✨ feat(workflows): aggiungi check pacchetti obsoleti e migliora audit sicurezza

- aggiungi workflow separato per controllo dipendenze obsolete
- aggiorna maintenance.yml per distinguere tra audit sicurezza e check obsolete
- aggiorna nomi e struttura dei job per maggiore chiarezza
- carica artifact Android con nome versione dinamico
- separa issue sicurezza da quelle di pacchetti obsoleti in CI
- migliora trigger per job di manutenzione periodica【workflows】

.gitea/workflows/capacitor-android.yml

@@ -78,6 +78,12 @@ jobs:
           echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
           echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
 
+      - name: Read app info from package.json
+        id: app-info
+        run: |
+          echo "name=$(node -e \"console.log(require('./package.json').name)\")" >> $GITHUB_OUTPUT
+          echo "version=$(node -e \"console.log(require('./package.json').version)\")" >> $GITHUB_OUTPUT
+
       - name: Install dependencies
         run: npm ci
 
@@ -112,6 +118,15 @@ jobs:
             ./gradlew assembleDebug
           fi
 
+      - name: Rename APK
+        if: inputs.output-format == 'apk'
+        run: |
+          APP="${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}"
+          APK_DIR="android/app/build/outputs/apk/${{ inputs.build-type }}"
+          mv "$APK_DIR"/app-${{ inputs.build-type }}.apk "$APK_DIR/${APP}.apk" 2>/dev/null || \
+          mv "$APK_DIR"/app-${{ inputs.build-type }}-unsigned.apk "$APK_DIR/${APP}.apk" 2>/dev/null || \
+          find "$APK_DIR" -name "*.apk" ! -name "${APP}.apk" -exec mv {} "$APK_DIR/${APP}.apk" \;
+
       - name: Build Android (AAB)
         if: inputs.output-format == 'aab'
         working-directory: android
@@ -121,20 +136,27 @@ jobs:
           KEY_PASSWORD: ${{ secrets.KEY_PASSWORD }}
         run: ./gradlew bundleRelease
 
+      - name: Rename AAB
+        if: inputs.output-format == 'aab'
+        run: |
+          APP="${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release"
+          AAB_DIR="android/app/build/outputs/bundle/release"
+          find "$AAB_DIR" -name "*.aab" ! -name "${APP}.aab" -exec mv {} "$AAB_DIR/${APP}.aab" \;
+
       - name: Upload APK artifact
         if: inputs.output-format == 'apk'
         uses: https://github.com/actions/upload-artifact@v3
         with:
-          name: android-${{ inputs.build-type || 'debug' }}-apk
+          name: ${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}-apk
-          path: android/app/build/outputs/apk/${{ inputs.build-type || 'debug' }}/*.apk
+          path: android/app/build/outputs/apk/${{ inputs.build-type }}/${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-${{ inputs.build-type }}.apk
           retention-days: 14
 
       - name: Upload AAB artifact
         if: inputs.output-format == 'aab'
         uses: https://github.com/actions/upload-artifact@v3
         with:
-          name: android-release-aab
+          name: ${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release-aab
-          path: android/app/build/outputs/bundle/release/*.aab
+          path: android/app/build/outputs/bundle/release/${{ steps.app-info.outputs.name }}-${{ steps.app-info.outputs.version }}-release.aab
           retention-days: 14
 
       - name: Upload Gradle build reports

.gitea/workflows/dependency-check.yml

@@ -1,4 +1,4 @@
-name: Dependency Check
+name: Dependency Audit
 
 on:
   workflow_call:
@@ -9,7 +9,7 @@ on:
   workflow_dispatch:
 
 jobs:
-  dependency-check:
+  dependency-audit:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -43,35 +43,26 @@ jobs:
           VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0")
           echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT
 
-      - name: Check outdated packages
+      - name: Open issue if vulnerabilities found
-        id: outdated
+        if: steps.audit.outputs.vulnerabilities != '0'
-        run: |
-          npm outdated --json > outdated.json 2>/dev/null || true
-          OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0")
-          echo "count=$OUTDATED" >> $GITHUB_OUTPUT
-
-      - name: Open issue if problems found
-        if: steps.audit.outputs.vulnerabilities != '0' || steps.outdated.outputs.count != '0'
         env:
           GITEA_TOKEN: ${{ gitea.token }}
           SERVER_URL: ${{ gitea.server_url }}
           REPOSITORY: ${{ gitea.repository }}
         run: |
           VULNS="${{ steps.audit.outputs.vulnerabilities }}"
-          OUTDATED="${{ steps.outdated.outputs.count }}"
           DATE=$(date '+%Y-%m-%d')
 
           VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")
-          OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")
 
-          printf '## Dependency Check — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n\n### Pacchetti obsoleti: %s\n\n```\n%s\n```\n' \
+          printf '## Security Audit — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n' \
-            "$DATE" "$VULNS" "$VULN_LIST" "$OUTDATED" "$OUTDATED_LIST" > /tmp/body.md
+            "$DATE" "$VULNS" "$VULN_LIST" > /tmp/body.md
 
           curl -s -X POST \
             -H "Content-Type: application/json" \
             -H "Authorization: token $GITEA_TOKEN" \
             "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
             -d "{
-              \"title\": \"[$DATE] Dipendenze: $VULNS vulnerabilità, $OUTDATED obsoleti\",
+              \"title\": \"[$DATE] Security: $VULNS vulnerabilità high/critical\",
               \"body\": $(jq -Rs . /tmp/body.md)
             }"

