claude_dev
23bbb11a55
CI/CD / test (push) Successful in 47s
CI/CD / nas-deploy (push) Successful in 1s
CI/CD / nas-verify (push) Successful in 7s
security(ci): nas-verify 登录口令去明文化——改走 Gitea secret NAS_API_PASSWORD [nas]
- 架构审计 P0-1 用户拍板轮换链第一步: workflow 明文口令(每次 CI 日志暴露面)
改 ${{ secrets.NAS_API_PASSWORD }}(secret 已建=HTTP 201)
- 同窗轮换: config/backtest.yaml(gitignore 种子,不入本 commit)已换新 bcrypt
hash+jwt_secret, 随本次 push 的 nas-deploy rsync 传播 NAS——nas-verify 用
新 secret 登录新 hash, 顺序=secret 先建后 push, 零断窗
- three-env §12 补 CI 凭据纪律(secret 引用+轮换流程+种子传播路径)
- VPS 侧: config 种子随下次推vps 传播; run_api.ps1 PROMOTION_PASSPHRASE 同串
轮换随后续步骤执行; git 历史旧明文按用户拍板不洗(私有内网仓)
Co-Authored-By: Claude Code <notify@anthropic.com>