fix: handle empty GitHub token list in Actions

.github/workflows/generate-report.yml

@@ -37,7 +37,7 @@ jobs:
     timeout-minutes: 30
     env:
       GITHUB_TOKEN: ${{ secrets.REPORT_GITHUB_TOKEN || github.token }}
-      GITHUB_TOKENS: ${{ secrets.REPORT_GITHUB_TOKENS || '' }}
+      GITHUB_TOKENS: ${{ secrets.REPORT_GITHUB_TOKENS || '[]' }}
       REPORT_OUTPUT: artifacts/github-security-report.md
       REPORT_MAX_ITEMS: ${{ github.event.inputs.max_items || '20' }}
       REPORT_KEYWORD_LIMIT: ${{ github.event.inputs.keyword_limit || '5' }}

config.py

@@ -3,15 +3,18 @@ from __future__ import annotations
 import json
 import os
 from pathlib import Path
-from typing import Any, ClassVar
+from typing import Annotated, Any, ClassVar
 
 from pydantic import BaseModel, Field, field_validator, model_validator
 
 try:
-    from pydantic_settings import BaseSettings, SettingsConfigDict
+    from pydantic_settings import BaseSettings, NoDecode, SettingsConfigDict
 except ModuleNotFoundError:
     from dotenv import dotenv_values
 
+    class NoDecode:
+        """Marker used by pydantic-settings when available."""
+
     class SettingsConfigDict(dict):
         """兼容缺少 pydantic-settings 的运行环境。"""
 
@@ -183,7 +186,10 @@ class Settings(BaseSettings):
     primary_ai_model: str = Field(default="qwen3-next", alias="PRIMARY_AI_MODEL")
 
     # Backup AI configs (JSON list)
-    backup_ai_configs: list[dict[str, str]] = Field(default_factory=list, alias="BACKUP_AI_CONFIGS")
+    backup_ai_configs: Annotated[list[dict[str, str]], NoDecode] = Field(
+        default_factory=list,
+        alias="BACKUP_AI_CONFIGS",
+    )
 
     # Gemini config
     gemini_ai_key: str = Field(default="", alias="GEMINI_AI_KEY")
@@ -194,7 +200,7 @@ class Settings(BaseSettings):
     )
 
     # GitHub tokens
-    github_tokens: list[str] = Field(default_factory=list, alias="GITHUB_TOKENS")
+    github_tokens: Annotated[list[str], NoDecode] = Field(default_factory=list, alias="GITHUB_TOKENS")
     github_token: str = Field(default="", alias="GITHUB_TOKEN")
 
     # Blog

tests/test_config_public_release.py

@@ -88,3 +88,20 @@ def test_config_imports_with_empty_public_environment(monkeypatch, tmp_path):
     assert reloaded.settings.gemini_ai_key == ""
     assert reloaded.settings.monitor_interval > 0
     assert Path(reloaded.settings.database_path).name == "cve_database.db"
+
+
+def test_config_treats_empty_complex_env_values_as_unconfigured(monkeypatch, tmp_path):
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setenv("GITHUB_TOKENS", "")
+    monkeypatch.setenv("BACKUP_AI_CONFIGS", "")
+    monkeypatch.delenv("GITHUB_TOKEN", raising=False)
+    monkeypatch.delenv("PRIMARY_AI_KEY", raising=False)
+    monkeypatch.delenv("GEMINI_AI_KEY", raising=False)
+    monkeypatch.delenv("BLOG_TOKEN", raising=False)
+
+    import config
+
+    reloaded = importlib.reload(config)
+
+    assert reloaded.settings.github_tokens == []
+    assert reloaded.settings.backup_ai_configs == []