fix: 修正禮物發放端點可被 GET 觸發與數量未驗證漏洞 (ZD-2026-00801) (#500) #49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test | |
| permissions: | |
| actions: write | |
| on: | |
| pull_request: | |
| push: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.head.sha || github.sha }} | |
| cancel-in-progress: true | |
| jobs: | |
| uv_list_upgrade: | |
| name: uv list upgradable dependencies | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v9.0.0 | |
| - name: Setup venv with Python ${{ matrix.python-version }} | |
| run: | | |
| uv venv --python ${{ matrix.python-version }} | |
| - name: Analysing upgradable dependencies with uv | |
| run: | | |
| uv tree --outdated | |
| uv lock --upgrade | |
| - name: Print diff using Git | |
| run: | | |
| git --no-pager diff | |
| pylint: | |
| name: Pylint | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v9.0.0 | |
| - name: Setup venv with Python ${{ matrix.python-version }} | |
| run: | | |
| uv venv --python ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| uv sync --dev --locked | |
| - name: Analysing the code with Pylint | |
| run: | | |
| git ls-files '*.py' | xargs -r uv run pylint | |
| - name: Delete cancelled runs in the same concurrency group | |
| if: matrix.python-version == '3.12' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TARGET_SHA: "${{ github.event.pull_request.head.sha || github.sha }}" | |
| run: | | |
| gh run list \ | |
| --workflow "${{ github.workflow }}" \ | |
| --commit "$TARGET_SHA" \ | |
| --status cancelled \ | |
| --json databaseId \ | |
| --jq ".[].databaseId | select(. != ${{ github.run_id }})" \ | |
| | xargs -I{} gh run delete {} | |
| pytest: | |
| name: Pytest | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13", "3.14"] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v9.0.0 | |
| - name: Setup venv with Python ${{ matrix.python-version }} | |
| run: | | |
| uv venv --python ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| uv sync --dev --locked | |
| - name: Analysing the code with Pytest | |
| run: | | |
| uv run pytest tests/pytest/ |