Files
awoooi/.gitignore
Your Name d0591c54b0
Some checks failed
CD Pipeline / build-and-deploy (push) Failing after 35s
fix(security): 體健修復 — 7項 Critical/Major 安全問題全修
## Critical 修復 (C1-C5)
- C1: git rm --cached 03-secrets.yaml(CHANGE_ME 模板不再追蹤)
- C2: git rm --cached awoooi.db + .gitignore 加 *.db(SQLite HARD_RULES 違規)
- C3: sentry-tunnel SENTRY_HOST 改為 process.env fallback
- C4: config.py DATABASE_URL 移除 changeme default,改為必填
- C5: run_migration.py 改為 os.environ["DATABASE_URL"]

## Major 修復 (M1-M4)
- M1: auto_repair /execute 加 CSRF 保護 + AutoRepairPanel.tsx 同步
- M2: drift /rollback /adopt 加 CSRF 保護(/internal/scan 保持無 CSRF)
- M3: terminal /intent 加 CSRF 保護 + terminal.store.ts 同步
- M4: live-dashboard HOST_IPS + host-grid VIP 改為 env var

## 其他
- 新增 apps/web/.env.example(6 個 env var 說明)
- K8s deployment-web 補入 3 個新 env var
- 整合測試:新增 aider_event_repository + ai_router_feedback 真實 DB 測試
- test_terminal.py CSRF dependency override 修復

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-22 01:27:39 +08:00

95 lines
1.4 KiB
Plaintext
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# =============================================================================
# AWOOOI - .gitignore
# =============================================================================
# 依賴套件
node_modules/
.pnp
.pnp.js
yarn.lock
package-lock.json
# 測試與建置產物
coverage/
.next/
out/
build/
dist/
.turbo/
# Playwright 測試產物 (動態生成,不需版本控制)
**/playwright-report/
**/test-results/
**/.auth/
# 保留 Phase 19 參考截圖
!apps/web/test-results/phase19/
# Python
__pycache__/
*.py[cod]
*$py.class
.Python
*.so
.venv/
venv/
ENV/
# 環境變數與機密 (絕對不能進 Git)
.env
.env.*
.env.local
.env.*.local
!.env.example
!apps/**/.env.example
*.pem
*.key
secrets/
# 日誌
npm-debug.log*
yarn-debug.log*
.pnpm-debug.log*
*.log
# 編輯器設定
.vscode/*
!.vscode/extensions.json
!.vscode/settings.json
.idea/
*.swp
*.swo
# 系統檔案
.DS_Store
Thumbs.db
# Workspace 檔案 (本地使用,不需提交)
*.code-workspace
# Kubernetes 機密
*-secret.yaml
*-secrets.yaml
# SQLiteHARD_RULES 禁止,必須用 PostgreSQL
*.db
*.sqlite
*.sqlite3
# 暫存檔案
tmp/
temp/
*.tmp
# AI Tools & Agents (本地使用,不需提交到 Git)
# 防止 Claude Code worktrees 干擾 CI/CD checkout
.claude/worktrees/
.claude/scheduled_tasks.lock
.cursor/
.agents/memory/
playwright-mcp/
tsconfig.tsbuildinfo
.superpowers/
.aider*
!.aiderignore
.claude/settings.local.json