feat: add release hardening, auth, CI, and deployment

PPPPanda · PPPPanda · commit 505e226632dc · 2026-03-11T00:41:26.000+08:00
diff --git a/.env.example b/.env.example
@@ -0,0 +1,14 @@
+# ContentPipe service
+CONTENTPIPE_HOST=0.0.0.0
+CONTENTPIPE_PORT=8765
+CONTENTPIPE_PUBLIC_BASE_URL=http://localhost:8765
+CONTENTPIPE_AUTH_TOKEN=change-me
+CONTENTPIPE_NOTIFY_CHANNEL=
+CONTENTPIPE_LOG_LEVEL=INFO
+
+# OpenClaw Gateway
+OPENCLAW_GATEWAY_URL=http://host.docker.internal:18789
+
+# Optional publishing credentials
+WECHAT_APPID=
+WECHAT_SECRET=
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt pytest
+      - name: Compile check
+        run: python -m compileall scripts
+      - name: Run tests
+        run: pytest -q
diff --git a/.gitignore b/.gitignore
@@ -23,6 +23,7 @@ Thumbs.db
 # Secrets / local config
 .env
 .env.*
+!.env.example
 settings.local.yaml
 
 # Build artifacts
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,38 @@
+# Contributing
+
+Thanks for contributing to ContentPipe.
+
+## Local Setup
+
+```bash
+python3 -m venv .venv
+source .venv/bin/activate
+pip install -r requirements.txt
+pip install pytest
+./start.sh start
+```
+
+## Before Opening a PR
+
+Please run:
+
+```bash
+python3 -m compileall scripts
+pytest
+```
+
+## Commit Style
+
+Prefer Conventional Commits:
+
+- `feat:` new feature
+- `fix:` bug fix
+- `docs:` documentation only
+- `refactor:` internal restructuring
+- `test:` tests
+- `chore:` maintenance
+
+## Scope
+
+Small, focused PRs are preferred.
+If you touch prompts, config, templates, and code together, explain why in the PR body.
diff --git a/Dockerfile b/Dockerfile
@@ -0,0 +1,15 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+EXPOSE 8765
+
+CMD ["python3", "-m", "uvicorn", "web.app:app", "--app-dir", "scripts", "--host", "0.0.0.0", "--port", "8765"]
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ssp
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/README.md b/README.md
@@ -198,6 +198,8 @@ CONTENTPIPE_PORT=8765
 CONTENTPIPE_HOST=0.0.0.0
 CONTENTPIPE_NOTIFY_CHANNEL=<discord_channel_id>
 CONTENTPIPE_PUBLIC_BASE_URL=http://localhost:8765
+CONTENTPIPE_AUTH_TOKEN=change-me
+CONTENTPIPE_LOG_LEVEL=INFO
 
 WECHAT_APPID=...
 WECHAT_SECRET=...
@@ -209,6 +211,7 @@ ANTHROPIC_API_KEY=...
 说明：
 - `CONTENTPIPE_NOTIFY_CHANNEL` 为空时，不会发送 Discord 通知
 - `CONTENTPIPE_PUBLIC_BASE_URL` 用于 Discord 通知里的回链地址
+- `CONTENTPIPE_AUTH_TOKEN` 非空时，Web UI / API 会开启鉴权（浏览器登录或请求头 `X-ContentPipe-Token`）
 - 发布相关密钥建议只通过环境变量或本地未跟踪配置注入
 
 ---
@@ -225,14 +228,27 @@ ANTHROPIC_API_KEY=...
 ./start.sh restart
 ```
 
-### 6.2 直接启动 uvicorn
+### 6.2 Docker 一键部署（推荐给外部用户）
+
+```bash
+cp .env.example .env
+# 修改 .env 里的 CONTENTPIPE_AUTH_TOKEN / OPENCLAW_GATEWAY_URL
+
+docker compose up -d --build
+```
+
+启动后：
+- Web UI: `http://localhost:8765`
+- 首次访问会要求输入 `CONTENTPIPE_AUTH_TOKEN`
+
+### 6.3 直接启动 uvicorn
 
 ```bash
 cd scripts
 python3 -m uvicorn web.app:app --host 0.0.0.0 --port 8765
 ```
 
-### 6.3 健康检查
+### 6.4 健康检查
 
 ```bash
 curl http://localhost:8765/api/health
@@ -378,12 +394,16 @@ git push origin main
 
