Revert "feat(ecc): prune plugin 43→12 items, promote 7 rules to .claude/rules/ (#245)"

This reverts commit 1bd68ff534.
2026-04-15 14:33:33 +08:00 · 2026-02-20 01:11:30 -08:00
parent 1bd68ff534
commit 0e9f613fd1
536 changed files with 111479 additions and 253 deletions
--- a/docs/zh-CN/skills/django-verification/SKILL.md
+++ b/docs/zh-CN/skills/django-verification/SKILL.md
@@ -0,0 +1,466 @@
+---
+name: django-verification
+description: Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR.
+---
+
+# Django 验证循环
+
+在发起 PR 之前、进行重大更改之后以及部署之前运行，以确保 Django 应用程序的质量和安全性。
+
+## 阶段 1: 环境检查
+
+```bash
+# Verify Python version
+python --version  # Should match project requirements
+
+# Check virtual environment
+which python
+pip list --outdated
+
+# Verify environment variables
+python -c "import os; import environ; print('DJANGO_SECRET_KEY set' if os.environ.get('DJANGO_SECRET_KEY') else 'MISSING: DJANGO_SECRET_KEY')"
+```
+
+如果环境配置错误，请停止并修复。
+
+## 阶段 2: 代码质量与格式化
+
+```bash
+# Type checking
+mypy . --config-file pyproject.toml
+
+# Linting with ruff
+ruff check . --fix
+
+# Formatting with black
+black . --check
+black .  # Auto-fix
+
+# Import sorting
+isort . --check-only
+isort .  # Auto-fix
+
+# Django-specific checks
+python manage.py check --deploy
+```
+
+常见问题：
+
+* 公共函数缺少类型提示
+* 违反 PEP 8 格式规范
+* 导入未排序
+* 生产配置中遗留调试设置
+
+## 阶段 3: 数据库迁移
+
+```bash
+# Check for unapplied migrations
+python manage.py showmigrations
+
+# Create missing migrations
+python manage.py makemigrations --check
+
+# Dry-run migration application
+python manage.py migrate --plan
+
+# Apply migrations (test environment)
+python manage.py migrate
+
+# Check for migration conflicts
+python manage.py makemigrations --merge  # Only if conflicts exist
+```
+
+报告：
+
+* 待应用的迁移数量
+* 任何迁移冲突
+* 模型更改未生成迁移
+
+## 阶段 4: 测试与覆盖率
+
+```bash
+# Run all tests with pytest
+pytest --cov=apps --cov-report=html --cov-report=term-missing --reuse-db
+
+# Run specific app tests
+pytest apps/users/tests/
+
+# Run with markers
+pytest -m "not slow"  # Skip slow tests
+pytest -m integration  # Only integration tests
+
+# Coverage report
+open htmlcov/index.html
+```
+
+报告：
+
+* 总测试数：X 通过，Y 失败，Z 跳过
+* 总体覆盖率：XX%
+* 按应用划分的覆盖率明细
+
+覆盖率目标：
+
+| 组件 | 目标 |
+|-----------|--------|
+| 模型 | 90%+ |
+| 序列化器 | 85%+ |
+| 视图 | 80%+ |
+| 服务 | 90%+ |
+| 总体 | 80%+ |
+
+## 阶段 5: 安全扫描
+
+```bash
+# Dependency vulnerabilities
+pip-audit
+safety check --full-report
+
+# Django security checks
+python manage.py check --deploy
+
+# Bandit security linter
+bandit -r . -f json -o bandit-report.json
+
+# Secret scanning (if gitleaks is installed)
+gitleaks detect --source . --verbose
+
+# Environment variable check
+python -c "from django.core.exceptions import ImproperlyConfigured; from django.conf import settings; settings.DEBUG"
+```
+
+报告：
+
+* 发现易受攻击的依赖项
+* 安全配置问题
+* 检测到硬编码的密钥
+* DEBUG 模式状态（生产环境中应为 False）
+
+## 阶段 6: Django 管理命令
+
+```bash
+# Check for model issues
+python manage.py check
+
+# Collect static files
+python manage.py collectstatic --noinput --clear
+
+# Create superuser (if needed for tests)
+echo "from apps.users.models import User; User.objects.create_superuser('admin@example.com', 'admin')" | python manage.py shell
+
+# Database integrity
+python manage.py check --database default
+
+# Cache verification (if using Redis)
