概述
执行聚焦的安全审查：扫描泄露密钥，验证最小权限 IAM，并在发布前确认依赖来源可追溯且无已知高危漏洞。本工作流属于安全合规领域，目标是block the release if a leaked secret, an over-privileged role, or a critical dependency vulnerability is found.以下步骤将指导你完成关键操作，并在每一步设置可验证的中间状态，确保最终结果可复现、可审计、可回滚。
步骤详解
-
Scan for leaked secrets。 Run a secret scanner across the repository and built artifacts and fail on any high-confidence finding.预期状态：No leaked secrets are present in the repo or artifacts.
-
Review IAM for least privilege。 Compare each role and policy against the actions the service actually uses and remove unused permissions.预期状态：Every role grants only the actions required and excess permissions are removed.
-
Verify dependency provenance。 Generate an SBOM, check each dependency against the vulnerability database, and confirm signatures where available.预期状态：SBOM is produced and no critical or high vulnerability is unresolved.
每一步都包含明确的动作与预期状态。执行时请记录实际输出，与预期状态逐一对照。若某一步未达预期，应停下排查而非继续推进，避免问题向后传递放大。
验证与后续
验证方法：block the release if a leaked secret, an over-privileged role, or a critical dependency vulnerability is found.完成后，将本次执行的命令、输出与参数归档，并更新团队运行手册。若用于生产环境，请先在预发环境完整演练一次，并确认团队熟悉回滚路径与应急联系人。本工作流难度级别为入门（beginner），预计耗时约20分钟。该流程已通过结构化校验，步骤与决策点均与英文版本严格一致，可在本地按工作流步骤复现并核对结果。
代码示例
trivy fs --severity HIGH,CRITICAL --exit-code 1 .