ci: 建立镜像发布前供应链门禁 (#6393)

docs/development-setup.md

@@ -150,20 +150,20 @@ python -m scripts.generate_plugin_market_default \
   --config-file app/runtime/config.py
 ```
 
-### 5. 运行安全检查
+### 5. 运行依赖漏洞检查
 
-我们使用 `safety` 工具检查 `pyproject.toml` 与 `uv.lock` 中是否存在已知安全漏洞。该检查是
-依赖变更的人工门禁，当前不属于自动 CI。
-
-#### 执行安全检查
-
-可以通过 `uvx` 在隔离工具环境中运行 `safety`，无需把它加入主程序依赖：
+正式发布会使用固定版本的 `pip-audit` 检查 `uv.lock` 锁定的运行时依赖。依赖变更后也可以在
+本地执行同一检查：
 
 ```bash
-uvx safety scan --target . --policy-file safety.policy.yml
+uv export --quiet --locked --no-dev --no-emit-project \
+  --output-file /tmp/moviepilot-audit-requirements.txt
+uvx --from pip-audit==2.10.1 pip-audit \
+  --require-hashes --disable-pip --strict --progress-spinner off \
+  --requirement /tmp/moviepilot-audit-requirements.txt
 ```
 
-Safety 直接识别项目清单和锁文件，不需要生成或维护 requirements 文件。
+导出文件由 `uv.lock` 生成且保留哈希，不作为项目依赖清单提交。
 
 ### 6. 提交代码前的检查
 
@@ -171,7 +171,7 @@ Safety 直接识别项目清单和锁文件，不需要生成或维护 requireme
 
 1. **确认依赖分层正确**：运行时包进入 `[project].dependencies`；测试、覆盖率、静态检查和构建辅助进入 `[dependency-groups].dev`；插件依赖不并入主程序运行时依赖。
 
-2. **运行安全检查**：确保 `safety` 检查通过，没有新的安全漏洞。
+2. **运行依赖漏洞检查**：确保锁定的运行时依赖通过 `pip-audit`。
 
 3. **运行测试**：如果项目中包含测试，请确保所有测试都通过。运行以下命令以执行测试：
 
@@ -202,6 +202,6 @@ Safety 直接识别项目清单和锁文件，不需要生成或维护 requireme
 ### 7. 参考资源
 
 - [uv 官方文档](https://docs.astral.sh/uv/)
-- [Safety CLI 官方文档](https://docs.safetycli.com/)
+- [pip-audit](https://github.com/pypa/pip-audit)
 - [MoviePilot-Resources](https://github.com/jxxghp/MoviePilot-Resources)
 - [MoviePilot-Plugins](https://github.com/jxxghp/MoviePilot-Plugins)

docs/rules/02-tech-stack.md

@@ -132,7 +132,7 @@
 | pytest | Test runner | `uv run --locked --no-sync pytest tests/test_xxx.py` |
 | pylint | Static analysis | `uv run --locked --no-sync pylint app/` |
 | uv | Lock and environment consistency | `uv lock --check && uv pip check` |
-| safety | Manual dependency vulnerability scan | `uvx safety scan --target . --policy-file safety.policy.yml` |
+| pip-audit | Locked dependency vulnerability scan | `uv export --quiet --locked --no-dev --no-emit-project -o /tmp/moviepilot-audit-requirements.txt && uvx --from pip-audit==2.10.1 pip-audit --require-hashes --disable-pip --strict --progress-spinner off -r /tmp/moviepilot-audit-requirements.txt` |
 
 ---
 

docs/rules/03-commands.md

@@ -79,13 +79,16 @@ uv run --locked --no-sync pylint app/chain/download.py
 ## Security Scan
 
