供应链变更审计与风险登记治理（类型-范围-评分）最佳实践

实现示例type Change = { type: 'registry' | 'dependency' | 'license' | 'artifact' | 'config'; impact: 'low' | 'medium' | 'high'; evidence: string[] } function score(c: Change): number { const base = c.type === 'registry' || c.type === 'artifact' ? 3 : 2; const imp = c.impact === 'high' ? 3 : c.impact === 'medium' ? 2 : 1; const ev = Math.min(c.evidence.length, 3); return base * imp + ev } function decide(list: Change[], thresholds: { block: number; warn: number }): { blocked: Change[]; warned: Change[]; passed: Change[] } { const blocked: Change[] = []; const warned: Change[] = []; const passed: Change[] = []; for (const c of list) { const s = score(c); if (s >= thresholds.block) blocked.push(c); else if (s >= thresholds.warn) warned.push(c); else passed.push(c) } return { blocked, warned, passed } } 审计与发布治理审计包含变更类型、范围与证据；阻断与警告项需审批与复核。风险评分与门禁阈值版本化管理，支持回溯与对比。