ci: 安全掃描與基礎驗證並行，不再等它綠燈 - #9
Merged
Merged
Conversation
本倉庫是公開的，Actions 分鐘數不計費——2026-08-12 把掃描接到基礎驗證 後面時，「紅燈時整組 skipped、省下執行器時間」那半條理由在這裡換不到 任何東西，只換到更晚才知道掃描的結論。 `security` job 拿掉 `needs:`，與基礎驗證同時起跑，並自己補上草稿 PR 的 `if:`——那一行原本是靠「被 needs: 的 job 因草稿 skipped 時一併 skipped」 傳遞過來的，少了它草稿 PR 會開始跑掃描。 `workflow_call` 的機制不動：改回自己掛 push／pull_request 雖然也是並行， 但會把檢查名稱從 `安全掃描 / Gitleaks` 變回 `Gitleaks`，動到按名字釘住的 分支保護，而且同一顆 commit 會變成兩次 run。 代價明確接受：建置壞掉時會多幾顆指向同一個根因的紅燈。 私有倉庫維持原樣，判準見 workspace AGENTS.md §1.9.1。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
為什麼
本倉庫是公開的，Actions 分鐘數不計費。2026-08-12 把安全掃描接到基礎驗證後面時，理由有兩半：
裁決是：公開倉庫不計 CI 成本，用那半條已經失效的理由換最快的回饋。私有倉庫維持原樣——那裡的分鐘數要付錢。
改了什麼
ci.yml：securityjob 拿掉needs: [links]，與內部連結同時起跑。ci.yml：securityjob 補上草稿 PR 的if:。那一行原本是靠「被needs:的 job 因草稿 skipped 時一併 skipped」傳遞過來的——少了它，草稿 PR 會開始跑掃描。這是本次唯一新增的邏輯。security.yml：檔頭三段描述閘門的註解改成描述並行。機制沒變，變的只有「等不等」。workflow_call保留。改回自己掛push／pull_request雖然也是並行，但會把檢查名稱從安全掃描 / Gitleaks變回Gitleaks（動到按名字釘住的分支保護），而且同一顆 commit 會變成兩次 run。同一個 workflow 裡沒有needs:的 job 本來就同時起跑，所以那兩個代價一個都不用付。代價
本倉庫的代價比其餘四個公開倉庫更小。 那條閘門擋的是「CodeQL 與 govulncheck 建不起來時吐出的第二顆紅燈」，而本倉庫兩者都沒有（只有 Markdown，沒有程式碼可以建）。Gitleaks 與 Trivy 本來就不建置任何東西——連結壞掉不會讓它們吐出與根因無關的紅燈。
驗證
actionlint（ci.yml＋security.yml）needs:且有草稿if:python3 tools/check-links.py這個 PR 本身是第一次真的驗證——非草稿，所以掃描應該與
內部連結同時起跑，而不是等它綠燈。判準與理由見 workspace
AGENTS.md§1.9.1。Generated by Claude Code