ci: 建立镜像发布前供应链门禁 (#6393)

docs/rules/02-tech-stack.md

@@ -132,7 +132,7 @@
 | pytest | Test runner | `uv run --locked --no-sync pytest tests/test_xxx.py` |
 | pylint | Static analysis | `uv run --locked --no-sync pylint app/` |
 | uv | Lock and environment consistency | `uv lock --check && uv pip check` |
-| safety | Manual dependency vulnerability scan | `uvx safety scan --target . --policy-file safety.policy.yml` |
+| pip-audit | Locked dependency vulnerability scan | `uv export --quiet --locked --no-dev --no-emit-project -o /tmp/moviepilot-audit-requirements.txt && uvx --from pip-audit==2.10.1 pip-audit --require-hashes --disable-pip --strict --progress-spinner off -r /tmp/moviepilot-audit-requirements.txt` |
 
 ---
 

docs/rules/03-commands.md

@@ -79,13 +79,16 @@ uv run --locked --no-sync pylint app/chain/download.py
 ## Security Scan
 
 ```bash
-# Scan pyproject.toml and uv.lock
-uvx safety scan --target . --policy-file=safety.policy.yml
+uv export --quiet --locked --no-dev --no-emit-project \
+  --output-file /tmp/moviepilot-audit-requirements.txt
+uvx --from pip-audit==2.10.1 pip-audit \
+  --require-hashes --disable-pip --strict --progress-spinner off \
+  --requirement /tmp/moviepilot-audit-requirements.txt
 ```
 
 **Rules:**
-- Run manually after runtime or development dependency changes; this is not currently an automated CI job.
-- No new high-severity vulnerabilities may be introduced.
+- Run after runtime dependency changes; the release workflow enforces the same audit before publishing images.
+- Any Python vulnerability reported by this audit blocks publishing until the dependency or explicit audit policy is updated.
 
 ---
 

docs/rules/11-quality-and-security.md

@@ -54,12 +54,17 @@ uv run --locked --no-sync pylint app/
 ## Dependency Security Scan
 
 ```bash
-uvx safety scan --target . --policy-file safety.policy.yml
+uv export --quiet --locked --no-dev --no-emit-project \
+  --output-file /tmp/moviepilot-audit-requirements.txt
+uvx --from pip-audit==2.10.1 pip-audit \
+  --require-hashes --disable-pip --strict --progress-spinner off \
+  --requirement /tmp/moviepilot-audit-requirements.txt
 ```
 
-- Run manually after runtime or development dependency changes; Safety scans `pyproject.toml` and `uv.lock` directly, and this check is not currently an automated CI job.
-- No new high-severity vulnerabilities may be introduced.
-- If a vulnerability cannot be patched immediately, document it explicitly in the PR description.
+- Run after runtime dependency changes; the release workflow audits the same locked dependency set before publishing images.
+- Any Python vulnerability reported by this audit blocks publishing until the dependency or explicit audit policy is updated.
+- Release candidates also scan OS and language packages on amd64 and arm64. HIGH or CRITICAL findings with an available fix block publishing; unfixed upstream findings require a separate reachability and impact assessment.
+- If upstream has no fix, assess reachability and impact before changing the audit policy; PR documentation alone does not bypass the gate.
 
 ---
 
@@ -131,7 +136,7 @@ Before marking any task as complete:
 
 - [ ] Related pytest tests pass
 - [ ] No new pylint error-level issues in `pylint app/`
-- [ ] If dependencies changed: the package is in the correct `pyproject.toml` group, `uv.lock` is current, locked sync and `uv pip check` pass, and the manual Safety scan passes
+- [ ] If dependencies changed: the package is in the correct `pyproject.toml` group, `uv.lock` is current, locked sync and `uv pip check` pass, and the locked runtime dependency audit passes
 - [ ] If CLI behavior changed: `docs/cli.md` and related tests are updated
 - [ ] If MCP/API behavior changed: `docs/mcp-api.md` and related skill files are updated
 - [ ] If database schema changed: a new Alembic migration exists under `database/versions/`

docs/rules/12-collaboration-and-distribution.md

@@ -103,7 +103,7 @@ When updating a dependency:
 
 1. Decide the dependency layer: runtime packages go to `[project].dependencies`; test, coverage, lint, and explicit build tooling go to `[dependency-groups].dev`.
 2. Run `uv lock`, commit the updated `uv.lock`, and verify it with `uv lock --check`.
-3. Run `uv sync --locked`, `uv pip check`, and the manual `uvx safety scan --target . --policy-file safety.policy.yml` check.
+3. Run `uv sync --locked`, `uv pip check`, and the locked runtime dependency audit documented in `03-commands.md`.
 4. Run the full test suite: `uv run --locked --no-sync pytest`.
 
 ---

docs/rules/README.md

@@ -56,7 +56,7 @@ This repository maintains a structured documentation library covering the full d
 
 * **11 Code Quality and Security**
   * File: `11-quality-and-security.md`
-  * Scope: Testing requirements, pylint gates, safety scans, authentication patterns, and input validation rules.
+  * Scope: Testing requirements, pylint gates, dependency vulnerability scans, authentication patterns, and input validation rules.
 
 * **12 Collaboration, Versioning, Build, and Release**
   * File: `12-collaboration-and-distribution.md`