签入版本

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,28 @@
+---
+name: Bug 报告
+about: 反馈使用过程中遇到的问题
+title: "[BUG] "
+labels: bug
+---
+
+## 环境信息
+- 版本号：
+- 操作系统：
+- Python 版本：
+
+## 问题描述
+<!-- 清晰描述你遇到的问题 -->
+
+## 复现步骤
+1.
+2.
+3.
+
+## 期望行为
+<!-- 你期望发生什么 -->
+
+## 实际行为
+<!-- 实际发生了什么，附上错误日志 -->
+
+## 截图 / 日志
+<!-- 如有请附上 -->

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: 功能建议
+about: 提出新的功能需求或改进建议
+title: "[FEATURE] "
+labels: enhancement
+---
+
+## 需求背景
+<!-- 为什么需要这个功能 -->
+
+## 功能描述
+<!-- 希望实现什么 -->
+
+## 实现思路（可选）
+<!-- 你期望的实现方式 -->
+
+## 影响范围
+<!-- 涉及哪些模块 / 是否需要同步修改前端 -->

.github/workflows/cd.yml

@@ -0,0 +1,30 @@
+name: CD
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ vars.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ vars.REGISTRY }}/${{ vars.IMAGE_NAME }}:latest
+            ${{ vars.REGISTRY }}/${{ vars.IMAGE_NAME }}:${{ github.ref_name }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/ci.yml

@@ -0,0 +1,61 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: "poetry"
+      - name: Install dependencies
+        run: |
+          pip install poetry
+          poetry install --with dev
+      - name: Lint (flake8)
+        run: poetry run flake8 src tests
+      - name: Type check (mypy)
+        run: poetry run mypy src
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: djangoadmin_test
+        ports:
+          - 3306:3306
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: "poetry"
+      - name: Install dependencies
+        run: |
+          pip install poetry
+          poetry install --with dev
+      - name: Run tests
+        env:
+          DB_HOST: 127.0.0.1
+          DB_PORT: 3306
+          DB_USERNAME: root
+          DB_PASSWORD: root
+          DB_DATABASE: djangoadmin_test
+          REDIS_HOST: 127.0.0.1
+          REDIS_PORT: 6379
+        run: poetry run pytest -v --cov=src --cov-report=term-missing

.github/workflows/security-scan.yml

@@ -0,0 +1,29 @@
+name: Security Scan
+
+on:
+  schedule:
+    - cron: "0 2 * * 0" # 每周日凌晨 2 点
+  workflow_dispatch:
+
+jobs:
+  pip-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install pip-audit
+        run: pip install pip-audit
+      - name: Audit dependencies
+        run: pip-audit -r <(poetry export --without-hashes 2>/dev/null || echo "requirements.txt")
+
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}