devops/shared-actions
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ci): aggiungi varianti -github dei reusable e fix audit Python

Browse Source 
- crea gemelli X-github.yml per ogni reusable con action da github.com (fallback mirror gitea.com)
- python-dependency-check/outdated: audit in venv isolata (fix falsi positivi da runner ML)
- python-dependency-check/outdated: deduplica issue (commento invece di nuova issue)
- examples: aggiungi ci-github.yml e release-github.yml in tutte le cartelle

Fixes #3 @3h
This commit is contained in:
LucaZanni
2026-07-06 19:53:01 +02:00
parent e5411d9d2d
commit f0896d775d
24 changed files with 1410 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/python-dependency-check.yml
+33 -14
View File
@@ -38,21 +38,24 @@ jobs:
${{ runner.os }}-pip-${{ inputs.python-version }}-
${{ runner.os }}-pip-
- name: Install dependencies
- name: Install dependencies (isolated venv)
run: |
python -m pip install --upgrade pip pip-audit
# venv pulita: audita SOLO le dipendenze dichiarate dal repo,
# non l'ambiente globale del runner (che su runner ML/GPU è contaminato)
python -m venv .audit-venv
.audit-venv/bin/pip install --upgrade pip pip-audit
if [ -n "${{ inputs.install-extras }}" ]; then
pip install -e ".[${{ inputs.install-extras }}]"
.audit-venv/bin/pip install -e ".[${{ inputs.install-extras }}]"
elif [ -f requirements.txt ]; then
pip install -r requirements.txt
.audit-venv/bin/pip install -r requirements.txt
else
pip install -e "."
.audit-venv/bin/pip install -e "."
fi
- name: Security audit (pip-audit)
id: audit
run: |
pip-audit --format=json --output=audit.json 2>/dev/null || true
.audit-venv/bin/pip-audit --format=json --output=audit.json 2>/dev/null || true
VULNS=$(python3 -c "
import json, sys
try:
@@ -65,7 +68,7 @@ jobs:
")
echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT
- name: Open issue if vulnerabilities found
- name: Open or update issue if vulnerabilities found
if: steps.audit.outputs.vulnerabilities != '0'
env:
GITEA_TOKEN: ${{ gitea.token }}
@@ -74,6 +77,7 @@ jobs:
run: |
VULNS="${{ steps.audit.outputs.vulnerabilities }}"
DATE=$(date '+%Y-%m-%d')
TITLE_PREFIX="Security Python:"
VULN_LIST=$(python3 -c "
import json
@@ -91,11 +95,26 @@ jobs:
printf '## Security Audit Python — %s\n\n### Vulnerabilità trovate: %s\n\n```\n%s\n```\n' \
"$DATE" "$VULNS" "$VULN_LIST" > /tmp/body.md
curl -s -X POST \
-H "Content-Type: application/json" \
# Deduplica: se esiste già una issue aperta con lo stesso prefisso,
# aggiungi un commento invece di aprirne una nuova
EXISTING=$(curl -s \
-H "Authorization: token $GITEA_TOKEN" \
"$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
-d "{
\"title\": \"[$DATE] Security Python: $VULNS vulnerabilità rilevate\",
\"body\": $(jq -Rs . /tmp/body.md)
}"
"$SERVER_URL/api/v1/repos/$REPOSITORY/issues?state=open&type=issues&limit=50" \
| jq -r --arg p "$TITLE_PREFIX" '[.[] | select(.title | contains($p))] | (first // {}) | .number // empty')
if [ -n "$EXISTING" ]; then
curl -s -X POST \
-H "Content-Type: application/json" \
-H "Authorization: token $GITEA_TOKEN" \
"$SERVER_URL/api/v1/repos/$REPOSITORY/issues/$EXISTING/comments" \
-d "{ \"body\": $(jq -Rs . /tmp/body.md) }"
else
curl -s -X POST \
-H "Content-Type: application/json" \
-H "Authorization: token $GITEA_TOKEN" \
"$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
-d "{
\"title\": \"[$DATE] Security Python: $VULNS vulnerabilità rilevate\",
\"body\": $(jq -Rs . /tmp/body.md)
}"
fi