🎉 feat(ci): aggiungi pipeline Capacitor Android riutilizzabile

- Nuovo workflow capacitor-android.yml con build debug e release
- Input configurabili: runner, node-version, java-version, build-type, output-format
- Supporto APK (sideload/test) e AAB (Play Store) via output-format
- Firma release tramite keystore in base64 (secret)
- Setup google-services.json opzionale per Firebase
- Cache npm + Gradle per performance
- Upload artifact automatico (retention 14 giorni)
- Esempi consumer: ci.yml, release.yml, maintenance.yml

.gitea/workflows/capacitor-android.yml

@@ -0,0 +1,135 @@
+name: Capacitor Android
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+      java-version:
+        type: string
+        default: '17'
+      runner:
+        type: string
+        default: 'ubuntu-latest'
+      build-type:
+        description: 'debug | release'
+        type: string
+        default: 'debug'
+      output-format:
+        description: 'apk (sideload/test) | aab (Play Store)'
+        type: string
+        default: 'apk'
+    secrets:
+      NPM_TOKEN:
+        required: false
+      KEYSTORE_BASE64:
+        required: false
+      KEYSTORE_PASSWORD:
+        required: false
+      KEY_ALIAS:
+        required: false
+      KEY_PASSWORD:
+        required: false
+      GOOGLE_SERVICES_JSON:
+        required: false
+
+jobs:
+  android-build:
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Setup Java
+        uses: https://github.com/actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: ${{ inputs.java-version || '17' }}
+
+      - name: Setup Android SDK
+        uses: https://github.com/android-actions/setup-android@v3
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Cache Gradle
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build web app
+        run: npm run build
+
+      - name: Sync Capacitor
+        run: npx cap sync android
+
+      - name: Setup google-services.json
+        if: secrets.GOOGLE_SERVICES_JSON != ''
+        run: echo '${{ secrets.GOOGLE_SERVICES_JSON }}' > android/app/google-services.json
+
+      - name: Setup release keystore
+        if: inputs.build-type == 'release'
+        run: echo '${{ secrets.KEYSTORE_BASE64 }}' | base64 -d > android/app/keystore.jks
+
+      - name: Build Android (APK)
+        if: inputs.output-format == 'apk'
+        working-directory: android
+        env:
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: |
+          if [ "${{ inputs.build-type }}" = "release" ]; then
+            ./gradlew assembleRelease
+          else
+            ./gradlew assembleDebug
+          fi
+
+      - name: Build Android (AAB)
+        if: inputs.output-format == 'aab'
+        working-directory: android
+        env:
+          KEYSTORE_PASSWORD: ${{ secrets.KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
+        run: ./gradlew bundleRelease
+
+      - name: Upload APK artifact
+        if: inputs.output-format == 'apk'
+        uses: https://gitea.com/actions/upload-artifact@v4
+        with:
+          name: android-${{ inputs.build-type }}-apk
+          path: android/app/build/outputs/apk/${{ inputs.build-type }}/*.apk
+          retention-days: 14
+
+      - name: Upload AAB artifact
+        if: inputs.output-format == 'aab'
+        uses: https://gitea.com/actions/upload-artifact@v4
+        with:
+          name: android-release-aab
+          path: android/app/build/outputs/bundle/release/*.aab
+          retention-days: 14

examples/capacitor/ci.yml

@@ -0,0 +1,24 @@
+# Copia in: .gitea/workflows/ci.yml
+# Trigger: push su qualsiasi branch → quality gates + build debug Android
+#
+# Il debug APK viene uplodato come artifact scaricabile dalla PR.
+# Non richiede firma: usato per test interni su device fisico o emulatore.
+
+name: CI
+
+on:
+  push:
+    branches-ignore:
+      - main
+
+jobs:
+  quality-gates:
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/quality-gates.yml@main
+    secrets: inherit
+
+  android-debug:
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/capacitor-android.yml@main
+    secrets: inherit
+    with:
+      build-type: debug
+      output-format: apk

examples/capacitor/maintenance.yml

@@ -0,0 +1,25 @@
+# Copia in: .gitea/workflows/maintenance.yml
+# Trigger:
+#   - PR merged → cleanup branch sorgente
+#   - Ogni lunedì 08:00 → controllo dipendenze vulnerabili/obsolete
+#   - Manuale → workflow_dispatch
+
+name: Maintenance
+
+on:
+  pull_request:
+    types: [closed]
+  schedule:
+    - cron: '0 8 * * 1'
+  workflow_dispatch:
+
+jobs:
+  branch-cleanup:
+    if: gitea.event_name == 'pull_request' && gitea.event.pull_request.merged == true
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/branch-cleanup.yml@main
+    secrets: inherit
+
+  dependency-check:
+    if: gitea.event_name == 'schedule' || gitea.event_name == 'workflow_dispatch'
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-check.yml@main
+    secrets: inherit

examples/capacitor/release.yml

@@ -0,0 +1,48 @@
+# Copia in: .gitea/workflows/release.yml
+# Trigger: git tag v* → APK firmato + AAB Play Store + release Gitea
+#
+# Secrets richiesti nel repository consumer:
+#   KEYSTORE_BASE64        — keystore codificato in base64
+#   KEYSTORE_PASSWORD      — password del keystore
+#   KEY_ALIAS              — alias della chiave
+#   KEY_PASSWORD           — password della chiave
+#   GOOGLE_SERVICES_JSON   — contenuto del file google-services.json (se Firebase)
+#
+# Prerequisito build.gradle (android/app/build.gradle):
+#   signingConfigs {
+#     release {
+#       storeFile file("keystore.jks")
+#       storePassword System.getenv("KEYSTORE_PASSWORD")
+#       keyAlias System.getenv("KEY_ALIAS")
+#       keyPassword System.getenv("KEY_PASSWORD")
+#     }
+#   }
+#
+# NOTA: i job girano in parallelo (no needs).
+# Gitea bug #31900: needs + workflow_call + checkout causa errori di autenticazione.
+
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  android-apk:
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/capacitor-android.yml@main
+    secrets: inherit
+    with:
+      build-type: release
+      output-format: apk
+
+  android-aab:
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/capacitor-android.yml@main
+    secrets: inherit
+    with:
+      build-type: release
+      output-format: aab
+
+  gitea-release:
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/auto-release.yml@main
+    secrets: inherit