feat(ci): aggiungi varianti -github dei reusable e fix audit Python

- crea gemelli X-github.yml per ogni reusable con action da github.com (fallback mirror gitea.com) - python-dependency-check/outdated: audit in venv isolata (fix falsi positivi da runner ML) - python-dependency-check/outdated: deduplica issue (commento invece di nuova issue) - examples: aggiungi ci-github.yml e release-github.yml in tutte le cartelle Fixes #3 @3h
2026-07-06 19:53:01 +02:00
parent e5411d9d2d
commit f0896d775d
24 changed files with 1410 additions and 28 deletions
@@ -0,0 +1,68 @@
+name: Dependency Audit
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        type: string
+        default: '24.16.0'
+  workflow_dispatch:
+
+jobs:
+  dependency-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: https://github.com/actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version: ${{ inputs.node-version || '24.16.0' }}
+
+      - name: Cache npm
+        uses: https://github.com/actions/cache@v4
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-
+
+      - name: Configure npm private registry
+        run: |
+          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
+          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Security audit
+        id: audit
+        run: |
+          npm audit --audit-level=high --json > audit.json 2>/dev/null || true
+          VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0")
+          echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT
+
+      - name: Open issue if vulnerabilities found
+        if: steps.audit.outputs.vulnerabilities != '0'
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+          SERVER_URL: ${{ gitea.server_url }}
+          REPOSITORY: ${{ gitea.repository }}
+        run: |
+          VULNS="${{ steps.audit.outputs.vulnerabilities }}"
+          DATE=$(date '+%Y-%m-%d')
+
+          VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")
+
+          printf '## Security Audit — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n' \
+            "$DATE" "$VULNS" "$VULN_LIST" > /tmp/body.md
+
+          curl -s -X POST \
+            -H "Content-Type: application/json" \
+            -H "Authorization: token $GITEA_TOKEN" \
+            "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
+            -d "{
+              \"title\": \"[$DATE] Security: $VULNS vulnerabilità high/critical\",
+              \"body\": $(jq -Rs . /tmp/body.md)
+            }"