fix workflow: remove github dependency + duplicate scan

.gitea/workflows/sonar-scan.yml

@@ -9,70 +9,138 @@ on:
 jobs:
   scan:
     runs-on: windows-latest
-
+    fail-fast: true
     env:
-      # PROXY_HOST: 127.0.0.1
-      # PROXY_PORT: 7890
       DC_VERSION: 11.0.0
-      DC_OUTPUT: ./depcheck
+      DC_OUTPUT: ${{ github.workspace }}\depcheck
+      SONAR_HOST_URL: http://127.0.0.1:9000
+      PROJECT_KEY: vectordbdemo
+      # 强制关闭所有代理（关键：避免代理残留导致网络问题）
+      HTTP_PROXY: ""
+      HTTPS_PROXY: ""
+      NO_PROXY: "*"
 
     steps:
-      - name: Checkout Code (Gitea)
-        uses: actions/checkout@v4
+      # 替换 GitHub 的 actions/checkout，改用 Gitea 原生的代码检出（核心修复）
+      - name: Checkout Code (Gitea Native)
+        uses: gitea/checkout@v4  # 使用 Gitea 官方 checkout 组件，而非 GitHub 的
+        with:
+          fetch-depth: 0  # 保留完整提交历史，满足 SonarQube 分析
+
+      - name: 清理系统代理环境变量（确保无残留）
+        run: |
+          # 清空系统级代理变量
+          [Environment]::SetEnvironmentVariable("HTTP_PROXY", "", "Machine")
+          [Environment]::SetEnvironmentVariable("HTTPS_PROXY", "", "Machine")
+          [Environment]::SetEnvironmentVariable("http_proxy", "", "User")
+          [Environment]::SetEnvironmentVariable("https_proxy", "", "User")
+          # 验证代理已关闭
+          Write-Host "HTTP_PROXY: $env:HTTP_PROXY"
+          Write-Host "HTTPS_PROXY: $env:HTTPS_PROXY"
+        shell: pwsh
 
       - name: Add Sonar Scanner to PATH
         run: |
-          echo "D:\Paths\sonar-scanner-cli\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8
+          $sonarScannerPath = "D:\Paths\sonar-scanner-cli\bin"
+          if (-not (Test-Path $sonarScannerPath)) {
+            Write-Error "Sonar Scanner 路径不存在: $sonarScannerPath"
+            exit 1
+          }
+          echo "$sonarScannerPath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8
+        shell: pwsh
 
       - name: Verify .NET SDK
         run: |
           dotnet --list-sdks
           dotnet --version
-
-      - name: Run OWASP Dependency Check
-        env:
-          # HTTP_PROXY: http://127.0.0.1:7890
-          # HTTPS_PROXY: http://127.0.0.1:7890
-        run: |
-          New-Item -Path $env:DC_OUTPUT -ItemType Directory -Force
-          & "D:\Paths\Gitea\dependency-check\bin\dependency-check.bat" `
-            --project "VectorDBDemo" `
-            --scan "." `
-            --format "XML" `
-            --out "$env:DC_OUTPUT"
+          if (-not (dotnet --list-sdks | Select-String -Pattern "8.0.")) {
+            Write-Error "未找到 .NET 8.0 SDK，请确认 Runner 环境配置"
+            exit 1
+          }
         shell: pwsh
 
+      - name: Run OWASP Dependency Check
+        run: |
+          New-Item -Path $env:DC_OUTPUT -ItemType Directory -Force -ErrorAction Stop
+          $depCheckPath = "D:\Paths\Gitea\dependency-check\bin\dependency-check.bat"
+          if (-not (Test-Path $depCheckPath)) {
+            Write-Error "Dependency Check 脚本不存在: $depCheckPath"
+            exit 1
+          }
+          & $depCheckPath `
+            --project "${{ env.PROJECT_KEY }}" `
+            --scan "${{ github.workspace }}" `
+            --format "XML" `
+            --out "$env:DC_OUTPUT" `
+            --failOnCVSS 9
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "OWASP 依赖检查失败"
+            exit 1
+          }
+        shell: pwsh
+
+      - name: Install dotnet-sonarscanner (本地源/无缓存)
+        run: |
+          # 禁用 NuGet 代理，改用本地/内网 NuGet 源（关键：避免访问 nuget.org 超时）
+          dotnet nuget remove source "nuget.org" -ErrorAction SilentlyContinue
+          # 替换为内网 NuGet 源（需根据你的环境配置）
+          dotnet nuget add source "http://your-internal-nuget-server/v3/index.json" -n "InternalNuGet" -p "true"
+          
+          if (-not (dotnet tool list --global | Select-String -Pattern "dotnet-sonarscanner")) {
+            dotnet tool install --global dotnet-sonarscanner --no-cache
+          }
+          $sonarToolPath = [Environment]::GetEnvironmentVariable("PATH", "User")
+          echo "$sonarToolPath" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8
+        shell: pwsh
 
