refactor: 重构安全防护，新增 SSE 支持

.github/workflows/ci.yml

@@ -10,16 +10,9 @@ permissions:
   contents: read
 
 jobs:
-  build-extension:
-    name: build (${{ matrix.os }} / PHP 8.3)
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - ubuntu-latest
-          - macOS-latest
-
+  quality-and-build:
+    name: quality + build (ubuntu / PHP 8.3)
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
@@ -31,43 +24,8 @@ jobs:
           ini-values: phar.readonly=Off
 
       - uses: dtolnay/rust-toolchain@stable
-
-      - uses: Swatinem/rust-cache@v2
-        with:
-          key: ${{ matrix.os }}-cargo
-          cache-on-failure: true
-
-      - name: cargo fmt (check)
-        run: cargo fmt --all -- --check
-
-      - name: cargo clippy
-        run: cargo clippy --all-targets -- -D warnings
-
-      - name: cargo test (release)
-        run: cargo test --release -- --nocapture
-
-      - name: cargo build (release)
-        run: cargo build --release --verbose
-
-      - name: Verify artifact
-        run: |
-          if   [ -f "target/release/liblychee_worker.so" ];   then EXT=target/release/liblychee_worker.so
-          elif [ -f "target/release/liblychee_worker.dylib" ]; then EXT=target/release/liblychee_worker.dylib
-          else echo "::error::Extension artifact not found"; exit 1
-          fi
-          ls -lh "$EXT"
-
-  php-quality:
-    name: php quality
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: shivammathur/setup-php@v2
         with:
-          php-version: "8.3"
-          tools: composer:v2
-          coverage: none
+          components: rustfmt, clippy
 
       - name: cache composer
         uses: actions/cache@v4
@@ -79,6 +37,17 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-php-composer-
 
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ runner.os }}-cargo
+          cache-on-failure: true
+
+      - name: composer validate
+        run: composer validate --strict --no-check-publish
+
+      - name: install.sh syntax
+        run: bash -n scripts/install.sh
+
       - name: composer install
         run: composer install --no-progress --ansi
 
@@ -88,12 +57,24 @@ jobs:
       - name: composer analyze
         run: composer analyze
 
-      - name: composer test-php
-        run: composer test-php
+      - name: composer test
+        run: composer test
 
-  metadata:
-    name: metadata
-    runs-on: ubuntu-latest
+      - name: composer build
+        run: composer build
+
+      - name: Verify artifact (.so)
+        run: |
+          EXT="target/release/liblychee_worker.so"
+          if [ ! -f "$EXT" ]; then
+            echo "::error::Extension artifact not found"
+            exit 1
+          fi
+          ls -lh "$EXT"
+
+  build-macos:
+    name: build (macOS / PHP 8.3)
+    runs-on: macOS-latest
     steps:
       - uses: actions/checkout@v4
 
@@ -102,26 +83,41 @@ jobs:
           php-version: "8.3"
           tools: composer:v2
           coverage: none
+          ini-values: phar.readonly=Off
 
-      - name: cache composer
-        uses: actions/cache@v4
+      - uses: dtolnay/rust-toolchain@stable
         with:
-          path: |
-            vendor
-            ~/.cache/composer
-          key: ${{ runner.os }}-php-composer-${{ hashFiles('**/composer.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-php-composer-
+          components: rustfmt, clippy
 
-      - name: composer validate
-        run: composer validate --strict --no-check-publish
+      - uses: Swatinem/rust-cache@v2
+        with:
+          key: ${{ runner.os }}-cargo
+          cache-on-failure: true
 
-      - name: install.sh syntax
-        run: bash -n scripts/install.sh
+      - name: composer check-style-rust
+        run: composer check-style-rust
+
+      - name: composer analyze-rust
+        run: composer analyze-rust
+
+      - name: composer test-rust
+        run: composer test-rust
+
+      - name: composer build
+        run: composer build
+
+      - name: Verify artifact (.dylib)
+        run: |
+          EXT="target/release/liblychee_worker.dylib"
+          if [ ! -f "$EXT" ]; then
+            echo "::error::Extension artifact not found"
+            exit 1
+          fi
+          ls -lh "$EXT"
 
   all-checks:
     name: all checks passed
-    needs: [build-extension, php-quality, metadata]
+    needs: [quality-and-build, build-macos]
     runs-on: ubuntu-latest
     steps:
       - run: echo "All required checks passed."

