host
c127beaa98
Phase 1 of audit-hardening CI expansion (baseline origin/main aebc623):
- lint: ruff E9 hard gate; full E,F@120 report-only (baseline 111 items)
- typecheck: mypy default mode, production scope, report-only (baseline 24)
- security: bandit production scope, report-only (baseline 287, High 5)
- depscan: pip-audit on requirements-ci.txt, hard gate (0 vulns; repo has
no production dependency manifest, see summary)
- coverage: production 58 files, fail-under=75 (baseline measured 76%)
- release build: E9 + pip-audit hard gates before packaging; full reports
stay in host-verify to avoid drift
No production code changed; CI billing failure mode unchanged.
11 lines
483 B
Plaintext
11 lines
483 B
Plaintext
# CI 工具链固定版本（host-verify / release 共用）。
|
|
# 只含 CI 检查工具，不含生产运行依赖：生产代码除宿主侧延迟加载的
|
|
# psycopg/psycopg2 驱动外只用标准库，仓库内无 requirements 清单，
|
|
# 因此 pip-audit 目前只能审计本文件（见 workflow 注释与 PR 摘要）。
|
|
# 升级版本时须同步本地试跑结果，禁止只改版本号不验证。
|
|
ruff==0.17.3
|
|
bandit==1.9.4
|
|
mypy==2.4.1
|
|
coverage==7.17.0
|
|
pip-audit==2.10.1
|