仓库自包含化：Docker/CI/文档/规范入库，路由分组拆分

internal/api/webhook_test.go

@@ -173,6 +173,36 @@ func TestWebhookDispatch(t *testing.T) {
 			headers:    map[string]string{onsHeaderTimestamp: now},
 			wantStatus: http.StatusBadRequest,
 		},
+		{
+			name: "SigningCertURL 非 Oracle 域名拒绝", secret: "",
+			headers: map[string]string{
+				onsHeaderMessageID:      "m-evil-cert",
+				onsHeaderTimestamp:      now,
+				onsHeaderSigningCertURL: "https://evil.example.com/cert.crt",
+			},
+			body:       `{"eventType":"t"}`,
+			wantStatus: http.StatusForbidden,
+		},
+		{
+			name: "SigningCertURL 非 https 拒绝", secret: "",
+			headers: map[string]string{
+				onsHeaderMessageID:      "m-http-cert",
+				onsHeaderTimestamp:      now,
+				onsHeaderSigningCertURL: "http://objectstorage.eu-paris-1.oraclecloud.com/cert.crt",
+			},
+			body:       `{"eventType":"t"}`,
+			wantStatus: http.StatusForbidden,
+		},
+		{
+			name: "SigningCertURL 白名单内放行(canonical form 未接入,不做签名校验)", secret: "",
+			headers: map[string]string{
+				onsHeaderMessageID:      "m-good-cert",
+				onsHeaderTimestamp:      now,
+				onsHeaderSigningCertURL: "https://objectstorage.eu-paris-1.oraclecloud.com/p/x/n/bmc-ons-prod/b/ons-ds/o/sig.crt",
+			},
+			body:       `{"eventType":"t"}`,
+			wantStatus: http.StatusOK, wantIngest: 1,
+		},
 		{
 			name: "缺时间戳头放行入库", secret: "",
 			headers:    map[string]string{onsHeaderMessageID: "m2"},