feat: node-check als wiederverwendbarer Workflow

2026-08-28 12:14:13 +03:00
commit 4c771f6287
2 changed files with 68 additions and 0 deletions
@@ -0,0 +1,59 @@
+# Wiederverwendbarer CI-Check für Node-Projekte (Gitea 1.26+: workflow_call aus privaten Repos).
+# Aufruf im Projekt (.gitea/workflows/ci.yml):
+#   jobs:
+#     ci:
+#       uses: roland/ci-templates/.gitea/workflows/node-check.yml@main
+#       with:
+#         check-command: "npm run typecheck && npm test"   # was lokal auch läuft
+#         node-version: "22"
+#       secrets:
+#         KUMA_PUSH_TOKEN: ${{ secrets.KUMA_PUSH_TOKEN }}
+# Blockend: der Check, npm audit (critical), gitleaks über die Historie. Ergebnis geht an Uptime Kuma.
+name: node-check
+
+on:
+  workflow_call:
+    inputs:
+      check-command:
+        type: string
+        default: "npm run check"
+      node-version:
+        type: string
+        default: "22"
+    secrets:
+      KUMA_PUSH_TOKEN:
+        required: true
+
+jobs:
+  pruefen:
+    runs-on: ubuntu-latest
+    env:
+      NEXT_TELEMETRY_DISABLED: "1"
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0 # gitleaks prüft die ganze Historie
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: ${{ inputs.node-version }}
+          cache: npm
+
+      - run: npm ci
+
+      - name: Check (wie lokal)
+        run: ${{ inputs.check-command }}
+
+      - run: npm audit --audit-level=critical
+      - run: npm audit --audit-level=high || echo "::warning::Hohe Audit-Funde, siehe Log"
+
+      - name: Secrets in der Historie (gitleaks)
+        run: |
+          curl -fsSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar xz gitleaks
+          ./gitleaks git --no-banner --redact --exit-code 1 .
+
+      - name: Ergebnis an Uptime Kuma melden
+        if: always()
+        run: >-
+          curl -fsS "https://uptime.rolandhentschel.de/api/push/${{ secrets.KUMA_PUSH_TOKEN }}?status=${{ job.status == 'success' && 'up' || 'down' }}&msg=${{ job.status }}%20%23${{ github.run_number }}"
+          > /dev/null