.gitea/workflows/dependency-outdated.yml

@@ -0,0 +1,68 @@
+name: Dependency Outdated
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '22.17'
+  workflow_dispatch:
+
+jobs:
+  dependency-outdated:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://gitea.com/actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: https://gitea.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '22.17' }}
+
+      - name: Cache npm
+        uses: https://gitea.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check outdated packages
+        id: outdated
+        run: |
+          npm outdated --json > outdated.json 2>/dev/null || true
+          OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0")
+          echo "count=$OUTDATED" >> $GITHUB_OUTPUT
+
+      - name: Open issue if packages outdated
+        if: steps.outdated.outputs.count != '0'
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+          SERVER_URL: ${{ gitea.server_url }}
+          REPOSITORY: ${{ gitea.repository }}
+        run: |
+          OUTDATED="${{ steps.outdated.outputs.count }}"
+          DATE=$(date '+%Y-%m-%d')
+
+          OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")
+
+          printf '## Dipendenze Obsolete — %s\n\n### Pacchetti da aggiornare: %s\n\n```\n%s\n```\n' \
+            "$DATE" "$OUTDATED" "$OUTDATED_LIST" > /tmp/body.md
+
+          curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
+            -d "{
+              \"title\": \"[$DATE] Dipendenze: $OUTDATED pacchetti obsoleti\",
+              \"body\": $(jq -Rs . /tmp/body.md)
+            }"

examples/capacitor/maintenance.yml

@@ -1,8 +1,9 @@
 # Copia in: .gitea/workflows/maintenance.yml
 # Trigger:
 #   - PR merged           → cleanup branch sorgente
-#   - Ogni lunedì 08:00 → controllo dipendenze vulnerabili/obsolete
+#   - Ogni lunedì 08:00   → security audit vulnerabilità (settimanale)
-#   - Manuale → workflow_dispatch
+#   - Ogni 1° del mese    → controllo pacchetti obsoleti (mensile)
+#   - Manuale             → workflow_dispatch (esegue tutti i job di manutenzione)
 
 name: Maintenance
 
@@ -10,7 +11,8 @@ on:
   pull_request:
     types: [closed]
   schedule:
-    - cron: '0 8 * * 1'
+    - cron: '0 8 * * 1'    # ogni lunedì alle 08:00 → security audit
+    - cron: '0 8 1 * *'    # ogni 1° del mese alle 08:00 → outdated check
   workflow_dispatch:
 
 jobs:
@@ -19,7 +21,16 @@ jobs:
     uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/branch-cleanup.yml@v1
     secrets: inherit
 
-  dependency-check:
+  dependency-audit:
-    if: gitea.event_name == 'schedule' || gitea.event_name == 'workflow_dispatch'
+    if: >
+      gitea.event_name == 'workflow_dispatch' ||
+      (gitea.event_name == 'schedule' && gitea.event.schedule == '0 8 * * 1')
     uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-check.yml@v1
     secrets: inherit
+
+  dependency-outdated:
+    if: >
+      gitea.event_name == 'workflow_dispatch' ||
+      (gitea.event_name == 'schedule' && gitea.event.schedule == '0 8 1 * *')
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-outdated.yml@v1
+    secrets: inherit

examples/microservizio/maintenance.yml

@@ -1,5 +1,9 @@
 # Copia in: .gitea/workflows/maintenance.yml
-# Combina branch-cleanup (PR merge) e dependency-check (settimanale)
+# Trigger:
+#   - PR merged           → cleanup branch sorgente
+#   - Ogni lunedì 08:00   → security audit vulnerabilità (settimanale)
+#   - Ogni 1° del mese    → controllo pacchetti obsoleti (mensile)
+#   - Manuale             → workflow_dispatch (esegue tutti i job di manutenzione)
 
 name: Maintenance
 
@@ -7,7 +11,8 @@ on:
   pull_request:
     types: [closed]
   schedule:
-    - cron: '0 8 * * 1'
+    - cron: '0 8 * * 1'    # ogni lunedì alle 08:00 → security audit
+    - cron: '0 8 1 * *'    # ogni 1° del mese alle 08:00 → outdated check
   workflow_dispatch:
 
 jobs:
@@ -16,7 +21,16 @@ jobs:
     uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/branch-cleanup.yml@v1
     secrets: inherit
 
-  dependency-check:
+  dependency-audit:
-    if: gitea.event_name == 'schedule' || gitea.event_name == 'workflow_dispatch'
+    if: >
+      gitea.event_name == 'workflow_dispatch' ||
+      (gitea.event_name == 'schedule' && gitea.event.schedule == '0 8 * * 1')
     uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-check.yml@v1
     secrets: inherit
+
+  dependency-outdated:
+    if: >
+      gitea.event_name == 'workflow_dispatch' ||
+      (gitea.event_name == 'schedule' && gitea.event.schedule == '0 8 1 * *')
+    uses: https://gitea.com/Punga78/shared-actions/.gitea/workflows/dependency-outdated.yml@v1
+    secrets: inherit