ci: 安全掃描與基礎驗證並行，不再等它綠燈 - #13
Merged
Merged
Conversation
本倉庫是公開的，Actions 分鐘數不計費——2026-08-12 把掃描接到基礎驗證 後面時，「紅燈時整組 skipped、省下執行器時間」那半條理由在這裡換不到 任何東西，只換到更晚才知道掃描的結論。 `security` job 拿掉 `needs:`，與基礎驗證同時起跑，並自己補上草稿 PR 的 `if:`——那一行原本是靠「被 needs: 的 job 因草稿 skipped 時一併 skipped」 傳遞過來的，少了它草稿 PR 會開始跑掃描。 `workflow_call` 的機制不動：改回自己掛 push／pull_request 雖然也是並行， 但會把檢查名稱從 `安全掃描 / Gitleaks` 變回 `Gitleaks`，動到按名字釘住的 分支保護，而且同一顆 commit 會變成兩次 run。 代價明確接受：建置壞掉時會多幾顆指向同一個根因的紅燈。 私有倉庫維持原樣，判準見 workspace AGENTS.md §1.9.1。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
為什麼
本倉庫是公開的，Actions 分鐘數不計費。2026-08-12 把安全掃描接到基礎驗證後面時，理由有兩半：
裁決是：公開倉庫不計 CI 成本，用那半條已經失效的理由換最快的回饋。私有倉庫維持原樣——那裡的分鐘數要付錢，兩半理由都還成立。
改了什麼
ci.yml：securityjob 拿掉needs: [go, js]，與基礎驗證同時起跑。ci.yml：securityjob 補上草稿 PR 的if:。那一行原本是靠「被needs:的 job 因草稿 skipped 時一併 skipped」傳遞過來的——少了它，草稿 PR 會開始跑掃描。這是本次唯一新增的邏輯。security.yml：檔頭三段描述閘門的註解改成描述並行。機制沒變，變的只有「等不等」。workflow_call保留。改回自己掛push／pull_request雖然也是並行，但會把檢查名稱從安全掃描 / Gitleaks變回Gitleaks（動到按名字釘住的分支保護），而且同一顆 commit 會變成兩次 run。同一個 workflow 裡沒有needs:的 job 本來就同時起跑，所以那兩個代價一個都不用付。代價
CodeQL 的 autobuild 與 govulncheck 都要先建置得起來。建置壞掉時它們會吐同一個編譯錯誤換一種包裝，所以一顆真的紅燈會伴隨幾顆指向同一個根因的紅燈。這次明確接受。
驗證
actionlint（ci.yml＋security.yml）needs:且有草稿if:go/：gofmt -l .、go build、go vet、go testjs/：npm test這個 PR 本身是第一次真的驗證——非草稿，所以掃描應該與
Go SDK／JS SDK同時起跑，而不是等它們綠燈。判準與理由見 workspace
AGENTS.md§1.9.1。Generated by Claude Code