✨ feat(workflows): aggiungi check pacchetti obsoleti e migliora audit sicurezza

- aggiungi workflow separato per controllo dipendenze obsolete - aggiorna maintenance.yml per distinguere tra audit sicurezza e check obsolete - aggiorna nomi e struttura dei job per maggiore chiarezza - carica artifact Android con nome versione dinamico - separa issue sicurezza da quelle di pacchetti obsoleti in CI - migliora trigger per job di manutenzione periodica【workflows】
2026-04-07 11:59:30 +02:00
parent eac0873d9a
commit edb33df3b8
5 changed files with 136 additions and 30 deletions
@@ -78,6 +78,12 @@ jobs:
          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc

+      - name: Read app info from package.json
+        id: app-info
+        run: |
+          echo "name=$(node -e \"console.log(require('./package.json').name)\")" >> $GITHUB_OUTPUT
+          echo "version=$(node -e \"console.log(require('./package.json').version)\")" >> $GITHUB_OUTPUT
+
      - name: Install dependencies
        run: npm ci

@@ -112,6 +118,15 @@ jobs:
            ./gradlew assembleDebug
          fi

+      - name: Rename APK
+        if: inputs.output-format == 'apk'
+        run: |
+          APP="${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}"
+          APK_DIR="android/app/build/outputs/apk/${{ inputs.build-type }}"
+          mv "$APK_DIR"/app-${{ inputs.build-type }}.apk "$APK_DIR/${APP}.apk" 2>/dev/null || \
+          mv "$APK_DIR"/app-${{ inputs.build-type }}-unsigned.apk "$APK_DIR/${APP}.apk" 2>/dev/null || \
+          find "$APK_DIR" -name "*.apk" ! -name "${APP}.apk" -exec mv {} "$APK_DIR/${APP}.apk" \;
+
      - name: Build Android (AAB)
        if: inputs.output-format == 'aab'
        working-directory: android
@@ -121,20 +136,27 @@ jobs:
          KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
        run: ./gradlew bundleRelease

+      - name: Rename AAB
+        if: inputs.output-format == 'aab'
+        run: |
+          APP="${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release"
+          AAB_DIR="android/app/build/outputs/bundle/release"
+          find "$AAB_DIR" -name "*.aab" ! -name "${APP}.aab" -exec mv {} "$AAB_DIR/${APP}.aab" \;
+
      - name: Upload APK artifact
        if: inputs.output-format == 'apk'
        uses: https://github.com/actions/upload-artifact@v3
        with:
-          name: android-${{ inputs.build-type || 'debug' }}-apk
-          path: android/app/build/outputs/apk/${{ inputs.build-type || 'debug' }}/*.apk
+          name: ${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}-apk
+          path: android/app/build/outputs/apk/${{ inputs.build-type }}/${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}.apk
          retention-days: 14

      - name: Upload AAB artifact
        if: inputs.output-format == 'aab'
        uses: https://github.com/actions/upload-artifact@v3
        with:
-          name: android-release-aab
-          path: android/app/build/outputs/bundle/release/*.aab
+          name: ${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release-aab
+          path: android/app/build/outputs/bundle/release/${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release.aab
          retention-days: 14

      - name: Upload Gradle build reports
@@ -1,4 +1,4 @@
-name: Dependency Check
+name: Dependency Audit

 on:
  workflow_call:
@@ -9,7 +9,7 @@ on:
  workflow_dispatch:

 jobs:
-  dependency-check:
+  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
@@ -43,35 +43,26 @@ jobs:
          VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0")
          echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT

-      - name: Check outdated packages
-        id: outdated
-        run: |
-          npm outdated --json > outdated.json 2>/dev/null || true
-          OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0")
-          echo "count=$OUTDATED" >> $GITHUB_OUTPUT
-
-      - name: Open issue if problems found
-        if: steps.audit.outputs.vulnerabilities != '0' || steps.outdated.outputs.count != '0'
+      - name: Open issue if vulnerabilities found
+        if: steps.audit.outputs.vulnerabilities != '0'
        env:
          GITEA_TOKEN: ${{ gitea.token }}
          SERVER_URL: ${{ gitea.server_url }}
          REPOSITORY: ${{ gitea.repository }}
        run: |
          VULNS="${{ steps.audit.outputs.vulnerabilities }}"
-          OUTDATED="${{ steps.outdated.outputs.count }}"
          DATE=$(date '+%Y-%m-%d')

          VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")
-          OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")

-          printf '## Dependency Check — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n\n### Pacchetti obsoleti: %s\n\n```\n%s\n```\n' \
-            "$DATE" "$VULNS" "$VULN_LIST" "$OUTDATED" "$OUTDATED_LIST" > /tmp/body.md
+          printf '## Security Audit — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n' \
+            "$DATE" "$VULNS" "$VULN_LIST" > /tmp/body.md

          curl -s -X POST \
            -H "Content-Type: application/json" \
            -H "Authorization: token $GITEA_TOKEN" \
            "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
            -d "{
-              \"title\": \"[$DATE] Dipendenze: $VULNS vulnerabilità, $OUTDATED obsoleti\",
+              \"title\": \"[$DATE] Security: $VULNS vulnerabilità high/critical\",
              \"body\": $(jq -Rs . /tmp/body.md)
            }"
@@ -0,0 +1,68 @@
+name: Dependency Outdated
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+  workflow_dispatch:
+
+jobs:
+  dependency-outdated:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check outdated packages
+        id: outdated
+        run: |
+          npm outdated --json > outdated.json 2>/dev/null || true
+          OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0")
+          echo "count=$OUTDATED" >> $GITHUB_OUTPUT
+
+      - name: Open issue if packages outdated
+        if: steps.outdated.outputs.count != '0'
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+          SERVER_URL: ${{ gitea.server_url }}
+          REPOSITORY: ${{ gitea.repository }}
+        run: |
+          OUTDATED="${{ steps.outdated.outputs.count }}"
+          DATE=$(date '+%Y-%m-%d')
+
+          OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")
+
+          printf '## Dipendenze Obsolete — %s\n\n### Pacchetti da aggiornare: %s\n\n```\n%s\n```\n' \
+            "$DATE" "$OUTDATED" "$OUTDATED_LIST" > /tmp/body.md
+
+          curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
+            -d "{
+              \"title\": \"[$DATE] Dipendenze: $OUTDATED pacchetti obsoleti\",
+              \"body\": $(jq -Rs . /tmp/body.md)
+            }"