60 lines
2.0 KiB
YAML
60 lines
2.0 KiB
YAML
# Wiederverwendbarer CI-Check für Node-Projekte (Gitea 1.26+: workflow_call aus privaten Repos).
|
|
# Aufruf im Projekt (.gitea/workflows/ci.yml):
|
|
# jobs:
|
|
# ci:
|
|
# uses: roland/ci-templates/.gitea/workflows/node-check.yml@main
|
|
# with:
|
|
# check-command: "npm run typecheck && npm test" # was lokal auch läuft
|
|
# node-version: "22"
|
|
# secrets:
|
|
# KUMA_PUSH_TOKEN: ${{ secrets.KUMA_PUSH_TOKEN }}
|
|
# Blockend: der Check, npm audit (critical), gitleaks über die Historie. Ergebnis geht an Uptime Kuma.
|
|
name: node-check
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
check-command:
|
|
type: string
|
|
default: "npm run check"
|
|
node-version:
|
|
type: string
|
|
default: "22"
|
|
secrets:
|
|
KUMA_PUSH_TOKEN:
|
|
required: true
|
|
|
|
jobs:
|
|
pruefen:
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
NEXT_TELEMETRY_DISABLED: "1"
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
fetch-depth: 0 # gitleaks prüft die ganze Historie
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: ${{ inputs.node-version }}
|
|
cache: npm
|
|
|
|
- run: npm ci
|
|
|
|
- name: Check (wie lokal)
|
|
run: ${{ inputs.check-command }}
|
|
|
|
- run: npm audit --audit-level=critical
|
|
- run: npm audit --audit-level=high || echo "::warning::Hohe Audit-Funde, siehe Log"
|
|
|
|
- name: Secrets in der Historie (gitleaks)
|
|
run: |
|
|
curl -fsSL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar xz gitleaks
|
|
./gitleaks git --no-banner --redact --exit-code 1 .
|
|
|
|
- name: Ergebnis an Uptime Kuma melden
|
|
if: always()
|
|
run: >-
|
|
curl -fsS "https://uptime.rolandhentschel.de/api/push/${{ secrets.KUMA_PUSH_TOKEN }}?status=${{ job.status == 'success' && 'up' || 'down' }}&msg=${{ job.status }}%20%23${{ github.run_number }}"
|
|
> /dev/null
|