Git子树外部代码引入治理（固定提交-审计）最佳实践

**实现示例** ```ts type Subtree = { prefix: string; remote: string; commit: string } const allowHosts = new Set(['github.com','git.example.com']) function sha40(s: string): boolean { return /^[a-f0-9]{40}$/.test(s) } function validRemote(u: string): boolean { try { const x = new URL(u); return x.protocol === 'https:' && allowHosts.has(x.host) } catch { return false } } function evaluate(s: Subtree): { ok: boolean; errors: string[] } { const errors: string[] = [] if (!s.prefix || !sha40(s.commit) || !validRemote(s.remote)) errors.push('entry') return { ok: errors.length === 0, errors } } ``` **审计与运行治理** - 审计前后提交差异与来源；异常阻断并输出修复建议。 - 子树变更需审批与归档。