Merge pull request #12 from Jerry-CodeHub/fix/security-headers #98
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Deploy to GitHub Pages | |
| on: | |
| push: | |
| branches: | |
| - master | |
| concurrency: | |
| group: gh-pages-deploy | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-deploy: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7.0.1 | |
| - name: Setup pnpm（读 packageManager 字段） | |
| uses: pnpm/action-setup@v6.1.0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v7.0.0 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: pnpm | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Type check | |
| run: pnpm run typecheck | |
| - name: Test | |
| run: pnpm test | |
| - name: Lint | |
| run: pnpm run lint | |
| - name: Build | |
| env: | |
| CESIUM_ION_TOKEN: ${{ secrets.CESIUM_ION_TOKEN }} | |
| # 可选：为演示站开启 Clarity 统计时配置（模板默认不含任何统计脚本） | |
| CLARITY_ID: ${{ secrets.CLARITY_ID }} | |
| run: pnpm run build:github | |
| - name: SPA fallback（子路由直链/刷新不 404） | |
| # GitHub Pages 对不存在的路径返回站点根的 404.html；复制入口页即可让前端路由接管 | |
| run: cp dist/index.html dist/404.html | |
| - name: Dist secrets scan（部署产物秘钥扫描，成功才允许部署） | |
| # 审计 2026-09-22 H-1：此前扫描只在 ci.yml（不注入 secret 的构建）上跑，扫的产物与 | |
| # 真正部署的产物不是同一份，门禁永真通过。这里对带 secret 构建的产物扫描： | |
| # EXPECTED_TOKEN 即本步骤注入的 ion token（客户端地图应用的凭据设计上必然公开）， | |
| # 脚本只以 sha256 指纹比对（不可逆、不落日志）；除它与 Cesium 默认 token 外的 | |
| # JWT / AWS/GitHub/PEM 等密钥特征一律判失败。 | |
| env: | |
| EXPECTED_TOKEN: ${{ secrets.CESIUM_ION_TOKEN }} | |
| run: node scripts/check-dist-secrets.mjs | |
| - name: Deploy to GitHub Pages | |
| uses: peaceiris/actions-gh-pages@v4.1.0 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| publish_dir: ./dist | |
| # 孤儿化部署：gh-pages 历史不累积（曾达 71 个提交/33MiB）， | |
| # 且旧产物（含已泄露未轮换的历史 token）不再被新克隆拉取。 | |
| # 注意：开启后首次部署将重建整棵部署树。 | |
| force_orphan: true |