ci: 同步 code-check.yml（移除依赖漏洞扫描 Job）

Author: Z User

.github/workflows/code-check.yml

@@ -10,8 +10,7 @@
 #   2. 代码风格检查 - 使用 Checkstyle 确保代码风格一致
 #   3. 静态分析 - 使用 SpotBugs 和 PMD 检测潜在 Bug 和代码质量问题
 #   4. 单元测试 - 运行所有测试并生成报告
-#   5. 依赖漏洞扫描 - 检查已知安全漏洞
-#   6. 代码重复度检查 - 使用 CPD 检测重复代码
+#   5. 代码重复度检查 - 使用 CPD 检测重复代码
 # ============================================================================
 
 name: 代码检查
@@ -346,119 +345,7 @@ jobs:
           if-no-files-found: warn
 
   # ==========================================================================
-  # Job 5: 依赖漏洞扫描
-  # ==========================================================================
-  dependency-scan:
-    name: 依赖漏洞扫描
-    runs-on: ubuntu-latest
-    needs: build
-
-    env:
-      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
-
-    steps:
-      - name: 检出代码仓库
-        uses: actions/checkout@v4
-
-      - name: 配置 JDK 17
-        uses: actions/setup-java@v4
-        with:
-          java-version: "17"
-          distribution: "temurin"
-
-      - name: 缓存 Gradle 依赖
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', 'gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
-
-      # 缓存 OWASP NVD 数据库，避免每次运行都重新下载
-      - name: 缓存 NVD 数据库
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.m2/repository/org/owasp/dependency-check-data/
-            /tmp/dependency-check-data/
-          key: nvd-db-${{ runner.os }}-${{ github.run_id }}
-          restore-keys: |
-            nvd-db-${{ runner.os }}-
-
-      - name: 赋予 Gradlew 可执行权限
-        run: chmod +x gradlew
-
-      - name: 分析依赖树
-        run: |
-          echo "## 依赖分析" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          ./gradlew dependencies --no-daemon --configuration runtimeClasspath 2>&1 | head -200 >> $GITHUB_STEP_SUMMARY || true
-          echo '```' >> $GITHUB_STEP_SUMMARY
-
-      # OWASP 依赖漏洞扫描
-      # 免费申请 NVD API Key：https://nvd.nist.gov/developers/request-an-api-key
-      # 配置方法：GitHub 仓库 → Settings → Secrets → Actions → NVD_API_KEY
-      - name: OWASP 依赖漏洞扫描
-        run: |
-          # 检查是否配置了 NVD API Key
-          if [ -n "$NVD_API_KEY" ]; then
-            echo "✅ 已检测到 NVD API Key，将使用 API Key 加速扫描"
-          else
-            echo "⚠️ 未检测到 NVD API Key，扫描可能会非常缓慢"
-            echo "💡 请前往 https://nvd.nist.gov/developers/request-an-api-key 免费申请"
-            echo "💡 然后在 GitHub 仓库 Settings → Secrets → Actions 中添加 NVD_API_KEY"
-          fi
-
-          mkdir -p build/reports/dependency-check
-
-          # 尝试使用 Gradle OWASP 插件运行
-          if ./gradlew tasks --no-daemon --quiet 2>/dev/null | grep -q "dependencyCheckAnalyze"; then
-            echo "检测到项目已配置 OWASP 插件，使用 Gradle 运行..."
-            if [ -n "$NVD_API_KEY" ]; then
-              ./gradlew dependencyCheckAnalyze --no-daemon \
-                -DnvdApiKey=$NVD_API_KEY \
-                -DnvdApiDelay=6000 || true
-            else
-              ./gradlew dependencyCheckAnalyze --no-daemon || true
-            fi
-          else
-            echo "项目未配置 OWASP 插件，使用命令行工具运行..."
-            DC_VERSION="10.0.4"
-            wget -q "https://github.com/jeremylong/DependencyCheck/releases/download/v${DC_VERSION}/dependency-check-${DC_VERSION}-release.zip" -O /tmp/dc.zip
-            unzip -q /tmp/dc.zip -d /tmp/
-
-            ./gradlew dependencies --no-daemon --write-locks || true
-
-            # 构建 OWASP 命令参数
-            DC_ARGS="--project Mcpatch2JavaClient"
-            DC_ARGS="$DC_ARGS --scan build/"
-            DC_ARGS="$DC_ARGS --out build/reports/dependency-check"
-            DC_ARGS="$DC_ARGS --format HTML"
-            DC_ARGS="$DC_ARGS --format JSON"
-            DC_ARGS="$DC_ARGS --failOnCVSS 7"
-            DC_ARGS="$DC_ARGS --data /tmp/dependency-check-data"
-
-            if [ -n "$NVD_API_KEY" ]; then
-              DC_ARGS="$DC_ARGS --nvdApiKey $NVD_API_KEY"
-            fi
-
-            /tmp/dependency-check/bin/dependency-check.sh $DC_ARGS || true
-          fi
-
-      - name: 上传漏洞扫描报告
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: dependency-scan-report
-          path: build/reports/dependency-check/
-          retention-days: 7
-          if-no-files-found: warn
-
-  # ==========================================================================
-  # Job 6: 代码重复度检查 (CPD)
+  # Job 5: 代码重复度检查 (CPD)
   # ==========================================================================
   code-duplication:
     name: 代码重复度检查
@@ -525,12 +412,12 @@ jobs:
           if-no-files-found: warn
 
   # ==========================================================================
-  # Job 7: 综合检查结果汇总
+  # Job 6: 综合检查结果汇总
   # ==========================================================================
   check-results:
     name: 检查结果汇总
     runs-on: ubuntu-latest
-    needs: [build, checkstyle, static-analysis, test, dependency-scan, code-duplication]
+    needs: [build, checkstyle, static-analysis, test, code-duplication]
     if: always()
 
     steps:
@@ -543,7 +430,6 @@ jobs:
           CHECKSTYLE_STATUS="${{ needs.checkstyle.result }}"
           STATIC_STATUS="${{ needs.static-analysis.result }}"
           TEST_STATUS="${{ needs.test.result }}"
-          DEP_STATUS="${{ needs.dependency-scan.result }}"
           CPD_STATUS="${{ needs.code-duplication.result }}"
 
           echo "| 检查项 | 状态 |" >> $GITHUB_STEP_SUMMARY
@@ -552,7 +438,6 @@ jobs:
           echo "| 代码风格检查 | ${CHECKSTYLE_STATUS} |" >> $GITHUB_STEP_SUMMARY
           echo "| 静态分析 | ${STATIC_STATUS} |" >> $GITHUB_STEP_SUMMARY
           echo "| 单元测试 | ${TEST_STATUS} |" >> $GITHUB_STEP_SUMMARY
-          echo "| 依赖漏洞扫描 | ${DEP_STATUS} |" >> $GITHUB_STEP_SUMMARY
           echo "| 代码重复度检查 | ${CPD_STATUS} |" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
@@ -569,9 +454,5 @@ jobs:
             echo "❌ **测试失败**：存在未通过的测试用例。" >> $GITHUB_STEP_SUMMARY
           fi
 
-          if [[ "${DEP_STATUS}" == "failure" ]]; then
-            echo "🚨 **安全漏洞**：发现高危依赖漏洞，请尽快修复！" >> $GITHUB_STEP_SUMMARY
-          fi
-
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "> 📋 详细报告可在 Artifacts 中下载查看" >> $GITHUB_STEP_SUMMARY