chore(v0.1.9): 商用加固 5 项 — audit/deny-panic CI + release-on-tag + 生产 unwrap 清零 - #15
Merged
Merged
Conversation
…nwrap 清零 为"商用万无一失"落地 5 个非阻塞加固项： 1. cargo-audit CI 门禁：新增 audit job 扫描依赖漏洞（continue-on-error 预警） 2. release-pack CI 鲁棒性：改为 tag 触发 + continue-on-error，macos runner 瓶颈不阻塞 main 恒绿 3. deny-panic CI 门禁：grep 校验生产代码顶层 panic/unimplemented/todo/unreachable = 0（基线 0） 4. 生产 unwrap 加固：fd-canvas-core compute_flex/compute_grid_layout 6 处 unwrap→match+warn+fallback 5. fd-design-lint 对齐 op-design-lint：确认 13 规则 + auto-fix 已为自建替身 验证：fmt size=0 / clippy -D warnings EXIT=0 / 369 passed 0 failed 1 ignored （加固后测试数不变）；生产 unwrap 清零；deny-panic 基线 0。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
grep 无匹配返回非零，set -e + pipefail 下在 echo 前提前退出（exit 1）， 导致"零 panic"这一正确状态反被判为失败。管道末尾 || true 兜底， 零匹配能正常走到 echo 与 if 判断。本地复现：生产代码顶层 panic 语句数: 0 → PASS。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lopdf 0.35.0 经 printpdf 0.8.2 引入，存在深层嵌套 PDF 对象栈溢出漏洞
（RUSTSEC-2026-0187，severity 7.5 high）。升级 printpdf 至 0.12.5，
其 lopdf 0.44.0 已修复（需 >=0.42.0）。
- 关闭 printpdf 默认 html feature，避免拉入 azul-layout/svg2pdf 重依赖
（我们仅用 ops::Op 内置字体 API）
- API 迁移：SetFontSizeBuiltinFont/WriteTextBuiltinFont →
SetFont{PdfFontHandle::Builtin}/ShowText（0.12 重命名）
- render_pdf 签名与输出 PDF 内容不变；369 测试全绿，fmt/clippy clean
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
dahai80
added a commit
that referenced
this pull request
Aug 8, 2026
PR #15 推送后两个加固 job 报错，已逐一修复并 CI 全绿，补记至 changelog 以保持文档与实际落地一致。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
商用加固 5 项（确保商用万无一失）
auditjob，cargo audit扫描依赖已知漏洞（continue-on-error预警不阻断）refs/tags/v*) +continue-on-error，macos-14 runner 瓶颈不再阻塞 main CI 恒绿deny-panicjob，grep 校验生产代码顶层 panic/unimplemented/todo/unreachable = 0（基线 0，防回归）fd-canvas-corecompute_flex_layout/compute_grid_layout6 处unwrap()→match+tracing::warn!+回退自由布局验证
cargo fmt --all --check：size=0cargo clippy --workspace --all-targets -- -D warnings：EXIT=0cargo test --workspace：369 passed / 0 failed / 1 ignored（加固后不变）🤖 Generated with Claude Code