chore(trunk): 初始化 trunk 门禁(纯质量/格式,无扫描)；checker 改为按目标仓库根运行并移除 trivy 扫描步骤

.trunk/.gitignore

@@ -0,0 +1,9 @@
+*out
+*logs
+*actions
+*notifications
+*tools
+plugins
+user_trunk.yaml
+user.yaml
+tmp

.trunk/configs/.markdownlint.yaml

@@ -0,0 +1,10 @@
+# Autoformatter friendly markdownlint config (all formatting rules disabled)
+default: true
+blank_lines: false
+bullet: false
+html: false
+indentation: false
+line_length: false
+spaces: false
+url: false
+whitespace: false

.trunk/configs/.shellcheckrc

@@ -0,0 +1,7 @@
+enable=all
+source-path=SCRIPTDIR
+disable=SC2154
+
+# If you're having issues with shellcheck following source, disable the errors via:
+# disable=SC1090
+# disable=SC1091

.trunk/configs/.yamllint.yaml

@@ -0,0 +1,10 @@
+rules:
+  quoted-strings:
+    required: only-when-needed
+    extra-allowed: ["{|}"]
+  empty-values:
+    forbid-in-block-mappings: true
+    forbid-in-flow-mappings: true
+  key-duplicates: {}
+  octal-values:
+    forbid-implicit-octal: true

.trunk/trunk.yaml

@@ -0,0 +1,23 @@
+# This file controls the behavior of Trunk: https://docs.trunk.io/cli
+# To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
+version: 0.1
+cli:
+  version: 1.25.0
+# Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
+runtimes:
+  enabled:
+    - go@1.19.5
+    - node@18.12.1
+    - python@3.10.8
+# This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
+lint:
+  enabled:
+    - git-diff-check
+    - markdownlint@0.49.1
+    - prettier@3.9.6
+    - shellcheck@0.8.0
+    - shfmt@3.6.0
+    - yamllint@1.38.0
+actions:
+  enabled:
+    - trunk-upgrade-available

tool-trunk-checker.sh

@@ -95,12 +95,24 @@ echo "🚀 正在运行代码质量检查..."
 echo "========================================"
 echo "模式: ${MODE}"
 
-# 切换到工作目录
+# 切换到工作目录（文件收集阶段；实际运行 trunk 前会再切到目标仓库根）
 cd /workspace || exit
 
-# 检查trunk工具是否可用
-if ! command -v ./trunk &>/dev/null; then
-	echo "❌ trunk工具未找到，请确保已正确安装"
+# 解析 trunk 二进制（优先级：TRUNK_BIN 环境变量 > /workspace/trunk > PATH 中的 trunk）
+resolve_trunk() {
+	if [ -n "${TRUNK_BIN:-}" ] && [ -x "$TRUNK_BIN" ]; then
+		printf '%s\n' "$TRUNK_BIN"
+	elif [ -x /workspace/trunk ]; then
+		printf '%s\n' /workspace/trunk
+	elif command -v trunk >/dev/null 2>&1; then
+		command -v trunk
+	else
+		printf '\n'
+	fi
+}
+TRUNK_BIN="$(resolve_trunk)"
+if [ -z "$TRUNK_BIN" ]; then
+	echo "❌ trunk工具未找到，请设置 TRUNK_BIN 或安装 trunk"
 	exit 1
 fi
 
@@ -172,10 +184,19 @@ echo "📊 共发现 ${FILE_COUNT} 个需要检查的文件:"
 echo "${ALL_FILES}"
 echo ""
 
-# 运行trunk check检查代码质量
+# 确定目标所在的 git 仓库根并切换（子模块是独立 git 仓库，需在各自仓库根运行 trunk）
+if [ -n "$ALL_FILES" ]; then
+	FIRST_FILE="$(printf '%s\n' "$ALL_FILES" | head -n 1)"
+	REPO_ROOT="$(git -C "$(dirname "$FIRST_FILE")" rev-parse --show-toplevel 2>/dev/null || echo /workspace)"
+else
+	REPO_ROOT="/workspace"
+fi
+cd "$REPO_ROOT" || exit
+
+# 运行trunk check检查代码质量（已禁用安全扫描类工具，仅纯代码质量/格式检查）
 echo ""
 echo "🔍 正在运行代码质量检查..."
-if ! ./trunk check ${ALL_FILES}; then
+if ! "$TRUNK_BIN" check ${ALL_FILES}; then
 	echo ""
 	echo "❌ 代码质量检查失败！"
 	echo ""
@@ -184,16 +205,6 @@ if ! ./trunk check ${ALL_FILES}; then
 	exit 1
 fi
 
-# 检查安全漏洞
-echo ""
-echo "🔒 正在检查安全漏洞..."
-if ! ./trunk check --filter=trivy ${ALL_FILES}; then
-	echo ""
-	echo "⚠️  发现安全相关问题，建议检查后再推送"
-	echo ""
-	exit 1
-fi
-
 echo ""
 echo "✅ 代码质量检查通过！可以安全提交。"
 echo "========================================"