# Wiederverwendbarer CI-Check für Node-Projekte (Gitea 1.26+: workflow_call aus privaten Repos).
# Aufruf im Projekt (.gitea/workflows/ci.yml):
#   jobs:
#     ci:
#       uses: roland/ci-templates/.gitea/workflows/node-check.yml@main
#       with:
#         check-command: "npm run typecheck && npm test"   # was lokal auch läuft
#         node-version: "22"
#       secrets:
#         KUMA_PUSH_TOKEN: ${{ secrets.KUMA_PUSH_TOKEN }}
# Blockend: der Check, npm audit (critical), gitleaks über die Historie. Ergebnis geht an Uptime Kuma.
name: node-check

on:
  workflow_call:
    inputs:
      check-command:
        type: string
        default: "npm run check"
      node-version:
        type: string
        default: "22"
    secrets:
      KUMA_PUSH_TOKEN:
        required: true

jobs:
  pruefen:
    runs-on: ubuntu-latest
    env:
      NEXT_TELEMETRY_DISABLED: "1"
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0 # gitleaks prüft die ganze Historie

      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: ${{ inputs.node-version }}
          cache: npm

      - run: npm ci

      - name: Check (wie lokal)
        run: ${{ inputs.check-command }}

      - run: npm audit --audit-level=critical
      - run: npm audit --audit-level=high || echo "::warning::Hohe Audit-Funde, siehe Log"

      - name: Secrets in der Historie (gitleaks)
        run: |
          curl -fsSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar xz gitleaks
          ./gitleaks git --no-banner --redact --exit-code 1 .

      - name: Ergebnis an Uptime Kuma melden
        if: always()
        run: >-
          curl -fsS "https://uptime.rolandhentschel.de/api/push/${{ secrets.KUMA_PUSH_TOKEN }}?status=${{ job.status == 'success' && 'up' || 'down' }}&msg=${{ job.status }}%20%23${{ github.run_number }}"
          > /dev/null