Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions 1 Packages Projects Releases 1 Wiki Activity

ci(i-g): Versionskonflikt-Praevention — pip check + npm audit Gates; Quote-Bug im SQL-Injection-Check gefixt

Browse Source 
(1) pip check erkennt inkonsistente Abhaengigkeiten zwischen installierten Paketen (transitive Constraints wie fastapi-pint-starlette). (2) npm audit --audit-level=high als Frontend-Gate. (3) Bonus-Fund: Zeile 73 hatte unbalancierte Quotes (text(f\"SELECT...{) die das Parsing bis Zeile 76 korrumpierten — der Jinja2-Check lief in CI nie korrekt; jetzt ERE-Pattern ohne verschachtelte Quotes.
This commit is contained in:
Agent Zero
2026-08-25 23:16:22 +02:00
parent a8916b3d86
commit a6bfa8e67c
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ci_pipeline.sh
+5 -1
View File
@@ -70,7 +70,7 @@ check "Backend Tests" "python3 -m pytest tests/ -x -q --tb=short 2>&1 | tail -5"
check "Frontend Tests" "cd frontend && npx vitest run --reporter=verbose 2>&1 | tail -5" check "Frontend Tests" "cd frontend && npx vitest run --reporter=verbose 2>&1 | tail -5"
# ── 7. Security: SQL Injection Check ───────────────────────────────────────── # ── 7. Security: SQL Injection Check ─────────────────────────────────────────
check "SQL Injection Check" "! grep -rn 'text(f"SELECT.*{' app/services/ --include='*.py' >/dev/null 2>&1" check "SQL Injection Check" "! grep -rnE 'text[(]f.+SELECT' app/services/ --include='*.py' >/dev/null 2>&1"
# ── 8. Security: Jinja2 Sandbox Check ───────────────────────────────────────── # ── 8. Security: Jinja2 Sandbox Check ─────────────────────────────────────────
check "Jinja2 Sandbox Check" "! grep -rn 'Environment(' app/plugins/builtins/report_generator/ --include='*.py' | grep -v Sandboxed >/dev/null 2>&1" check "Jinja2 Sandbox Check" "! grep -rn 'Environment(' app/plugins/builtins/report_generator/ --include='*.py' | grep -v Sandboxed >/dev/null 2>&1"
@@ -98,10 +98,14 @@ fi
# ── 13. Dependency Scan (if pip-audit installed) ───────────────────────────── # ── 13. Dependency Scan (if pip-audit installed) ─────────────────────────────
if command -v pip-audit &>/dev/null; then if command -v pip-audit &>/dev/null; then
check "Dependency Scan (pip-audit)" "pip-audit -r requirements.txt --strict 2>&1 | tail -5" check "Dependency Scan (pip-audit)" "pip-audit -r requirements.txt --strict 2>&1 | tail -5"
check "Pip Consistency (pip check)" "pip check"
else else
echo -e "${YELLOW}[CI] SKIP: Dependency Scan (pip-audit not installed)${NC}" echo -e "${YELLOW}[CI] SKIP: Dependency Scan (pip-audit not installed)${NC}"
fi fi
# ── 13b. Frontend Dependency Scan ─────────────────────────────────────────────
check "Frontend Dependency Scan (npm audit)" "cd frontend && npm audit --audit-level=high 2>&1 | tail -3"
# ── 14. Container Smoke Test (if Docker available) ─────────────────────────── # ── 14. Container Smoke Test (if Docker available) ───────────────────────────
if command -v docker &>/dev/null && [ -f Dockerfile ]; then if command -v docker &>/dev/null && [ -f Dockerfile ]; then
check "Container Smoke Test" "curl -sk https://crm.media-on.de/api/v1/health 2>&1 | grep -q 'healthy'" check "Container Smoke Test" "curl -sk https://crm.media-on.de/api/v1/health 2>&1 | grep -q 'healthy'"