From f1305498c19672eda0d385cb275d533c91b18ad7 Mon Sep 17 00:00:00 2001
From: LucaZanni <info@pzeta.it>
Date: Thu, 26 Mar 2026 07:01:34 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20fix(ci):=20correggi=20URL=20ista?=
 =?UTF-8?q?nza,=20token=20e=20struttura=20YAML=20nei=20workflow=20condivis?=
 =?UTF-8?q?i?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Sostituito URL hardcoded con ${{ gitea.server_url }} (portabilità)
- Sostituito ${{ secrets.GITEA_TOKEN }} con ${{ gitea.token }} (token automatico)
- Aggiunto env SERVER_URL/REPOSITORY per evitare espressioni inline nei curl
- Fix dependency-check: rimosso BODY multi-riga (bug YAML run:|) → printf + /tmp/body.md
- Fix auto-release: changelog su /tmp/changelog.txt (evita collisione workspace)
- Fix branch-cleanup: encoding branch via variabile (sicurezza shell)
---
 .gitea/workflows/auto-release.yml     | 10 ++++++----
 .gitea/workflows/branch-cleanup.yml   |  8 ++++++--
 .gitea/workflows/dependency-check.yml | 23 +++++++----------------
 3 files changed, 19 insertions(+), 22 deletions(-)

diff --git a/.gitea/workflows/auto-release.yml b/.gitea/workflows/auto-release.yml
index 4a4341d..a5af9b3 100644
--- a/.gitea/workflows/auto-release.yml
+++ b/.gitea/workflows/auto-release.yml
@@ -24,21 +24,23 @@ jobs:
             CHANGELOG=$(git log --pretty=format:"- %s (%h)" "${PREV_TAG}..${CURRENT_TAG}")
           fi
 
-          echo "$CHANGELOG" > changelog.txt
+          echo "$CHANGELOG" > /tmp/changelog.txt
           echo "current_tag=$CURRENT_TAG" >> $GITHUB_OUTPUT
 
       - name: Create release
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ gitea.token }}
+          SERVER_URL: ${{ gitea.server_url }}
+          REPOSITORY: ${{ gitea.repository }}
         run: |
           CURRENT_TAG=${{ steps.changelog.outputs.current_tag }}
           APP_NAME=$(jq -r '.name' package.json)
-          CHANGELOG=$(cat changelog.txt)
+          CHANGELOG=$(cat /tmp/changelog.txt)
 
           curl -s -X POST \
             -H "Content-Type: application/json" \
             -H "Authorization: token $GITEA_TOKEN" \
-            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/releases" \
+            "$SERVER_URL/api/v1/repos/$REPOSITORY/releases" \
             -d "{
               \"tag_name\": \"$CURRENT_TAG\",
               \"name\": \"$APP_NAME $CURRENT_TAG\",
diff --git a/.gitea/workflows/branch-cleanup.yml b/.gitea/workflows/branch-cleanup.yml
index f388ab9..4411d46 100644
--- a/.gitea/workflows/branch-cleanup.yml
+++ b/.gitea/workflows/branch-cleanup.yml
@@ -10,7 +10,9 @@ jobs:
     steps:
       - name: Delete merged branch
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ gitea.token }}
+          SERVER_URL: ${{ gitea.server_url }}
+          REPOSITORY: ${{ gitea.repository }}
         run: |
           BRANCH="${{ gitea.event.pull_request.head.ref }}"
 
@@ -19,8 +21,10 @@ jobs:
             exit 0
           fi
 
+          ENCODED_BRANCH=$(python3 -c "import urllib.parse, sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$BRANCH")
+
           curl -s -X DELETE \
             -H "Authorization: token $GITEA_TOKEN" \
-            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/branches/$(python3 -c "import urllib.parse; print(urllib.parse.quote('$BRANCH', safe=''))")"
+            "$SERVER_URL/api/v1/repos/$REPOSITORY/branches/$ENCODED_BRANCH"
 
           echo "Branch eliminato: $BRANCH"
diff --git a/.gitea/workflows/dependency-check.yml b/.gitea/workflows/dependency-check.yml
index 2ca4aa4..cc297c1 100644
--- a/.gitea/workflows/dependency-check.yml
+++ b/.gitea/workflows/dependency-check.yml
@@ -53,7 +53,9 @@ jobs:
       - name: Open issue if problems found
         if: steps.audit.outputs.vulnerabilities != '0' || steps.outdated.outputs.count != '0'
         env:
-          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          GITEA_TOKEN: ${{ gitea.token }}
+          SERVER_URL: ${{ gitea.server_url }}
+          REPOSITORY: ${{ gitea.repository }}
         run: |
           VULNS="${{ steps.audit.outputs.vulnerabilities }}"
           OUTDATED="${{ steps.outdated.outputs.count }}"
@@ -62,25 +64,14 @@ jobs:
           VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")
           OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")
 
-          BODY="## Dependency Check — $DATE
-
-### Vulnerabilità (high/critical): $VULNS
-
-\`\`\`
-$VULN_LIST
-\`\`\`
-
-### Pacchetti obsoleti: $OUTDATED
-
-\`\`\`
-$OUTDATED_LIST
-\`\`\`"
+          printf '## Dependency Check — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n\n### Pacchetti obsoleti: %s\n\n```\n%s\n```\n' \
+            "$DATE" "$VULNS" "$VULN_LIST" "$OUTDATED" "$OUTDATED_LIST" > /tmp/body.md
 
           curl -s -X POST \
             -H "Content-Type: application/json" \
             -H "Authorization: token $GITEA_TOKEN" \
-            "https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/issues" \
+            "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
             -d "{
               \"title\": \"[$DATE] Dipendenze: $VULNS vulnerabilità, $OUTDATED obsoleti\",
-              \"body\": $(echo "$BODY" | jq -Rs .)
+              \"body\": $(jq -Rs . /tmp/body.md)
             }"