🎉 feat(ci): setup Gitea Actions riutilizzabili cross-repo

- Aggiunti 6 workflow condivisi in .gitea/workflows/ con trigger workflow_call
- Implementati: quality-gates, npm-publish, docker-release, auto-release, dependency-check, branch-cleanup
- Aggiunti esempi consumer per microservizio e libreria-npm (ci, release, maintenance)
- Allineato npm run lint:check su tutti i workflow
- Corretti GITEA_TOKEN, gitea.* context, GITHUB_REF/GITHUB_OUTPUT per compatibilità Gitea
- Rimosso needs: tra job reusable (Gitea bug #31900), path uses: con .gitea/workflows/

Fixes #1 @1d

.gitea/workflows/auto-release.yml

@@ -0,0 +1,48 @@
+name: Auto Release
+
+on:
+  workflow_call:
+
+jobs:
+  auto-release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Generate changelog
+        id: changelog
+        run: |
+          CURRENT_TAG=${GITHUB_REF#refs/tags/}
+          PREV_TAG=$(git tag --sort=-version:refname | sed -n '2p')
+
+          if [ -z "$PREV_TAG" ]; then
+            CHANGELOG=$(git log --pretty=format:"- %s (%h)" "$CURRENT_TAG")
+          else
+            CHANGELOG=$(git log --pretty=format:"- %s (%h)" "${PREV_TAG}..${CURRENT_TAG}")
+          fi
+
+          echo "$CHANGELOG" > changelog.txt
+          echo "current_tag=$CURRENT_TAG" >> $GITHUB_OUTPUT
+
+      - name: Create release
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          CURRENT_TAG=${{ steps.changelog.outputs.current_tag }}
+          APP_NAME=$(jq -r '.name' package.json)
+          CHANGELOG=$(cat changelog.txt)
+
+          curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/releases" \
+            -d "{
+              \"tag_name\": \"$CURRENT_TAG\",
+              \"name\": \"$APP_NAME $CURRENT_TAG\",
+              \"body\": $(echo "$CHANGELOG" | jq -Rs .),
+              \"draft\": false,
+              \"prerelease\": false
+            }"

.gitea/workflows/branch-cleanup.yml

@@ -0,0 +1,26 @@
+name: Branch Cleanup
+
+on:
+  workflow_call:
+
+jobs:
+  branch-cleanup:
+    runs-on: ubuntu-latest
+    if: gitea.event.pull_request.merged == true
+    steps:
+      - name: Delete merged branch
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          BRANCH="${{ gitea.event.pull_request.head.ref }}"
+
+          if [[ "$BRANCH" == "main" || "$BRANCH" == "master" || "$BRANCH" == "develop" ]]; then
+            echo "Branch protetto, skip: $BRANCH"
+            exit 0
+          fi
+
+          curl -s -X DELETE \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/branches/$(python3 -c "import urllib.parse; print(urllib.parse.quote('$BRANCH', safe=''))")"
+
+          echo "Branch eliminato: $BRANCH"

.gitea/workflows/dependency-check.yml

@@ -0,0 +1,86 @@
+name: Dependency Check
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+  workflow_dispatch:
+
+jobs:
+  dependency-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Security audit
+        id: audit
+        run: |
+          npm audit --audit-level=high --json > audit.json 2>/dev/null || true
+          VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0")
+          echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT
+
+      - name: Check outdated packages
+        id: outdated
+        run: |
+          npm outdated --json > outdated.json 2>/dev/null || true
+          OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0")
+          echo "count=$OUTDATED" >> $GITHUB_OUTPUT
+
+      - name: Open issue if problems found
+        if: steps.audit.outputs.vulnerabilities != '0' || steps.outdated.outputs.count != '0'
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          VULNS="${{ steps.audit.outputs.vulnerabilities }}"
+          OUTDATED="${{ steps.outdated.outputs.count }}"
+          DATE=$(date '+%Y-%m-%d')
+
+          VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")
+          OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")
+
+          BODY="## Dependency Check — $DATE
+
+### Vulnerabilità (high/critical): $VULNS
+
+\`\`\`
+$VULN_LIST
+\`\`\`
+
+### Pacchetti obsoleti: $OUTDATED
+
+\`\`\`
+$OUTDATED_LIST
+\`\`\`"
+
+          curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/issues" \
+            -d "{
+              \"title\": \"[$DATE] Dipendenze: $VULNS vulnerabilità, $OUTDATED obsoleti\",
+              \"body\": $(echo "$BODY" | jq -Rs .)
+            }"

.gitea/workflows/docker-release.yml

@@ -1,9 +1,11 @@
 name: Docker Release
 
 on:
-  push:
+  workflow_call:
-    tags:
+    inputs:
-      - 'v*'
+      node-version:
+        type: string
+        default: '22.17'
 
 jobs:
   docker-release:
@@ -15,7 +17,7 @@ jobs:
       - name: Setup Node.js
         uses: https://gitea.com/actions/setup-node@v4
         with:
-          node-version: 22.17
+          node-version: ${{ inputs.node-version || '22.17' }}
 
       - name: Cache npm
         uses: https://gitea.com/actions/cache@v4

.gitea/workflows/npm-publish.yml

@@ -1,9 +1,11 @@
 name: Publish npm Package
 
 on:
-  push:
+  workflow_call:
-    tags:
+    inputs:
-      - 'v*'
+      node-version:
+        type: string
+        default: '22.17'
 
 jobs:
   npm-publish:
@@ -15,7 +17,7 @@ jobs:
       - name: Setup Node.js
         uses: https://gitea.com/actions/setup-node@v4
         with:
-          node-version: 22.17
+          node-version: ${{ inputs.node-version || '22.17' }}
 