 ---
 
-## 12. License / 使用说明
+## 12. License / 开源配套文件
 
-仓库当前未附带正式许可证文件；在公开发布前，建议补充：
+仓库当前已经补齐以下公开发布基础文件：
 
-- `LICENSE`
+- `LICENSE`（MIT）
 - `CONTRIBUTING.md`
 - `SECURITY.md`
 
-如果你计划公开给其他人部署，这三项最好补齐。
+如果你准备正式 release，建议下一步继续补：
+
+- `CHANGELOG.md`
+- GitHub Release notes
+- 部署示例截图 / demo 数据
diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported Versions
+
+Current maintained line:
+
+- `0.7.x`
+
+## Reporting a Vulnerability
+
+Please do **not** open a public GitHub issue for security-sensitive findings.
+
+Instead, report privately to the maintainer with:
+
+- affected version / commit
+- reproduction steps
+- expected vs actual behavior
+- impact assessment
+- suggested fix (optional)
+
+## Deployment Guidance
+
+Before exposing ContentPipe beyond localhost, you should:
+
+- set `CONTENTPIPE_AUTH_TOKEN`
+- place the service behind HTTPS / reverse proxy
+- restrict network exposure where possible
+- keep API keys in environment variables, not committed files
+- review upload limits and publishing credentials
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -0,0 +1,15 @@
+version: "3.9"
+
+services:
+  contentpipe:
+    build: .
+    container_name: contentpipe
+    restart: unless-stopped
+    ports:
+      - "8765:8765"
+    env_file:
+      - .env
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    volumes:
+      - ./output:/app/output
diff --git a/scripts/logutil.py b/scripts/logutil.py
@@ -0,0 +1,15 @@
+from __future__ import annotations
+
+import logging
+import os
+
+_LEVEL = os.environ.get("CONTENTPIPE_LOG_LEVEL", "INFO").upper()
+
+logging.basicConfig(
+    level=getattr(logging, _LEVEL, logging.INFO),
+    format="%(asctime)s | %(levelname)s | %(name)s | %(message)s",
+)
+
+
+def get_logger(name: str) -> logging.Logger:
+    return logging.getLogger(name)
diff --git a/scripts/web/app.py b/scripts/web/app.py
@@ -15,6 +15,8 @@
 from fastapi import FastAPI
 from fastapi.staticfiles import StaticFiles
 
+from web.auth import AuthMiddleware
+
 # 确保 scripts/ 在 sys.path
 SCRIPTS_DIR = Path(__file__).parent.parent
 if str(SCRIPTS_DIR) not in sys.path:
@@ -31,6 +33,7 @@
     description="图文内容 Pipeline 主控台",
     version="0.7.0",
 )
+app.add_middleware(AuthMiddleware)
 
 # 静态文件
 STATIC_DIR = Path(__file__).parent / "static"
diff --git a/scripts/web/auth.py b/scripts/web/auth.py
@@ -0,0 +1,76 @@
+from __future__ import annotations
+
+import hashlib
+import os
+from typing import Optional
+
+from fastapi import Request
+from fastapi.responses import RedirectResponse
+from starlette.middleware.base import BaseHTTPMiddleware
+
+AUTH_ENV = "CONTENTPIPE_AUTH_TOKEN"
+AUTH_COOKIE = "contentpipe_auth"
+AUTH_HEADER = "x-contentpipe-token"
+
+PUBLIC_PATH_PREFIXES = (
+    "/static",
+    "/api/health",
+    "/api/info",
+    "/login",
+    "/docs",
+    "/openapi.json",
+    "/redoc",
+    "/favicon.ico",
+)
+
+
+def get_auth_token() -> str:
+    return os.environ.get(AUTH_ENV, "").strip()
+
+
+def is_auth_enabled() -> bool:
+    return bool(get_auth_token())
+
+
+def hash_token(token: str) -> str:
+    return hashlib.sha256(f"contentpipe:{token}".encode("utf-8")).hexdigest()
+
+
+def is_authenticated_request(request: Request) -> bool:
+    token = get_auth_token()
+    if not token:
+        return True
+
+    cookie_val = request.cookies.get(AUTH_COOKIE, "")
+    if cookie_val and cookie_val == hash_token(token):
+        return True
+
+    header_val = request.headers.get(AUTH_HEADER, "") or request.headers.get("authorization", "")
+    if header_val.lower().startswith("bearer "):
+        header_val = header_val[7:].strip()
+    if header_val and header_val == token:
+        return True
+
+    return False
+
+
+class AuthMiddleware(BaseHTTPMiddleware):
+    async def dispatch(self, request: Request, call_next):
+        if not is_auth_enabled():
+            return await call_next(request)
+
+        path = request.url.path
+        if any(path.startswith(prefix) for prefix in PUBLIC_PATH_PREFIXES):
+            return await call_next(request)
+
+        if is_authenticated_request(request):
+            return await call_next(request)
+
+        if path.startswith("/api/") or request.headers.get("hx-request") == "true":
+            from fastapi.responses import JSONResponse
+            return JSONResponse({"detail": "Authentication required"}, status_code=401)
+
+        next_url = request.url.path
+        if request.url.query:
+            next_url += f"?{request.url.query}"
+        return RedirectResponse(url=f"/login?next={next_url}", status_code=303)
diff --git a/scripts/web/notify.py b/scripts/web/notify.py
@@ -11,10 +11,13 @@
 import httpx
 from typing import Optional
 
+from logutil import get_logger
+
 # 配置（可被环境变量覆盖）
 GATEWAY_URL = os.environ.get("OPENCLAW_GATEWAY_URL", "http://localhost:18789")
 NOTIFY_CHANNEL = os.environ.get("CONTENTPIPE_NOTIFY_CHANNEL", "")
 PUBLIC_BASE_URL = os.environ.get("CONTENTPIPE_PUBLIC_BASE_URL", "http://localhost:8765").rstrip("/")
+logger = get_logger(__name__)
 
 # 节点 emoji
 NODE_EMOJI = {
@@ -65,7 +68,7 @@ async def notify_discord(
             )
             return resp.status_code == 200
     except Exception as e:
-        print(f"⚠️ Discord notify failed: {e}")
+        logger.warning("Discord notify failed: %s", e)
         return False
 
 
diff --git a/scripts/web/routes/api.py b/scripts/web/routes/api.py
diff --git a/scripts/web/routes/pages.py b/scripts/web/routes/pages.py
diff --git a/scripts/web/templates/login.html b/scripts/web/templates/login.html
diff --git a/tests/test_auth.py b/tests/test_auth.py
diff --git a/tests/test_nodes.py b/tests/test_nodes.py
diff --git a/tests/test_web_api.py b/tests/test_web_api.py
