修复 Actions 输入安全、扫描范围绕过和报告脱敏

action.yml

@@ -43,22 +43,45 @@ runs:
   steps:
     - name: Install PatchBrake
       shell: bash
-      run: npm install -g "patchbrake@${{ inputs.version }}" --ignore-scripts
+      env:
+        PATCHBRAKE_VERSION: ${{ inputs.version }}
+      run: |
+        set -euo pipefail
+        if [[ ! "$PATCHBRAKE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
+          echo 'PatchBrake version must be a pinned npm semver version.' >&2
+          exit 2
+        fi
+        npm install -g "patchbrake@$PATCHBRAKE_VERSION" --ignore-scripts
     - name: Run PatchBrake
       shell: bash
+      env:
+        PATCHBRAKE_BASE: ${{ inputs.base }}
+        PATCHBRAKE_HEAD: ${{ inputs.head }}
+        PATCHBRAKE_FORMAT: ${{ inputs.format }}
+        PATCHBRAKE_FAIL_ON: ${{ inputs.fail-on }}
+        PATCHBRAKE_OUTPUT: ${{ inputs.output }}
+        PATCHBRAKE_ALLOW_CUSTOM_RULES: ${{ inputs.allow-custom-rules }}
+        PATCHBRAKE_ALLOW_INLINE_IGNORE: ${{ inputs.allow-inline-ignore }}
+        PATCHBRAKE_FAIL_ON_NEW_IGNORE: ${{ inputs.fail-on-new-ignore }}
       run: |
         set -euo pipefail
-        args=(scan --base "${{ inputs.base }}" --head "${{ inputs.head }}" --format "${{ inputs.format }}" --fail-on "${{ inputs.fail-on }}")
-        if [ -n "${{ inputs.output }}" ]; then
-          args+=(--output "${{ inputs.output }}")
+        for flag in "$PATCHBRAKE_ALLOW_CUSTOM_RULES" "$PATCHBRAKE_ALLOW_INLINE_IGNORE" "$PATCHBRAKE_FAIL_ON_NEW_IGNORE"; do
+          if [[ "$flag" != true && "$flag" != false ]]; then
+            echo 'PatchBrake boolean inputs must be true or false.' >&2
+            exit 2
+          fi
+        done
+        args=(scan --base "$PATCHBRAKE_BASE" --head "$PATCHBRAKE_HEAD" --format "$PATCHBRAKE_FORMAT" --fail-on "$PATCHBRAKE_FAIL_ON")
+        if [ -n "$PATCHBRAKE_OUTPUT" ]; then
+          args+=(--output "$PATCHBRAKE_OUTPUT")
         fi
-        if [ "${{ inputs.allow-custom-rules }}" != "true" ]; then
+        if [ "$PATCHBRAKE_ALLOW_CUSTOM_RULES" != "true" ]; then
           args+=(--no-custom-rules)
         fi
-        if [ "${{ inputs.allow-inline-ignore }}" != "true" ]; then
+        if [ "$PATCHBRAKE_ALLOW_INLINE_IGNORE" != "true" ]; then
           args+=(--disallow-inline-ignore)
         fi
-        if [ "${{ inputs.fail-on-new-ignore }}" = "true" ]; then
+        if [ "$PATCHBRAKE_FAIL_ON_NEW_IGNORE" = "true" ]; then
           args+=(--fail-on-new-ignore)
         fi
         patchbrake "${args[@]}"

docs/deep-audit-20261104.md

@@ -0,0 +1,9 @@
+# Deep audit repairs (2026-11-04)
+
+- `**/` includes zero or more directories and `?` matches one non-separator character. Parsed repository paths retain actual `a/` and `b/` directories; diff prefixes are removed once by the parser.
+- Placeholder suppression applies to the matched value, not unrelated comments or words elsewhere on the line. Quoted JSON assignments and high-confidence tokens in comments are scanned.
+- All rule findings, including inline-ignore findings, redact recognized token formats and complete secret assignments before report output. One line triggering another rule cannot reintroduce the same recognized secret in its excerpt.
+
+Regression tests use synthetic values only. This remains a heuristic diff scanner, not a complete secret detector. Changed redacted excerpts can change secret-rule fingerprints: review regenerated baselines rather than copying exceptions blindly. Reports do not include raw diff files, though the programmatic scan result still includes the requested input diff for callers.
+
+Verification: TypeScript build, full Vitest suite, deterministic benchmark and Git whitespace check. No major development dependency migration is included.

docs/reaudit-20261106.md

@@ -0,0 +1,11 @@
+# Second audit: diff and suppression boundaries
+
+Verified against PR #28 head `ce20564567e47d8a5991da60fcbd505b54ede6bb`.
+
+- Hunk lines beginning with `--- ` or `+++ ` were interpreted as file headers. This could discard a risky added line and change the path used by every rule. Headers are now recognized only before the first hunk of each file.
+- Deleted inline-ignore comments still suppressed new findings, and a named ignore could suppress unrelated rules. Only surviving lines apply; a named rule must match exactly. Bare directives keep their existing behavior. The Action's stricter inline-ignore defaults remain in effect.
+- Human-oriented Git color/prefix settings could produce missing or mislocated findings. Staged and range scans now request explicit uncolored patch prefixes/indicators and disable text conversion/external diff helpers.
+
+New regression suite: 17 cases, including actual staged Git repositories. Initial 14 cases had 8 failures before the fix. Final full suite: 75 passed; TypeScript build passed; benchmark 30/30. This remains a heuristic patch scanner, not a complete semantic security audit.
+
+Git option behavior was checked against the [official git-diff documentation](https://git-scm.com/docs/git-diff).