       - name: Cache npm
         uses: https://gitea.com/actions/cache@v4
@@ -34,7 +36,7 @@ jobs:
         run: npm ci
 
       - name: Lint
-        run: npm run lint
+        run: npm run lint:check
 
       - name: Type check
         run: npm run typecheck

.gitea/workflows/quality-gates.yml

@@ -1,17 +1,11 @@
 name: Quality Gates
 
 on:
-  push:
+  workflow_call:
-    branches:
+    inputs:
-      - main
+      node-version:
-    paths-ignore:
+        type: string
-      - '**.md'
+        default: '22.17'
-      - 'docs/**'
-      - '.vscode/**'
-      - '.idea/**'
-  pull_request:
-    branches:
-      - main
 
 jobs:
   quality-gates:
@@ -23,7 +17,7 @@ jobs:
       - name: Setup Node.js
         uses: https://gitea.com/actions/setup-node@v4
         with:
-          node-version: 22.17
+          node-version: ${{ inputs.node-version || '22.17' }}
 
       - name: Cache npm
         uses: https://gitea.com/actions/cache@v4
@@ -48,7 +42,7 @@ jobs:
         run: npm audit --audit-level=high || true
 
       - name: Lint
-        run: npm run lint
+        run: npm run lint:check
 
       - name: Type check
         run: npm run typecheck

examples/libreria-npm/ci.yml

@@ -0,0 +1,20 @@
+# Copia in: .gitea/workflows/ci.yml
+# Usato da: librerie npm pubblicate su registry @pzeta
+
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  quality-gates:
+    uses: pzeta_touch/shared-actions/.gitea/workflows/quality-gates.yml@main
+    secrets: inherit

examples/libreria-npm/maintenance.yml

@@ -0,0 +1,22 @@
+# Copia in: .gitea/workflows/maintenance.yml
+# Combina branch-cleanup (PR merge) e dependency-check (settimanale)
+
+name: Maintenance
+
+on:
+  pull_request:
+    types: [closed]
+  schedule:
+    - cron: '0 8 * * 1'
+  workflow_dispatch:
+
+jobs:
+  branch-cleanup:
+    if: gitea.event_name == 'pull_request' && gitea.event.pull_request.merged == true
+    uses: pzeta_touch/shared-actions/.gitea/workflows/branch-cleanup.yml@main
+    secrets: inherit
+
+  dependency-check:
+    if: gitea.event_name == 'schedule' || gitea.event_name == 'workflow_dispatch'
+    uses: pzeta_touch/shared-actions/.gitea/workflows/dependency-check.yml@main
+    secrets: inherit

examples/libreria-npm/release.yml

@@ -0,0 +1,21 @@
+# Copia in: .gitea/workflows/release.yml
+# Trigger: git tag v* → pubblica su npm + crea release Gitea
+#
+# NOTA: i job girano in parallelo (non sequenziali con needs).
+# Gitea bug #31900: needs + workflow_call + checkout causa errori di autenticazione.
+
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  npm-publish:
+    uses: pzeta_touch/shared-actions/.gitea/workflows/npm-publish.yml@main
+    secrets: inherit
+
+  auto-release:
+    uses: pzeta_touch/shared-actions/.gitea/workflows/auto-release.yml@main
+    secrets: inherit

examples/microservizio/ci.yml

@@ -0,0 +1,22 @@
+# Copia in: .gitea/workflows/ci.yml
+# Usato da: microservizi Node.js con deploy Docker
+
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+      - 'docs/**'
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  quality-gates:
+    uses: pzeta_touch/shared-actions/.gitea/workflows/quality-gates.yml@main
+    secrets: inherit
+    # with:
+    #   node-version: '22.17'   # opzionale, default già impostato

examples/microservizio/maintenance.yml

@@ -0,0 +1,22 @@
+# Copia in: .gitea/workflows/maintenance.yml
+# Combina branch-cleanup (PR merge) e dependency-check (settimanale)
+
+name: Maintenance
+
+on:
+  pull_request:
+    types: [closed]
+  schedule:
+    - cron: '0 8 * * 1'
+  workflow_dispatch:
+
+jobs:
+  branch-cleanup:
+    if: gitea.event_name == 'pull_request' && gitea.event.pull_request.merged == true
+    uses: pzeta_touch/shared-actions/.gitea/workflows/branch-cleanup.yml@main
+    secrets: inherit
+
+  dependency-check:
+    if: gitea.event_name == 'schedule' || gitea.event_name == 'workflow_dispatch'
+    uses: pzeta_touch/shared-actions/.gitea/workflows/dependency-check.yml@main
+    secrets: inherit

examples/microservizio/release.yml

@@ -0,0 +1,21 @@
+# Copia in: .gitea/workflows/release.yml
+# Trigger: git tag v* → build Docker + crea release Gitea
+#
+# NOTA: i job girano in parallelo (non sequenziali con needs).
+# Gitea bug #31900: needs + workflow_call + checkout causa errori di autenticazione.
+
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  docker-release:
+    uses: pzeta_touch/shared-actions/.gitea/workflows/docker-release.yml@main
+    secrets: inherit
+
+  auto-release:
+    uses: pzeta_touch/shared-actions/.gitea/workflows/auto-release.yml@main
+    secrets: inherit