完善不同加密方法的使用

2026-09-30 15:49:12 +08:00
parent 034315ddbd
commit 7db722f8b9
69 changed files with 21362 additions and 2563 deletions
@@ -0,0 +1,116 @@
+name: CI
+
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: 构建 / 静态检查 / 测试
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # 格式检查：任何未 gofmt 的文件都会让 CI 失败
+      - name: gofmt
+        run: |
+          unformatted="$(gofmt -l .)"
+          if [ -n "$unformatted" ]; then
+            echo "以下文件未通过 gofmt："
+            echo "$unformatted"
+            exit 1
+          fi
+
+      - name: go vet
+        run: go vet ./...
+
+      # staticcheck 能发现 go vet 覆盖不到的问题（死代码、永不匹配的条件、
+      # 误用标准库等）。本仓库在 ecdsax/ 下有 staticcheck.conf，对 SA1019 做了
+      # 定向豁免并写明了理由。
+      - name: staticcheck
+        run: |
+          go install honnef.co/go/tools/cmd/staticcheck@latest
+          staticcheck ./...
+
+      - name: go build
+        run: go build ./...
+
+      # -race 能发现并发使用中的问题；本库的函数应全部可并发调用
+      - name: go test
+        run: go test -race -covermode=atomic -coverprofile=coverage.txt ./...
+
+      - name: 覆盖率摘要
+        run: go tool cover -func=coverage.txt | tail -n 20
+
+      - name: 上传覆盖率
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: coverage.txt
+
+  vulncheck:
+    name: 依赖漏洞扫描
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # govulncheck 只报告「代码确实会走到」的漏洞，比单纯比对版本号更准
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+  fuzz:
+    name: 模糊测试冒烟
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # 每个目标短跑一段时间。解密路径的输入直接来自不可信来源，这里是对
+      # "绝不 panic" 承诺的持续验证。
+      - name: fuzz 冒烟
+        run: |
+          for target in FuzzDecryptNeverPanics FuzzDecryptWithIVNeverPanics \
+                        FuzzSymmetricRoundTrip FuzzAEADTamperDetection; do
+            echo "===== $target ====="
+            go test -run='^$' -fuzz="^${target}$" -fuzztime=30s .
+          done
+
+  tidy:
+    name: go.mod 一致性
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # 确保 go.mod / go.sum 与源码 import 保持一致
+      - name: go mod tidy 检查
+        run: |
+          cp go.mod go.mod.bak
+          cp go.sum go.sum.bak
+          go mod tidy
+          diff -u go.mod.bak go.mod
+          diff -u go.sum.bak go.sum