+python -c "from django.core.cache import cache; cache.set('test', 'value', 10); print(cache.get('test'))"
+```
+
+## 阶段 7: 性能检查
+
+```bash
+# Django Debug Toolbar output (check for N+1 queries)
+# Run in dev mode with DEBUG=True and access a page
+# Look for duplicate queries in SQL panel
+
+# Query count analysis
+django-admin debugsqlshell  # If django-debug-sqlshell installed
+
+# Check for missing indexes
+python manage.py shell << EOF
+from django.db import connection
+with connection.cursor() as cursor:
+    cursor.execute("SELECT table_name, index_name FROM information_schema.statistics WHERE table_schema = 'public'")
+    print(cursor.fetchall())
+EOF
+```
+
+报告：
+
+* 每页查询次数（典型页面应 < 50）
+* 缺少数据库索引
+* 检测到重复查询
+
+## 阶段 8: 静态资源
+
+```bash
+# Check for npm dependencies (if using npm)
+npm audit
+npm audit fix
+
+# Build static files (if using webpack/vite)
+npm run build
+
+# Verify static files
+ls -la staticfiles/
+python manage.py findstatic css/style.css
+```
+
+## 阶段 9: 配置审查
+
+```python
+# Run in Python shell to verify settings
+python manage.py shell << EOF
+from django.conf import settings
+import os
+
+# Critical checks
+checks = {
+    'DEBUG is False': not settings.DEBUG,
+    'SECRET_KEY set': bool(settings.SECRET_KEY and len(settings.SECRET_KEY) > 30),
+    'ALLOWED_HOSTS set': len(settings.ALLOWED_HOSTS) > 0,
+    'HTTPS enabled': getattr(settings, 'SECURE_SSL_REDIRECT', False),
+    'HSTS enabled': getattr(settings, 'SECURE_HSTS_SECONDS', 0) > 0,
+    'Database configured': settings.DATABASES['default']['ENGINE'] != 'django.db.backends.sqlite3',
+}
+
+for check, result in checks.items():
+    status = '✓' if result else '✗'
+    print(f"{status} {check}")
+EOF
+```
+
+## 阶段 10: 日志配置
+
+```bash
+# Test logging output
+python manage.py shell << EOF
+import logging
+logger = logging.getLogger('django')
+logger.warning('Test warning message')
+logger.error('Test error message')
+EOF
+
+# Check log files (if configured)
+tail -f /var/log/django/django.log
+```
+
+## 阶段 11: API 文档（如果使用 DRF）
+
+```bash
+# Generate schema
+python manage.py generateschema --format openapi-json > schema.json
+
+# Validate schema
+# Check if schema.json is valid JSON
+python -c "import json; json.load(open('schema.json'))"
+
+# Access Swagger UI (if using drf-yasg)
+# Visit http://localhost:8000/swagger/ in browser
+```
+
+## 阶段 12: 差异审查
+
+```bash
+# Show diff statistics
+git diff --stat
+
+# Show actual changes
+git diff
+
+# Show changed files
+git diff --name-only
+
+# Check for common issues
+git diff | grep -i "todo\|fixme\|hack\|xxx"
+git diff | grep "print("  # Debug statements
+git diff | grep "DEBUG = True"  # Debug mode
+git diff | grep "import pdb"  # Debugger
+```
+
+检查清单：
+
+* 无调试语句（print, pdb, breakpoint()）
+* 关键代码中无 TODO/FIXME 注释
+* 无硬编码的密钥或凭证
+* 模型更改包含数据库迁移
+* 配置更改已记录
+* 外部调用存在错误处理
+* 需要时已进行事务管理
+
+## 输出模板
+
+```
+DJANGO VERIFICATION REPORT
+==========================
+
+Phase 1: Environment Check
+  ✓ Python 3.11.5
+  ✓ Virtual environment active
+  ✓ All environment variables set
+
+Phase 2: Code Quality
+  ✓ mypy: No type errors
+  ✗ ruff: 3 issues found (auto-fixed)
+  ✓ black: No formatting issues
+  ✓ isort: Imports properly sorted
+  ✓ manage.py check: No issues
+
+Phase 3: Migrations
+  ✓ No unapplied migrations
+  ✓ No migration conflicts
+  ✓ All models have migrations
+
+Phase 4: Tests + Coverage
+  Tests: 247 passed, 0 failed, 5 skipped
