🎉 feat(ci): setup Gitea Actions riutilizzabili cross-repo

- Aggiunti 6 workflow condivisi in .gitea/workflows/ con trigger workflow_call - Implementati: quality-gates, npm-publish, docker-release, auto-release, dependency-check, branch-cleanup - Aggiunti esempi consumer per microservizio e libreria-npm (ci, release, maintenance) - Allineato npm run lint:check su tutti i workflow - Corretti GITEA_TOKEN, gitea.* context, GITHUB_REF/GITHUB_OUTPUT per compatibilità Gitea - Rimosso needs: tra job reusable (Gitea bug #31900), path uses: con .gitea/workflows/ Fixes #1 @1d
2026-03-24 17:04:22 +01:00
parent 9e0928a327
commit 8b292ae35d
12 changed files with 308 additions and 22 deletions
@@ -0,0 +1,86 @@
+name: Dependency Check
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+  workflow_dispatch:
+
+jobs:
+  dependency-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Security audit
+        id: audit
+        run: |
+          npm audit --audit-level=high --json > audit.json 2>/dev/null || true
+          VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0")
+          echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT
+
+      - name: Check outdated packages
+        id: outdated
+        run: |
+          npm outdated --json > outdated.json 2>/dev/null || true
+          OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0")
+          echo "count=$OUTDATED" >> $GITHUB_OUTPUT
+
+      - name: Open issue if problems found
+        if: steps.audit.outputs.vulnerabilities != '0' || steps.outdated.outputs.count != '0'
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          VULNS="${{ steps.audit.outputs.vulnerabilities }}"
+          OUTDATED="${{ steps.outdated.outputs.count }}"
+          DATE=$(date '+%Y-%m-%d')
+
+          VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")
+          OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")
+
+          BODY="## Dependency Check — $DATE
+
+### Vulnerabilità (high/critical): $VULNS
+
+\`\`\`
+$VULN_LIST
+\`\`\`
+
+### Pacchetti obsoleti: $OUTDATED
+
+\`\`\`
+$OUTDATED_LIST
+\`\`\`"
+
+          curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/issues" \
+            -d "{
+              \"title\": \"[$DATE] Dipendenze: $VULNS vulnerabilità, $OUTDATED obsoleti\",
+              \"body\": $(echo "$BODY" | jq -Rs .)
+            }"