From edb33df3b803a07ba812a8b3801d178bd7ebb2d8 Mon Sep 17 00:00:00 2001 From: LucaZanni Date: Tue, 7 Apr 2026 11:59:30 +0200 Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20feat(workflows):=20aggiungi=20check?= =?UTF-8?q?=20pacchetti=20obsoleti=20e=20migliora=20audit=20sicurezza?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - aggiungi workflow separato per controllo dipendenze obsolete - aggiorna maintenance.yml per distinguere tra audit sicurezza e check obsolete - aggiorna nomi e struttura dei job per maggiore chiarezza - carica artifact Android con nome versione dinamico - separa issue sicurezza da quelle di pacchetti obsoleti in CI - migliora trigger per job di manutenzione periodica【workflows】 --- .gitea/workflows/capacitor-android.yml | 30 +++++++++-- .gitea/workflows/dependency-check.yml | 23 +++----- .gitea/workflows/dependency-outdated.yml | 68 ++++++++++++++++++++++++ examples/capacitor/maintenance.yml | 23 +++++--- examples/microservizio/maintenance.yml | 22 ++++++-- 5 files changed, 136 insertions(+), 30 deletions(-) create mode 100644 .gitea/workflows/dependency-outdated.yml diff --git a/.gitea/workflows/capacitor-android.yml b/.gitea/workflows/capacitor-android.yml index b6effd9..445ddc6 100644 --- a/.gitea/workflows/capacitor-android.yml +++ b/.gitea/workflows/capacitor-android.yml @@ -78,6 +78,12 @@ jobs: echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc + - name: Read app info from package.json + id: app-info + run: | + echo "name=$(node -e \"console.log(require('./package.json').name)\")" >> $GITHUB_OUTPUT + echo "version=$(node -e \"console.log(require('./package.json').version)\")" >> $GITHUB_OUTPUT + - name: Install dependencies run: npm ci @@ -112,6 +118,15 @@ jobs: ./gradlew assembleDebug fi + - name: Rename APK + if: inputs.output-format == 'apk' + run: | + APP="${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}" + APK_DIR="android/app/build/outputs/apk/${{ inputs.build-type }}" + mv "$APK_DIR"/app-${{ inputs.build-type }}.apk "$APK_DIR/${APP}.apk" 2>/dev/null || \ + mv "$APK_DIR"/app-${{ inputs.build-type }}-unsigned.apk "$APK_DIR/${APP}.apk" 2>/dev/null || \ + find "$APK_DIR" -name "*.apk" ! -name "${APP}.apk" -exec mv {} "$APK_DIR/${APP}.apk" \; + - name: Build Android (AAB) if: inputs.output-format == 'aab' working-directory: android @@ -121,20 +136,27 @@ jobs: KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }} run: ./gradlew bundleRelease + - name: Rename AAB + if: inputs.output-format == 'aab' + run: | + APP="${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release" + AAB_DIR="android/app/build/outputs/bundle/release" + find "$AAB_DIR" -name "*.aab" ! -name "${APP}.aab" -exec mv {} "$AAB_DIR/${APP}.aab" \; + - name: Upload APK artifact if: inputs.output-format == 'apk' uses: https://github.com/actions/upload-artifact@v3 with: - name: android-${{ inputs.build-type || 'debug' }}-apk - path: android/app/build/outputs/apk/${{ inputs.build-type || 'debug' }}/*.apk + name: ${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}-apk + path: android/app/build/outputs/apk/${{ inputs.build-type }}/${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}.apk retention-days: 14 - name: Upload AAB artifact if: inputs.output-format == 'aab' uses: https://github.com/actions/upload-artifact@v3 with: - name: android-release-aab - path: android/app/build/outputs/bundle/release/*.aab + name: ${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release-aab + path: android/app/build/outputs/bundle/release/${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release.aab retention-days: 14 - name: Upload Gradle