🎉 feat(ci): setup Gitea Actions riutilizzabili cross-repo

- Aggiunti 6 workflow condivisi in .gitea/workflows/ con trigger workflow_call - Implementati: quality-gates, npm-publish, docker-release, auto-release, dependency-check, branch-cleanup - Aggiunti esempi consumer per microservizio e libreria-npm (ci, release, maintenance) - Allineato npm run lint:check su tutti i workflow - Corretti GITEA_TOKEN, gitea.* context, GITHUB_REF/GITHUB_OUTPUT per compatibilità Gitea - Rimosso needs: tra job reusable (Gitea bug #31900), path uses: con .gitea/workflows/ Fixes #1 @1d
2026-03-24 17:04:22 +01:00
parent 9e0928a327
commit 8b292ae35d
12 changed files with 308 additions and 22 deletions
@@ -0,0 +1,48 @@
+name: Auto Release
+
+on:
+  workflow_call:
+
+jobs:
+  auto-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          CURRENT_TAG=${GITHUB_REF#refs/tags/}
+          PREV_TAG=$(git tag --sort=-version:refname | sed -n '2p')
+
+          if [ -z "$PREV_TAG" ]; then
+            CHANGELOG=$(git log --pretty=format:"- %s (%h)" "$CURRENT_TAG")
+          else
+            CHANGELOG=$(git log --pretty=format:"- %s (%h)" "${PREV_TAG}..${CURRENT_TAG}")
+          fi
+
+          echo "$CHANGELOG" > changelog.txt
+          echo "current_tag=$CURRENT_TAG" >> $GITHUB_OUTPUT
+
+      - name: Create release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          CURRENT_TAG=${{ steps.changelog.outputs.current_tag }}
+          APP_NAME=$(jq -r '.name' package.json)
+          CHANGELOG=$(cat changelog.txt)
+
+          curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/releases" \
+            -d "{
+              \"tag_name\": \"$CURRENT_TAG\",
+              \"name\": \"$APP_NAME $CURRENT_TAG\",
+              \"body\": $(echo "$CHANGELOG" | jq -Rs .),
+              \"draft\": false,
+              \"prerelease\": false
+            }"
@@ -0,0 +1,26 @@
+name: Branch Cleanup
+
+on:
+  workflow_call:
+
+jobs:
+  branch-cleanup:
+    runs-on: ubuntu-latest
+    if: gitea.event.pull_request.merged == true
+    steps:
+      - name: Delete merged branch
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          BRANCH="${{ gitea.event.pull_request.head.ref }}"
+
+          if [[ "$BRANCH" == "main" || "$BRANCH" == "master" || "$BRANCH" == "develop" ]]; then
+            echo "Branch protetto, skip: $BRANCH"
+            exit 0
+          fi
+
+          curl -s -X DELETE \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/branches/$(python3 -c "import urllib.parse; print(urllib.parse.quote('$BRANCH', safe=''))")"
+
+          echo "Branch eliminato: $BRANCH"
@@ -0,0 +1,86 @@
+name: Dependency Check
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+  workflow_dispatch:
+
+jobs:
+  dependency-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Security audit
+        id: audit
+        run: |
+          npm audit --audit-level=high --json > audit.json 2>/dev/null || true
+          VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0")
+          echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT
+
+      - name: Check outdated packages
+        id: outdated
+        run: |
+          npm outdated --json > outdated.json 2>/dev/null || true
+          OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0")
+          echo "count=$OUTDATED" >> $GITHUB_OUTPUT
+
+      - name: Open issue if problems found
+        if: steps.audit.outputs.vulnerabilities != '0' || steps.outdated.outputs.count != '0'
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          VULNS="${{ steps.audit.outputs.vulnerabilities }}"
+          OUTDATED="${{ steps.outdated.outputs.count }}"
+          DATE=$(date '+%Y-%m-%d')
+
+          VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")
+          OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")
+
+          BODY="## Dependency Check — $DATE
+
+### Vulnerabilità (high/critical): $VULNS
+
+\`\`\`
+$VULN_LIST
+\`\`\`
+
+### Pacchetti obsoleti: $OUTDATED
+
+\`\`\`
+$OUTDATED_LIST
+\`\`\`"
+
+          curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/issues" \
+            -d "{
+              \"title\": \"[$DATE] Dipendenze: $VULNS vulnerabilità, $OUTDATED obsoleti\",
+              \"body\": $(echo "$BODY" | jq -Rs .)
+            }"
@@ -0,0 +1,79 @@
+name: Docker Release
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+
+jobs:
+  docker-release:
+    runs-on: catthehacker-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type check
+        run: npm run typecheck
+
+      - name: Lint
+        run: npm run lint:check
+
+      - name: Format check
+        run: npm run format:check
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm run test
+
+      - name: Login to container registry
+        uses: https://gitea.com/docker/login-action@v3
+        with:
+          registry: gitea.pzetatouch.it
+          username: ${{ secrets.G_USER }}
+          password: ${{ secrets.NPM_TOKEN }}
+
+      - name: Determine image tags
+        id: tags
+        run: |
+          APP_NAME=$(jq -r '.name' package.json)
+          VERSION=$(jq -r '.version' package.json)
+          REGISTRY="gitea.pzetatouch.it/pzeta_touch"
+          echo "version_tag=${REGISTRY}/${APP_NAME}:${VERSION}" >> $GITHUB_OUTPUT
+          echo "latest_tag=${REGISTRY}/${APP_NAME}:latest" >> $GITHUB_OUTPUT
+
+      - name: Build and push Docker image
+        uses: https://gitea.com/docker/build-push-action@v6
+        with:
+          push: true
+          context: .
+          file: ./Dockerfile
+          tags: |
+            ${{ steps.tags.outputs.version_tag }}
+            ${{ steps.tags.outputs.latest_tag }}
+          build-args: |
+            NPM_TOKEN=${{ secrets.NPM_TOKEN }}
@@ -0,0 +1,54 @@
+name: Publish npm Package
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+
+jobs:
+  npm-publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint:check
+
+      - name: Type check
+        run: npm run typecheck
+
+      - name: Format check
+        run: npm run format:check
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm run test
+
+      - name: Publish
+        run: npm publish
@@ -0,0 +1,57 @@
+name: Quality Gates
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+
+jobs:
+  quality-gates:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Check outdated packages
+        run: npm outdated || true
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Security audit
+        run: npm audit --audit-level=high || true
+
+      - name: Lint
+        run: npm run lint:check
+
+      - name: Type check
+        run: npm run typecheck
+
+      - name: Format check
+        run: npm run format:check
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm run test