+  Coverage:
+    Overall: 87%
+    users: 92%
+    products: 89%
+    orders: 85%
+    payments: 91%
+
+Phase 5: Security Scan
+  ✗ pip-audit: 2 vulnerabilities found (fix required)
+  ✓ safety check: No issues
+  ✓ bandit: No security issues
+  ✓ No secrets detected
+  ✓ DEBUG = False
+
+Phase 6: Django Commands
+  ✓ collectstatic completed
+  ✓ Database integrity OK
+  ✓ Cache backend reachable
+
+Phase 7: Performance
+  ✓ No N+1 queries detected
+  ✓ Database indexes configured
+  ✓ Query count acceptable
+
+Phase 8: Static Assets
+  ✓ npm audit: No vulnerabilities
+  ✓ Assets built successfully
+  ✓ Static files collected
+
+Phase 9: Configuration
+  ✓ DEBUG = False
+  ✓ SECRET_KEY configured
+  ✓ ALLOWED_HOSTS set
+  ✓ HTTPS enabled
+  ✓ HSTS enabled
+  ✓ Database configured
+
+Phase 10: Logging
+  ✓ Logging configured
+  ✓ Log files writable
+
+Phase 11: API Documentation
+  ✓ Schema generated
+  ✓ Swagger UI accessible
+
+Phase 12: Diff Review
+  Files changed: 12
+  +450, -120 lines
+  ✓ No debug statements
+  ✓ No hardcoded secrets
+  ✓ Migrations included
+
+RECOMMENDATION: ⚠️ Fix pip-audit vulnerabilities before deploying
+
+NEXT STEPS:
+1. Update vulnerable dependencies
+2. Re-run security scan
+3. Deploy to staging for final testing
+```
+
+## 预部署检查清单
+
+* \[ ] 所有测试通过
+* \[ ] 覆盖率 ≥ 80%
+* \[ ] 无安全漏洞
+* \[ ] 无未应用的迁移
+* \[ ] 生产设置中 DEBUG = False
+* \[ ] SECRET\_KEY 已正确配置
+* \[ ] ALLOWED\_HOSTS 设置正确
+* \[ ] 数据库备份已启用
+* \[ ] 静态文件已收集并提供服务
+* \[ ] 日志配置正常且有效
+* \[ ] 错误监控（Sentry 等）已配置
+* \[ ] CDN 已配置（如果适用）
+* \[ ] Redis/缓存后端已配置
+* \[ ] Celery 工作进程正在运行（如果适用）
+* \[ ] HTTPS/SSL 已配置
+* \[ ] 环境变量已记录
+
+## 持续集成
+
+### GitHub Actions 示例
+
+```yaml
+# .github/workflows/django-verification.yml
+name: Django Verification
+
+on: [push, pull_request]
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:14
+        env:
+          POSTGRES_PASSWORD: postgres
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.11'
+
+      - name: Cache pip
+        uses: actions/cache@v3
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
+
+      - name: Install dependencies
+        run: |
+          pip install -r requirements.txt
+          pip install ruff black mypy pytest pytest-django pytest-cov bandit safety pip-audit
+
+      - name: Code quality checks
+        run: |
+          ruff check .
+          black . --check
+          isort . --check-only
+          mypy .
+
+      - name: Security scan
+        run: |
+          bandit -r . -f json -o bandit-report.json
+          safety check --full-report
+          pip-audit
+
+      - name: Run tests
+        env:
+          DATABASE_URL: postgres://postgres:postgres@localhost:5432/test
+          DJANGO_SECRET_KEY: test-secret-key
+        run: |
+          pytest --cov=apps --cov-report=xml --cov-report=term-missing
+
+      - name: Upload coverage
+        uses: codecov/codecov-action@v3
+```
+
+## 快速参考
+
+| 检查项 | 命令 |
+|-------|---------|
+| 环境 | `python --version` |
+| 类型检查 | `mypy .` |
+| 代码检查 | `ruff check .` |
+| 格式化 | `black . --check` |
+| 迁移 | `python manage.py makemigrations --check` |
+| 测试 | `pytest --cov=apps` |
+| 安全 | `pip-audit && bandit -r .` |
+| Django 检查 | `python manage.py check --deploy` |
+| 收集静态文件 | `python manage.py collectstatic --noinput` |
+| 差异统计 | `git diff --stat` |
+
+请记住：自动化验证可以发现常见问题，但不能替代在预发布环境中的手动代码审查和测试。