50 lines
1.6 KiB
YAML
50 lines
1.6 KiB
YAML
# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
# 🛰️ 天眼密钥流审计 (Sky-Eye Credential Audit)
|
|
#
|
|
# 守护: PER-ZY001 铸渊 (Zhuyuan)
|
|
# 系统: SYS-GLW-0001
|
|
# 主控: TCS-0002∞ (冰朔)
|
|
#
|
|
# 功能:
|
|
# ① GOOGLE_DRIVE_SERVICE_ACCOUNT 密钥流完整性校验
|
|
# ② 依赖图扫描（工作流 + 脚本）
|
|
# ③ YAML 语法全量扫描
|
|
# ④ 审计报告归档至 System_Logs/
|
|
# ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
|
|
|
name: "🛰️ 天眼密钥流审计 (Sky-Eye Credential Audit)"
|
|
|
|
on:
|
|
schedule:
|
|
# 每天 UTC 14:00 (CST 22:00) 执行一次审计
|
|
- cron: "0 14 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
jobs:
|
|
credential-audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: "📦 Checkout"
|
|
uses: actions/checkout@v4
|
|
|
|
- name: "🛰️ Run Sky-Eye Credential Audit"
|
|
env:
|
|
GOOGLE_DRIVE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_DRIVE_SERVICE_ACCOUNT }}
|
|
run: node scripts/skyeye/credential-audit.js
|
|
|
|
- name: "📝 Commit audit report"
|
|
if: always()
|
|
run: |
|
|
git config user.name "zhuyuan-bot"
|
|
git config user.email "zhuyuan-bot@guanghulab.com"
|
|
git add System_Logs/ skyeye/logs/
|
|
if git diff --cached --quiet; then
|
|
echo "No changes to commit"
|
|
else
|
|
git commit -m "🛰️ [Sky-Eye Audit] credential audit report [skip ci]"
|
|
git push
|
|
fi
|