Repository navigation
fix(deploy): 部署 workflow 加上守門，網頁加 meta CSP - #20
Merged
Merged
Conversation
- 部署手冊 2.4：CI 補上頂層 permissions；Pages workflow 頂層只留 contents: read，寫入權限放在 deploy job；所有 checkout 加 persist-credentials: false；發布前檢查 owner 與 main。 - CI 加入依賴稽核：npm audit（high／critical 失敗）、pip-audit（任何已知漏洞都失敗）。chromadb 目前最新版仍有 4 個未修漏洞，都在 Chroma 伺服器端點與 RBAC 授權模組；本專案以 langchain 內嵌本機資料夾使用，沒有啟動伺服器，所以只忽略這 4 個編號並註明原因。 - 部署手冊 2.2：index.html 加 meta CSP，只允許本站、Harbor 維護腳本與 Google Fonts；線上後端已退役，Pages 上不再允許連 Supabase 或 API。 驗證：npm audit 通過；pip-audit 除上述 4 個忽略項外無漏洞；建置後用 Chromium 實測 CSP 違規 0 筆，模擬 Harbor 維護中與正常兩種回應都正常，點擊 15 次按鈕沒有 CSP 違規或頁面錯誤。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
依 Harbor 部署手冊 2.2、2.4 調整。
修改
permissions: contents: read；Pages workflow 頂層只留contents: read，寫入權限放在 deploy job；所有 checkout 加persist-credentials: false；發布前檢查 owner 與 main。npm audit --audit-level=high、pip-audit（不分嚴重度）。frontend/index.html加 meta CSP：本站、Harbor 維護腳本、Google Fonts。線上後端已退役，Pages 上不再允許連 Supabase 或 API。驗證
npm audit通過；pip-audit除上述 4 個忽略項外無漏洞。Rollback
revert 這個 PR。
Generated by Claude Code