LucaZanni
8b292ae35d
- Aggiunti 6 workflow condivisi in .gitea/workflows/ con trigger workflow_call - Implementati: quality-gates, npm-publish, docker-release, auto-release, dependency-check, branch-cleanup - Aggiunti esempi consumer per microservizio e libreria-npm (ci, release, maintenance) - Allineato npm run lint:check su tutti i workflow - Corretti GITEA_TOKEN, gitea.* context, GITHUB_REF/GITHUB_OUTPUT per compatibilità Gitea - Rimosso needs: tra job reusable (Gitea bug #31900), path uses: con .gitea/workflows/ Fixes #1 @1d
87 lines
2.8 KiB
YAML
87 lines
2.8 KiB
YAML
name: Dependency Check
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
node-version:
|
|
type: string
|
|
default: '22.17'
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
dependency-check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://gitea.com/actions/checkout@v4
|
|
|
|
- name: Setup Node.js
|
|
uses: https://gitea.com/actions/setup-node@v4
|
|
with:
|
|
node-version: ${{ inputs.node-version || '22.17' }}
|
|
|
|
- name: Cache npm
|
|
uses: https://gitea.com/actions/cache@v4
|
|
with:
|
|
path: ~/.npm
|
|
key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
|
|
restore-keys: |
|
|
${{ runner.os }}-node-
|
|
|
|
- name: Configure npm private registry
|
|
run: |
|
|
echo "@pzeta:registry=https://gitea.pzetatouch.it/api/packages/pzeta_touch/npm/" >> ~/.npmrc
|
|
echo "//gitea.pzetatouch.it/api/packages/pzeta_touch/npm/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Security audit
|
|
id: audit
|
|
run: |
|
|
npm audit --audit-level=high --json > audit.json 2>/dev/null || true
|
|
VULNS=$(jq '(.metadata.vulnerabilities.high // 0) + (.metadata.vulnerabilities.critical // 0)' audit.json 2>/dev/null || echo "0")
|
|
echo "vulnerabilities=$VULNS" >> $GITHUB_OUTPUT
|
|
|
|
- name: Check outdated packages
|
|
id: outdated
|
|
run: |
|
|
npm outdated --json > outdated.json 2>/dev/null || true
|
|
OUTDATED=$(jq 'keys | length' outdated.json 2>/dev/null || echo "0")
|
|
echo "count=$OUTDATED" >> $GITHUB_OUTPUT
|
|
|
|
- name: Open issue if problems found
|
|
if: steps.audit.outputs.vulnerabilities != '0' || steps.outdated.outputs.count != '0'
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
VULNS="${{ steps.audit.outputs.vulnerabilities }}"
|
|
OUTDATED="${{ steps.outdated.outputs.count }}"
|
|
DATE=$(date '+%Y-%m-%d')
|
|
|
|
VULN_LIST=$(jq -r '.vulnerabilities | to_entries[] | "- \(.key): \(.value.severity)"' audit.json 2>/dev/null | head -20 || echo "N/A")
|
|
OUTDATED_LIST=$(jq -r 'to_entries[] | "- \(.key): \(.value.current) → \(.value.latest)"' outdated.json 2>/dev/null | head -20 || echo "N/A")
|
|
|
|
BODY="## Dependency Check — $DATE
|
|
|
|
### Vulnerabilità (high/critical): $VULNS
|
|
|
|
\`\`\`
|
|
$VULN_LIST
|
|
\`\`\`
|
|
|
|
### Pacchetti obsoleti: $OUTDATED
|
|
|
|
\`\`\`
|
|
$OUTDATED_LIST
|
|
\`\`\`"
|
|
|
|
curl -s -X POST \
|
|
-H "Content-Type: application/json" \
|
|
-H "Authorization: token $GITEA_TOKEN" \
|
|
"https://gitea.pzetatouch.it/api/v1/repos/${{ gitea.repository }}/issues" \
|
|
-d "{
|
|
\"title\": \"[$DATE] Dipendenze: $VULNS vulnerabilità, $OUTDATED obsoleti\",
|
|
\"body\": $(echo "$BODY" | jq -Rs .)
|
|
}"
|