 ```bash
-# Scan pyproject.toml and uv.lock
-uvx safety scan --target . --policy-file=safety.policy.yml
+uv export --quiet --locked --no-dev --no-emit-project \
+  --output-file /tmp/moviepilot-audit-requirements.txt
+uvx --from pip-audit==2.10.1 pip-audit \
+  --require-hashes --disable-pip --strict --progress-spinner off \
+  --requirement /tmp/moviepilot-audit-requirements.txt
 ```
 
 **Rules:**
-- Run manually after runtime or development dependency changes; this is not currently an automated CI job.
-- No new high-severity vulnerabilities may be introduced.
+- Run after runtime dependency changes; the release workflow enforces the same audit before publishing images.
+- Any Python vulnerability reported by this audit blocks publishing until the dependency or explicit audit policy is updated.
 
 ---
 

docs/rules/11-quality-and-security.md

@@ -54,12 +54,17 @@ uv run --locked --no-sync pylint app/
 ## Dependency Security Scan
 
 ```bash
-uvx safety scan --target . --policy-file safety.policy.yml
+uv export --quiet --locked --no-dev --no-emit-project \
+  --output-file /tmp/moviepilot-audit-requirements.txt
+uvx --from pip-audit==2.10.1 pip-audit \
+  --require-hashes --disable-pip --strict --progress-spinner off \
+  --requirement /tmp/moviepilot-audit-requirements.txt
 ```
 
-- Run manually after runtime or development dependency changes; Safety scans `pyproject.toml` and `uv.lock` directly, and this check is not currently an automated CI job.
-- No new high-severity vulnerabilities may be introduced.
-- If a vulnerability cannot be patched immediately, document it explicitly in the PR description.
+- Run after runtime dependency changes; the release workflow audits the same locked dependency set before publishing images.
+- Any Python vulnerability reported by this audit blocks publishing until the dependency or explicit audit policy is updated.
+- Release candidates also scan OS and language packages on amd64 and arm64. HIGH or CRITICAL findings with an available fix block publishing; unfixed upstream findings require a separate reachability and impact assessment.
+- If upstream has no fix, assess reachability and impact before changing the audit policy; PR documentation alone does not bypass the gate.
 
 ---
 
@@ -131,7 +136,7 @@ Before marking any task as complete:
 
 - [ ] Related pytest tests pass
 - [ ] No new pylint error-level issues in `pylint app/`
-- [ ] If dependencies changed: the package is in the correct `pyproject.toml` group, `uv.lock` is current, locked sync and `uv pip check` pass, and the manual Safety scan passes
+- [ ] If dependencies changed: the package is in the correct `pyproject.toml` group, `uv.lock` is current, locked sync and `uv pip check` pass, and the locked runtime dependency audit passes
 - [ ] If CLI behavior changed: `docs/cli.md` and related tests are updated
 - [ ] If MCP/API behavior changed: `docs/mcp-api.md` and related skill files are updated
 - [ ] If database schema changed: a new Alembic migration exists under `database/versions/`

docs/rules/12-collaboration-and-distribution.md

@@ -103,7 +103,7 @@ When updating a dependency:
 
 1. Decide the dependency layer: runtime packages go to `[project].dependencies`; test, coverage, lint, and explicit build tooling go to `[dependency-groups].dev`.
 2. Run `uv lock`, commit the updated `uv.lock`, and verify it with `uv lock --check`.
-3. Run `uv sync --locked`, `uv pip check`, and the manual `uvx safety scan --target . --policy-file safety.policy.yml` check.
+3. Run `uv sync --locked`, `uv pip check`, and the locked runtime dependency audit documented in `03-commands.md`.
 4. Run the full test suite: `uv run --locked --no-sync pytest`.
 
 ---

docs/rules/README.md

@@ -56,7 +56,7 @@ This repository maintains a structured documentation library covering the full d
 
 * **11 Code Quality and Security**
   * File: `11-quality-and-security.md`
-  * Scope: Testing requirements, pylint gates, safety scans, authentication patterns, and input validation rules.
+  * Scope: Testing requirements, pylint gates, dependency vulnerability scans, authentication patterns, and input validation rules.
 
 * **12 Collaboration, Versioning, Build, and Release**
   * File: `12-collaboration-and-distribution.md`