mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/Mapleawaa/PVE-Tools-9.git
synced 2026-09-20 08:03:35 +08:00
d8b3d9fbdf
Unify all menus on lib/menu.sh (run_menu), harden GPU/GRUB writes with two-tier confirms and markers, fix remote/self-update to Releases assets, and close real CI quality gates with SHA256SUMS. Bump to 11.0.0 / Liino.
87 lines
3.7 KiB
YAML
87 lines
3.7 KiB
YAML
name: PR Validation
|
||
on:
|
||
pull_request:
|
||
branches: [ main, beta ]
|
||
|
||
jobs:
|
||
validate:
|
||
runs-on: ubuntu-latest
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Shellcheck
|
||
run: |
|
||
shellcheck -f gcc PVE-Tools.sh > shellcheck_results.txt || true
|
||
cat shellcheck_results.txt || true
|
||
if grep -q "error\|warning" shellcheck_results.txt; then
|
||
echo "Shellcheck found issues. Please fix them before merging."
|
||
exit 1
|
||
fi
|
||
|
||
- name: Shellcheck (lib and modules, error level)
|
||
run: |
|
||
# 全量源码 error 级静态检查（入口与构建产物维持 error+warning 严格档）
|
||
find lib src/modules -name '*.sh' -print0 | xargs -0 shellcheck --severity=error -f gcc
|
||
|
||
- name: Shell syntax check
|
||
run: |
|
||
bash -n PVE-Tools.sh
|
||
bash -n dev.sh
|
||
bash build.sh
|
||
bash -n dist/PVE-Tools.sh
|
||
|
||
- name: Shellcheck (built script)
|
||
run: |
|
||
shellcheck -f gcc dist/PVE-Tools.sh > shellcheck_dist_results.txt || true
|
||
cat shellcheck_dist_results.txt || true
|
||
if grep -q "error\|warning" shellcheck_dist_results.txt; then
|
||
echo "Shellcheck found issues in built script. Please fix them before merging."
|
||
exit 1
|
||
fi
|
||
|
||
- name: Build output consistency check
|
||
run: |
|
||
# 断言 lib/ 与 src/modules/ 中定义的每个函数都进入了构建产物（双向一致）
|
||
diff <(grep -rhoE '^[a-zA-Z_][a-zA-Z0-9_]*\(\)' lib src/modules --include='*.sh' | sort -u) \
|
||
<(grep -hoE '^[a-zA-Z_][a-zA-Z0-9_]*\(\)' dist/PVE-Tools.sh | sort -u) \
|
||
|| { echo "构建产物与源码的函数集合不一致，见上方 diff（< 仅源码有 / > 仅产物有）"; exit 1; }
|
||
|
||
- name: Version consistency check
|
||
run: |
|
||
SCRIPT_VERSION=$(grep "CURRENT_VERSION=" lib/config.sh | cut -d'"' -f2)
|
||
VERSION_FILE_VERSION=$(cat VERSION 2>/dev/null)
|
||
if [ "$SCRIPT_VERSION" != "$VERSION_FILE_VERSION" ]; then
|
||
echo "Version inconsistency: script($SCRIPT_VERSION) != version file($VERSION_FILE_VERSION)"
|
||
exit 1
|
||
fi
|
||
|
||
- name: UPDATE changelog freshness check
|
||
run: |
|
||
# UPDATE 是 check_update 展示给线上用户的更新日志，首行必须包含当前版本号，防止再次脱节
|
||
VERSION_FILE_VERSION=$(cat VERSION)
|
||
if ! head -1 UPDATE | grep -qF "$VERSION_FILE_VERSION"; then
|
||
echo "UPDATE 首行未包含当前版本 $VERSION_FILE_VERSION —— 更新日志已脱节，请同步 UPDATE 文件"
|
||
exit 1
|
||
fi
|
||
|
||
- name: Security scan
|
||
run: |
|
||
# 对全量构建产物扫描真实危险模式，命中即失败
|
||
# （旧版对入口 grep eval/source 永远命中且从不失败，属于空转检查）
|
||
status=0
|
||
if grep -nE '(^|[^a-zA-Z_.])eval([^a-zA-Z_]|$)' dist/PVE-Tools.sh; then
|
||
echo "检测到 eval 使用：本项目约定禁止 eval，请改写后再合并"
|
||
status=1
|
||
fi
|
||
if grep -nE 'rm -rf +\$' dist/PVE-Tools.sh; then
|
||
echo "检测到未加引号且以变量开头的 rm -rf 路径：变量为空或含空格时行为不可控，请加引号与前置校验"
|
||
status=1
|
||
fi
|
||
if grep -nE '^[[:space:]]*(source|\.)[[:space:]]' dist/PVE-Tools.sh; then
|
||
echo "构建产物中不应存在 source 语句：dist 是自包含单文件，出现 source 说明拼接进了开发态加载代码"
|
||
status=1
|
||
fi
|
||
if [ "$status" -eq 0 ]; then
|
||
echo "Security scan passed"
|
||
fi
|
||
exit $status |