.github/workflows/release.yml

@@ -32,20 +32,47 @@ jobs:
           ini-values: phar.readonly=Off
 
       - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
 
       - uses: Swatinem/rust-cache@v2
         with:
           key: ${{ matrix.os }}-cargo
           cache-on-failure: true
 
-      - name: cargo fmt (check)
-        run: cargo fmt --all -- --check
+      # ── meta / 配置检查（仅 ubuntu，两个平台只需一次） ──
+      - name: composer validate
+        if: runner.os == 'Linux'
+        run: composer validate --strict --no-check-publish
+
+      - name: install.sh syntax
+        if: runner.os == 'Linux'
+        run: bash -n scripts/install.sh
+
+      # ── 质量检查（仅 ubuntu 跑 PHP + Rust；macOS 只跑 Rust） ──
+      - name: composer install
+        if: runner.os == 'Linux'
+        run: composer install --no-progress --ansi
 
-      - name: cargo clippy
-        run: cargo clippy --all-targets -- -D warnings
+      - name: composer check-style
+        if: runner.os == 'Linux'
+        run: composer check-style
 
-      - name: cargo build (release)
-        run: cargo build --release --verbose
+      - name: composer check-style-rust
+        if: runner.os == 'macOS'
+        run: composer check-style-rust
+
+      - name: composer analyze
+        if: runner.os == 'Linux'
+        run: composer analyze
+
+      - name: composer analyze-rust
+        if: runner.os == 'macOS'
+        run: composer analyze-rust
+
+      # ── 构建 ──────────────────────────────────────────────
+      - name: composer build
+        run: composer build
 
       - name: Detect OS / arch / libc for PIE pre-packaged-binary naming
         id: detect
@@ -124,27 +151,9 @@ jobs:
           if-no-files-found: error
           retention-days: 90
 
-  metadata:
-    name: metadata
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: shivammathur/setup-php@v2
-        with:
-          php-version: "8.3"
-          tools: composer:v2
-          coverage: none
-
-      - name: composer validate
-        run: composer validate --strict --no-check-publish
-
-      - name: install.sh syntax
-        run: bash -n scripts/install.sh
-
   release:
     name: publish release artifacts
-    needs: [ build-extension, metadata ]
+    needs: build-extension
     runs-on: ubuntu-latest
 
     steps:

.gitignore

@@ -4,9 +4,10 @@
 
 # vendor
 vendor
-# 构建产物
+# cache
 .phpunit.result.cache
 .php-cs-fixer.cache
+# build
 target
 modules
 

Cargo.toml

@@ -22,6 +22,7 @@ sha1 = "0.10"
 base64 = "0.22"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+libc = "0.2"
 
 [profile.release]
 opt-level = 3

composer.json

@@ -63,8 +63,23 @@
     ],
     "test-php": "phpunit",
     "test-rust": "cargo test --release",
-    "analyze": "phpstan --no-progress --memory-limit=1G",
-    "fix-style": "php-cs-fixer fix",
-    "check-style": "php-cs-fixer fix --dry-run"
+    "analyze": [
+      "@analyze-php",
+      "@analyze-rust"
+    ],
+    "analyze-php": "phpstan --no-progress --memory-limit=1G",
+    "analyze-rust": "cargo clippy --all-targets -- -D warnings",
+    "fix-style": [
+      "@fix-style-php",
+      "@fix-style-rust"
+    ],
+    "fix-style-php": "php-cs-fixer fix --no-interaction --ansi",
+    "fix-style-rust": "cargo fmt --all",
+    "check-style": [
+      "@check-style-php",
+      "@check-style-rust"
+    ],
+    "check-style-php": "php-cs-fixer fix --dry-run --no-interaction --ansi",
+    "check-style-rust": "cargo fmt --all -- --check"
   }
 }