chore(v0.1.9): 商用加固 5 项 — audit/deny-panic CI + release-on-tag + 生产 unwrap 清零

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: CI
 on:
   push:
     branches: [main]
+    tags: ["v*"]
   pull_request:
     branches: [main]
 
@@ -41,11 +42,63 @@ jobs:
       - name: WASM build (fd-host-web)
         run: cargo build -p fd-host-web --target wasm32-unknown-unknown
 
+  # 依赖漏洞门禁（商用加固项 #1）。
+  # 失败不阻断主流程：cargo-audit 报告 advisories，作为早期预警。
+  audit:
+    name: cargo-audit (advisory scan)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain (1.94)
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.94"
+
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
+      - name: Audit dependencies for known advisories
+        run: cargo audit
+
+  # 生产代码零 panic 门禁（商用加固项 #3）。
+  # 当前基线：所有 panic!/unimplemented!/todo!/unreachable! 均在 #[cfg(test)] 模块内。
+  # 任何生产代码顶层 panic 语句将使该 job 失败，防未来回归。
+  deny-panic:
+    name: deny panic in production code
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Scan for top-level panic statements in non-test source
+        run: |
+          set -euo pipefail
+          # 检测 src/ 文件中行首的 panic!/unimplemented!/todo!/unreachable! 语句。
+          # 测试模块内（mod tests）的 panic! 在 match 臂断言中形如 "=> panic!("，
+          # 故排除含 "=>" 的行与 tests 路径，聚焦生产顶层语句。
+          # 注意：grep 无匹配返回非零，pipefail 下会触发 set -e 提前退出，
+          # 故用 || true 兜底，确保"零匹配"场景能正常走到 echo 与判断。
+          strict=$(grep -rnE "^\s*(panic!|unimplemented!|todo!|unreachable!)\(" \
+            crates/*/src/*.rs 2>/dev/null \
+            | grep -vE "tests|=>" \
+            | wc -l | tr -d ' ' || true)
+          echo "生产代码顶层 panic 语句数: $strict"
+          if [ "$strict" -ne 0 ]; then
+            echo "::error::生产代码含顶层 panic/unimplemented/todo/unreachable 语句，违反商用零 panic 约束"
+            grep -rnE "^\s*(panic!|unimplemented!|todo!|unreachable!)\(" \
+              crates/*/src/*.rs 2>/dev/null | grep -vE "tests|=>" || true
+            exit 1
+          fi
+
+  # 发布打包：改为 tag 触发 + continue-on-error（商用加固项 #2）。
+  # macos-14 runner 供给瓶颈不应阻塞 main CI 恒绿；tag 推送时尽力出包。
   release-pack:
     name: release tarball (apple silicon)
     runs-on: macos-14
-    if: github.ref == 'refs/heads/main'
+    if: startsWith(github.ref, 'refs/tags/v')
     needs: build-test
+    continue-on-error: true
     steps:
       - uses: actions/checkout@v4