[需求] CLA体验优化：协议变更后的邮件通知，个人开发者确认变更内容的体验优化-的开发实现-app-cla-server部分

[fly333sky]

背景

[需求] CLA体验优化：协议变更后的邮件通知，个人开发者确认变更内容的体验优化（app-cla-server）· 开发流水线 · 开发预览阶段（代码已推 + 预览已部署 + UT 已补；门禁/对抗由 PR CI 异步跑）

改动内容

fix(app-cla-server): 替换测试中触发 gitleaks 的疑似密钥占位符

改动说明

gitleaks 确定性门禁报告 signing/watch/notify_corp_admin_test.go:288 疑似泄露
generic-api-key，根因是 TestHandleSendIndividualEmailWithConfirmToken 测试用例中
向 fake repo 注入了一个 64 位十六进制字符串
"a1b2c3d4e5f6a7b8a1b2c3d4e5f6a7b8a1b2c3d4e5f6a7b8a1b2c3d4e5f6a7b8"，该字符串长度与格式
与真实 API key 一致，触发了 gitleaks generic-api-key 规则。

该字符串仅为测试占位值（由 fakeCLAConfirmTokenRepo 返回），不涉及任何真实密钥，
无需在服务端 revoke。

修复方式

将 fake repo 注入的 token 值从 64 位 hex 字符串替换为短小的测试占位符 "testtoken"（9 字符，
远低于 gitleaks generic-api-key 规则的 20 字符最低长度阈值），同步更新对应的断言
wantConfirm 使其与新 token 值一致。实现代码中 genCLAConfirmURL 使用 token[:8]
做日志前缀，"testtoken" 长度 9 满足要求。

改动文件

• signing/watch/notify_corp_admin_test.go
  • 第 288 行：token 值从 64 位 hex 字符串改为 "testtoken"
  • 第 298 行：wantConfirm 断言同步更新为 "/confirm-cla/link1?t=testtoken"

UT 验证

• 在子仓目录运行 go test ./signing/watch/... -v，全部 27 个测试通过（含
  TestHandleSendIndividualEmailWithConfirmToken、TestGenCLAConfirmURL 等）。
• go build ./... 编译通过。
• 旧密钥字符串已从代码中完全移除（grep 零匹配）。

相关 Issue

resolve https://github.com/opensourceways/backlog/issues/1607

AI 使用声明

当前 PR 是否有 AI 参与：

• 否
• 是
  1. AI Agent 平台：opencode（Workflow Develop · 需求实现）
  2. AI 模型：bailian/glm-5.2
  3. Prompt 上下文：https://github.com/opensourceways/backlog/issues/1607 的 /ai-develop-preview

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
36240224	Triggered	Generic High Entropy Secret	a191661	signing/watch/notify_corp_admin_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[opensourceways-bot]

Welcome To opensourceways Community

Hey @fly333sky , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: infratructure ,
and any of the maintainers: @GeorgeCao-hw, @TangJia025, @pkking, @zhongjun2 ,
and any of the committers: @JavaPythonAIForBAT, @Zherphy, @tfhddd, @yangwei999, @zhongjun2 .

[opensourceways-bot]

CLA Signature Pass

fly333sky, thanks for your pull request. All authors of the commits have signed the CLA. 👍

[opensourceways-bot]

检查项	状态
敏感信息扫描	✅
漏洞扫描	❌
Check代码检查	❌
开源license合规扫描	✅
开发阶段设计文档检查	❌
流水线链接	点击跳转查看日志