       - name: Build .NET Project
         run: |
-          dotnet restore
-          dotnet build --configuration Release --no-restore
+          dotnet restore --verbosity minimal
+          dotnet build --configuration Release --no-restore --verbosity minimal
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error ".NET 项目构建失败"
+            exit 1
+          }
+        shell: pwsh
 
       - name: SonarQube Full Scan
         run: |
-          dotnet tool install --global dotnet-sonarscanner --no-cache
           dotnet sonarscanner begin `
-            /k:"vectordbdemo" `
-            /d:sonar.host.url="http://127.0.0.1:9000" `
+            /k:"${{ env.PROJECT_KEY }}" `
+            /d:sonar.host.url="${{ env.SONAR_HOST_URL }}" `
             /d:sonar.login="${{ secrets.SONAR_TOKEN }}" `
-            /d:sonar.sources="./" `
-            /d:sonar.exclusions="**/obj/**,**/bin/**,depcheck/**" `
-            /d:sonar.dependencyCheck.xmlReportPath="$env:DC_OUTPUT\dependency-check-report.xml" `
+            /d:sonar.sources="${{ github.workspace }}" `
+            /d:sonar.exclusions="**/obj/**,**/bin/**,${{ env.DC_OUTPUT }}/**" `
+            /d:sonar.dependencyCheck.xmlReportPath="${{ env.DC_OUTPUT }}\dependency-check-report.xml" `
             /d:sonar.verbose=true
-          dotnet build --configuration Release --no-restore
-          dotnet sonarscanner end `
-            /d:sonar.login="${{ secrets.SONAR_TOKEN }}"
+          dotnet build --configuration Release --no-restore --verbosity minimal
+          dotnet sonarscanner end `/d:sonar.login="${{ secrets.SONAR_TOKEN }}"
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "SonarQube 扫描失败"
+            exit 1
+          }
+        shell: pwsh
 
       - name: Fetch SonarQube Blocker Issues
         id: fetch_issues
         run: |
-          $projectKey = "vectordbdemo"
-          $sonarApiUrl = "http://127.0.0.1:9000/api/issues/search?componentKeys=$projectKey&severities=BLOCKER&statuses=OPEN"
-          $auth = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("${{ secrets.SONAR_TOKEN }}:"))
-          $response = Invoke-RestMethod -Uri $sonarApiUrl -Headers @{ Authorization = "Basic $auth" }
-          $blockerCount = $response.total
-          echo "blocker_issues_count=$blockerCount" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8
-          if ($blockerCount -gt 0) {
-            Write-Error "Found $blockerCount Blocker issues in SonarQube"
+          $sonarApiUrl = "${{ env.SONAR_HOST_URL }}/api/issues/search?componentKeys=${{ env.PROJECT_KEY }}&severities=BLOCKER&statuses=OPEN"
+          $authToken = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes("${{ secrets.SONAR_TOKEN }}:"))
+          try {
+            $response = Invoke-RestMethod -Uri $sonarApiUrl `
+              -Headers @{ Authorization = "Basic $authToken" } `
+              -Method Get `
+              -TimeoutSec 30
+            $blockerCount = $response.total
+            echo "blocker_issues_count=$blockerCount" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8
+            if ($blockerCount -gt 0) {
+              Write-Error "SonarQube 检测到 $blockerCount 个阻塞级问题，工作流终止"
+              exit 1
+            } else {
+              Write-Host "✅ SonarQube 无阻塞级问题"
+            }
+          } catch {
+            Write-Error "调用 SonarQube API 失败: $_"
             exit 1
           }
+        shell: pwsh