build reports diff --git a/.gitea/workflows/dependency-check.yml b/.gitea/workflows/dependency-check.yml index cc297c1..f167ee5 100644 --- a/.gitea/workflows/dependency-check.yml +++ b/.gitea/workflows/dependency-check.yml @@ -1,4 +1,4 @@ -name: Dependency Check +name: Dependency Audit on: workflow_call: @@ -9,7 +9,7 @@ on: workflow_dispatch: jobs: - dependency-check: + dependency-audit: runs-on: ubuntu-latest steps: - name: Checkout @@ -43,35 +43,26 @@ jobs: VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0") echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT - - name: Check outdated packages - id: outdated - run: | - npm outdated --json > outdated.json 2>/dev/null || true - OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0") - echo "count=$OUTDATED" >> $GITHUB_OUTPUT - - - name: Open issue if problems found - if: steps.audit.outputs.vulnerabilities != '0' || steps.outdated.outputs.count != '0' + - name: Open issue if vulnerabilities found + if: steps.audit.outputs.vulnerabilities != '0' env: GITEA_TOKEN: ${{ gitea.token }} SERVER_URL: ${{ gitea.server_url }} REPOSITORY: ${{ gitea.repository }} run: | VULNS="${{ steps.audit.outputs.vulnerabilities }}" - OUTDATED="${{ steps.outdated.outputs.count }}" DATE=$(date '+%Y-%m-%d') VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A") - OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A") - printf '## Dependency Check — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n\n### Pacchetti obsoleti: %s\n\n```\n%s\n```\n' \ - "$DATE" "$VULNS" "$VULN_LIST" "$OUTDATED" "$OUTDATED_LIST" > /tmp/body.md + printf '## Security Audit — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n' \ + "$DATE" "$VULNS" "$VULN_LIST" > /tmp/body.md curl -s -X POST \ -H "Content-Type: application/json" \ -H "Authorization: token $GITEA_TOKEN" \ "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \ -d "{ - \"title\": \"[$DATE] Dipendenze: $VULNS vulnerabilità, $OUTDATED obsoleti\", + \"title\": \"[$DATE] Security: $VULNS vulnerabilità high/critical\", \"body\": $(jq -Rs . /tmp/body.md) }" diff --git a/.gitea/workflows/dependency-outdated.yml b/.gitea/workflows/dependency-outdated.yml new file mode 100644 index 0000000..ea0cb27 --- /dev/null +++ b/.gitea/workflows/dependency-outdated.yml @@ -0,0 +1,68 @@ +name: Dependency Outdated + +on: + workflow_call: + inputs: + node-version: + type: string + default: '22.17' + workflow_dispatch: + +jobs: + dependency-outdated: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: https://gitea.com/actions/checkout@v4 + + - name: Setup Node.js + uses: https://gitea.com/actions/setup-node@v4 + with: + node-version: ${{ inputs.node-version || '22.17' }} + + - name: Cache npm + uses: https://gitea.com/actions/cache@v4 + with: + path: ~/.npm + key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }} + restore-keys: | + ${{ runner.os }}-node- + + - name: Configure npm private registry + run: | + echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc + echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc + + - name: Install dependencies + run: npm ci + + - name: Check outdated packages + id: outdated + run: | + npm outdated --json > outdated.json 2>/dev/null || true + OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0") + echo "count=$OUTDATED" >> $GITHUB_OUTPUT + + - name: Open issue if packages outdated + if: steps.outdated.outputs.count != '0' + env: + GITEA_TOKEN: ${{ gitea.token }} + SERVER_URL: ${{ gitea.server_url }} + REPOSITORY: ${{ gitea.repository }} + run: | + OUTDATED="${{ steps.outdated.outputs.count }}" + DATE=$(date '+%Y-%m-%d') + + OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A") + + printf '## Dipendenze Obsolete — %s\n\n### Pacchetti da aggiornare: %s\n\n```\n%s\n```\n' \ + "$DATE" "$OUTDATED" "$OUTDATED_LIST" > /tmp/body.md + + curl -s -X POST \ + -H "Content-Type: application/json" \ + -H "Authorization: token $GITEA_TOKEN" \ + "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \ + -d "{ + \"title\": \"[$DATE] Dipendenze: $OUTDATED pacchetti obsoleti\", + \"body\": $(jq -Rs . /tmp/body.md) + }" diff --git a/examples/capacitor/maintenance.yml b/examples/capacitor/maintenance.yml index 3e8fb31..e5d03f3 100644 --- a/examples/capacitor/maintenance.yml +++ b/examples/capacitor/maintenance.yml @@ -1,8 +1,9 @@ # Copia in: .gitea/workflows/maintenance.yml # Trigger: -# - PR merged → cleanup branch sorgente -# - Ogni lunedì 08:00 → controllo dipendenze vulnerabili/obsolete -# - Manuale → workflow_dispatch +# - PR merged → cleanup branch sorgente +# - Ogni lunedì 08:00 → security audit vulnerabilità (settimanale) +# - Ogni 1° del mese → controllo pacchetti obsoleti (mensile) +# - Manuale → workflow_dispatch (esegue tutti i job di manutenzione) name: Maintenance @@ -10,7 +11,8 @@ on: pull_request: types: [closed] schedule: - - cron: '0 8 * * 1' + - cron: '0 8 * * 1' # ogni lunedì alle 08:00 → security audit + - cron: '0 8 1 * *' # ogni 1° del mese alle 08:00 → outdated check workflow_dispatch: jobs: @@ -19,7 +21,16 @@ jobs: uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/branch-cleanup.yml@v1 secrets: inherit - dependency-check: - if: gitea.event_name == 'schedule' || gitea.event_name == 'workflow_dispatch' + dependency-audit: + if: > + gitea.event_name == 'workflow_dispatch' || + (gitea.event_name == 'schedule' && gitea.event.schedule == '0 8 * * 1') uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-check.yml@v1 secrets: inherit + + dependency-outdated: + if: > + gitea.event_name == 'workflow_dispatch' || + (gitea.event_name == 'schedule' && gitea.event.schedule == '0 8 1 * *') + uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-outdated.yml@v1 + secrets: inherit diff --git a/examples/microservizio/maintenance.yml b/examples/microservizio/maintenance.yml index efc87b5..e5d03f3 100644 --- a/examples/microservizio/maintenance.yml +++ b/examples/microservizio/maintenance.yml @@ -1,5 +1,9 @@ # Copia in: .gitea/workflows/maintenance.yml -# Combina branch-cleanup (PR merge) e dependency-check (settimanale) +# Trigger: +# - PR merged → cleanup branch sorgente +# - Ogni lunedì 08:00 → security audit vulnerabilità (settimanale) +# - Ogni 1° del mese → controllo pacchetti obsoleti (mensile) +# - Manuale → workflow_dispatch (esegue tutti i job di manutenzione) name: Maintenance @@ -7,7 +11,8 @@ on: pull_request: types: [closed] schedule: - - cron: '0 8 * * 1' + - cron: '0 8 * * 1' # ogni lunedì alle 08:00 → security audit + - cron: '0 8 1 * *' # ogni 1° del mese alle 08:00 → outdated check workflow_dispatch: jobs: @@ -16,7 +21,16 @@ jobs: uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/branch-cleanup.yml@v1 secrets: inherit - dependency-check: - if: gitea.event_name == 'schedule' || gitea.event_name == 'workflow_dispatch' + dependency-audit: + if: > + gitea.event_name == 'workflow_dispatch' || + (gitea.event_name == 'schedule' && gitea.event.schedule == '0 8 * * 1') uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-check.yml@v1 secrets: inherit + + dependency-outdated: + if: > + gitea.event_name == 'workflow_dispatch' || + (gitea.event_name == 'schedule' && gitea.event.schedule == '0 8 1 * *') + uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-outdated.yml@v1 + secrets: inherit