增加 CI 质量与安全合并门禁 (#106)

新增前后端质量与安全检查，并将检查设为 main 分支的强制合并门禁。后端使用轻量测试依赖运行完整测试，前端执行测试、Lint、类型检查、构建与高危依赖审计。

Author: liuzhao1225

.github/workflows/ci.yml

@@ -0,0 +1,100 @@
+name: 质量与安全门禁
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  frontend:
+    name: 前端质量与安全
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: apps/web
+    steps:
+      - name: 检出代码
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: 配置 Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: apps/web/package-lock.json
+
+      - name: 安装前端依赖
+        run: npm ci --ignore-scripts --no-audit --no-fund --registry=https://registry.npmmirror.com
+
+      - name: 运行前端测试
+        run: npm test -- --reporter=verbose
+
+      - name: 运行 ESLint
+        run: npm run lint
+
+      - name: 运行 TypeScript 检查
+        run: ./node_modules/.bin/tsc --noEmit
+
+      - name: 构建生产版本
+        run: npm run build
+
+      - name: 审计生产依赖
+        run: npm audit --omit=dev --audit-level=high --registry=https://registry.npmjs.org
+
+  backend:
+    name: 后端测试
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: 检出代码
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: 配置 Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: backend/requirements-test.txt
+
+      - name: 安装后端测试依赖
+        id: pip_aliyun
+        continue-on-error: true
+        run: python -m pip install -r backend/requirements-test.txt -i https://mirrors.aliyun.com/pypi/simple/
+
+      - name: 阿里云失败后使用清华镜像重试
+        if: steps.pip_aliyun.outcome == 'failure'
+        run: python -m pip install -r backend/requirements-test.txt -i https://pypi.tuna.tsinghua.edu.cn/simple/
+
+      - name: 检查轻量依赖边界
+        run: |
+          python -m pip check
+          python - <<'PY'
+          from importlib.util import find_spec
+
+          excluded = (
+              "torch", "whisper", "demucs", "voxcpm", "modelscope",
+              "librosa", "audiostretchy", "spacy", "openunmix",
+          )
+          installed = [name for name in excluded if find_spec(name) is not None]
+          if installed:
+              raise SystemExit(f"CI 测试环境意外安装了重型依赖: {', '.join(installed)}")
+          PY
+
+      - name: 运行后端全量测试
+        run: python -m pytest backend/tests -q

backend/app/adapters/audio.py

@@ -3,10 +3,8 @@
 import json
 from pathlib import Path
 
-import librosa
 import numpy as np
 import soundfile as sf
-from audiostretchy.stretch import stretch_audio
 from pydub import AudioSegment
 
 BASE_FACTOR_MIN = 0.8
@@ -35,6 +33,8 @@ def split_audio_by_translation(vocals_file: Path, translation_file: Path, sessio
 
 
 def _audio_duration(file: Path) -> tuple[float, int]:
+    import librosa
+
     y, sr = librosa.load(str(file), sr=None)
     return len(y) / sr, sr
 
@@ -53,9 +53,13 @@ def _base_speed_factor(translation: list[dict], tts_files: list[Path]) -> float:
 
 
 def _stretch_segment(audio_file: Path, ratio: float, target_sec: float, cache_dir: Path) -> tuple[np.ndarray, int]:
+    import librosa
+
     if abs(ratio - 1.0) < SPEED_NOOP_EPSILON:
         y, sr = librosa.load(str(audio_file), sr=None)
         return y, sr
+    from audiostretchy.stretch import stretch_audio
+
     out_path = cache_dir / audio_file.name
     stretch_audio(str(audio_file), str(out_path), ratio=ratio)
     y, sr = librosa.load(str(out_path), sr=None)

backend/requirements-test.txt

@@ -0,0 +1,17 @@
+# Lightweight CPU-only dependencies for the complete backend unit-test suite.
+# Keep this list aligned with imports exercised by backend/tests. Runtime ML
+# packages such as Torch, Whisper, OpenUnmix, librosa, AudioStretchy and VoxCPM
+# are mocked or lazily imported by tests and intentionally do not belong here.
+fastapi
+pydantic
+python-dotenv
+python-multipart
+pwdlib[argon2]>=0.3,<1
+openai
+yt-dlp
+requests
+numpy
+soundfile
+pydub
+pytest
+httpx[socks]