shared-actions/.gitea/workflows/dependency-check.yml

name: Dependency Audit

on:
  workflow_call:
    inputs:
      node-version:
        type: string
        default: '24.16.0'
  workflow_dispatch:

jobs:
  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: https://gitea.com/actions/checkout@v6

      - name: Setup Node.js
        uses: https://gitea.com/actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version || '24.16.0' }}

      - name: Cache npm
        uses: https://github.com/actions/cache@v4
        with:
          path: ~/.npm
          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            ${{ runner.os }}-node-

      - name: Configure npm private registry
        run: |
          echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
          echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc

      - name: Install dependencies
        run: npm ci

      - name: Security audit
        id: audit
        run: |
          npm audit --audit-level=high --json > audit.json 2>/dev/null || true
          VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0")
          echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT

      - name: Open issue if vulnerabilities found
        if: steps.audit.outputs.vulnerabilities != '0'
        env:
          GITEA_TOKEN: ${{ gitea.token }}
          SERVER_URL: ${{ gitea.server_url }}
          REPOSITORY: ${{ gitea.repository }}
        run: |
          VULNS="${{ steps.audit.outputs.vulnerabilities }}"
          DATE=$(date '+%Y-%m-%d')

          VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")

          printf '## Security Audit — %s\n\n### Vulnerabilità (high/critical): %s\n\n```\n%s\n```\n' \
            "$DATE" "$VULNS" "$VULN_LIST" > /tmp/body.md

          curl -s -X POST \
            -H "Content-Type: application/json" \
            -H "Authorization: token $GITEA_TOKEN" \
            "$SERVER_URL/api/v1/repos/$REPOSITORY/issues" \
            -d "{
              \"title\": \"[$DATE] Security: $VULNS vulnerabilità high/critical\",
              \"body\": $(jq -Rs . /tmp/body.md)
            }"