[CI/CD及代码质量优化]: 主要调整构建配置与CI流程，增强代码静态检查与安全性

- **优化.clang-tidy配置**：扩展静态检查规则集，禁用部分不适用条款，启用临时析构函数分析
- **重构GitHub Actions逻辑**：
  - 移除install-dependencies中冗余的os_name参数传递
  - 新增CodeQL代码安全扫描工作流，包含定时触发与PR检查
  - 扩展dependabot监控范围至自定义action目录
- **改进打包流程**：
  - 添加Python虚拟环境管理脚本activate_venv.sh
  - 调整macOS打包脚本使用虚拟环境执行Python打包逻辑
- **修复脚本兼容性问题**：
  - 移除package.py的shebang依赖，改为显式调用python解释器
  - 规范shell脚本错误处理与路径操作逻辑

Author: RealChuan

.clang-tidy

@@ -1,7 +1,38 @@
----
-Checks:          'clang-analyzer-*,readability-*,performance-*,modernize-*,bugprone-*,cert-*,portability-*,llvm-*,google-*'
-WarningsAsErrors: ''
+Checks: >
+  clang-analyzer-*,
+  bugprone-*,
+  performance-*,
+  cert-*,
+  misc-*,
+  modernize-*,
+  cppcoreguidelines-*,
+  concurrency-*,
+  -modernize-use-trailing-return-type,
+  -cppcoreguidelines-avoid-magic-numbers,
+  -llvm-header-guard,
+  -readability-identifier-length,
+  -readability-magic-numbers,
+  -modernize-pass-by-value,
+  -cert-err58-cpp,
+  -hicpp-exception-baseclass
+
+WarningsAsErrors: >
+  clang-analyzer-*,
+  bugprone-*,
+  performance-*,
+  cert-*,
+  misc-*,
+  concurrency-mt-unsafe,
+  concurrency-thread-canceltype,
+  cppcoreguidelines-pro-type-*,
+  cppcoreguidelines-owning-memory,
+  cppcoreguidelines-no-malloc,
+  hicpp-noexcept,
+  performance-no-int-to-ptr,
+  performance-trivially-destructible,
+  bugprone-exception-escape
+
 HeaderFilterRegex: '.'
-AnalyzeTemporaryDtors: false
-FormatStyle:     none
-User:            user
+AnalyzeTemporaryDtors: true
+FormatStyle: file
+User: user

.github/actions/install-dependencies/action.yml

@@ -1,10 +1,6 @@
 name: 'Install Dependencies'
 description: 'Install qt environment and compile dependencies'
 inputs:
-  os_name:
-    description: 'os name'
-    required: true
-    type: string
   qt_modules:
     description: 'qt modules'
     required: false

.github/dependabot.yml

@@ -6,6 +6,8 @@
 version: 2
 updates:
   - package-ecosystem: "github-actions" # See documentation for possible values
-    directory: "/" # Location of package manifests
+    directories : 
+      - "/" # Location of package manifests
+      - "/.github/actions/**"
     schedule:
       interval: "weekly"

.github/workflows/cmake.yml

@@ -42,8 +42,6 @@ jobs:
           fetch-depth: 1
 
       - uses: ./.github/actions/install-dependencies
-        with:
-          os_name: ${{ matrix.os }}
 
       - name: Configure and build windows
         if: startsWith(matrix.os, 'windows')

.github/workflows/codeql.yml

@@ -0,0 +1,49 @@
+name: CodeQL
+
+on: 
+  push:
+    paths-ignore: 
+        - '**/picture/**'
+        - 'packaging/**'
+        - '.clang-*'
+        - '.gitignore'
+        - 'LICENSE'
+        - '*.pro'
+        - 'README*'
+  pull_request:
+    paths-ignore: 
+        - '**/picture/**'
+        - 'packaging/**'
+        - '.clang-*'
+        - '.gitignore'
+        - 'LICENSE'
+        - '*.pro'
+        - 'README*'
+        
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+  
+
+jobs:
+  CodeQL:
+    runs-on: ubuntu-latest
+  
+    steps:      
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - uses: ./.github/actions/install-dependencies
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+            languages: cpp
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        

.github/workflows/qmake.yml

@@ -40,8 +40,6 @@ jobs:
           fetch-depth: 1
 
       - uses: ./.github/actions/install-dependencies
-        with:
-          os_name: ${{ matrix.os }}
 
       - uses: RealChuan/install-jom@main
 

packaging/activate_venv.sh

@@ -0,0 +1,24 @@
+#!/bin/bash -ex
+
+VENV_NAME="venv" # 定义虚拟环境目录名
+
+# 检查虚拟环境是否存在
+if [ ! -d "$VENV_NAME" ]; then
+    echo "创建虚拟环境 '$VENV_NAME'..."
+    python3 -m venv "$VENV_NAME" || {
+        echo "创建失败"
+        exit 1
+    }
+else
+    echo "检测到虚拟环境 '$VENV_NAME' 已存在"
+fi
+
+# 自动激活虚拟环境（需通过 source 执行脚本）
+echo "激活虚拟环境..."
+source "$VENV_NAME/bin/activate"
+
+# 提示用户后续操作
+echo "虚拟环境已激活，当前 Python 路径: $(which python)"
+
+current_path=$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")
+pip install -r "${current_path}/requirements.txt" -i https://pypi.tuna.tsinghua.edu.cn/simple

packaging/macos/package.py

@@ -1,4 +1,3 @@
-#!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 
 import os

packaging/macos/package.sh

@@ -92,5 +92,7 @@ cp -f -v ${project_root}/packaging/macos/dmg.json ${release_dir}/dmg.json
 appdmg ${release_dir}/dmg.json ${out_dmg_path}
 notarize_app "${out_dmg_path}"
 
+source ${project_root}/packaging/activate_venv.sh
 cd "$(dirname "$0")"
-./package.py
+python ./package.py
+deactivate