path: backend/go.sum
61+
- name: Verify Go version
62+
run: |
63+
go version | grep -q 'go1.26.4'
64+
- name: golangci-lint
65+
uses: golangci/golangci-lint-action@v9
66+
with:
67+
version: v2.9
68+
args: --timeout=30m
69+
working-directory: backend

‎.github/workflows/cla.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: "CLA Assistant"
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
pull_request_target:
7+
types: [opened, reopened, closed, synchronize]
8+
9+
permissions:
10+
actions: write
11+
contents: write
12+
pull-requests: write
13+
statuses: write
14+
15+
jobs:
16+
cla-check:
17+
if: |
18+
github.repository == 'Wei-Shaw/sub2api' &&
19+
(
20+
github.event_name == 'issue_comment' ||
21+
(github.event_name == 'pull_request_target' && github.event.action != 'closed')
22+
)
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: "CLA Assistant"
26+
if: |
27+
(github.event.comment.body == 'recheck' ||
28+
github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') ||
29+
github.event_name == 'pull_request_target'
30+
uses: contributor-assistant/github-action@v2.6.1
31+
env:
32+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
33+
with:
34+
path-to-signatures: "cla.json"
35+
path-to-document: "https://github.com/Wei-Shaw/sub2api/blob/main/CLA.md"
36+
branch: "cla-signatures"
37+
allowlist: "dependabot[bot],renovate[bot],bot*"
38+
lock-pullrequest-aftermerge: false
39+
custom-notsigned-prcomment: |
40+
Thank you for your contribution! Before we can merge this PR, we need $you to sign our [Contributor License Agreement (CLA)](https://github.com/Wei-Shaw/sub2api/blob/main/CLA.md).
41+
42+
**To sign**, please reply with the following comment:
43+
44+
> I have read the CLA Document and I hereby sign the CLA
45+
46+
You only need to sign once — it will be valid for all your future contributions to this project.
47+
custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA"
48+
custom-allsigned-prcomment: "All contributors have signed the CLA. ✅"
49+
50+
cla-lock:
51+
if: |
52+
github.repository == 'Wei-Shaw/sub2api' &&
53+
github.event_name == 'pull_request_target' &&
54+
github.event.action == 'closed' &&
55+
github.event.pull_request.merged == true
56+
runs-on: ubuntu-latest
57+
steps:
58+
- name: "Lock merged PR"
59+
uses: contributor-assistant/github-action@v2.6.1
60+
env:
61+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
62+
with:
63+
path-to-signatures: "cla.json"
64+
path-to-document: "https://github.com/Wei-Shaw/sub2api/blob/main/CLA.md"
65+
branch: "cla-signatures"
66+
lock-pullrequest-aftermerge: true

0 commit comments

Comments
 (0)