Git子树外部代码引入治理（固定提交-审计）最佳实践

实现示例type Subtree = { prefix: string; remote: string; commit: string } const allowHosts = new Set<string>(['github.com','git.example.com']) function sha40(s: string): boolean { return /^[a-f0-9]{40}$/.test(s) } function validRemote(u: string): boolean { try { const x = new URL(u); return x.protocol === 'https:' && allowHosts.has(x.host) } catch { return false } } function evaluate(s: Subtree): { ok: boolean; errors: string[] } { const errors: string[] = [] if (!s.prefix || !sha40(s.commit) || !validRemote(s.remote)) errors.push('entry') return { ok: errors.length === 0, errors } } 审计与运行治理审计前后提交差异与来源；异常阻断并输出修复建议。子树变更需审批与归档。