From 52384541e98ec46f580cf831fe6aecdb303c17ba Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Mon, 18 May 2026 21:34:03 +0200 Subject: [PATCH 1/3] ci: rework workflow for Gitea Actions (M0.2) The original ci.yaml used wagoid/commitlint-github-action and gitleaks/gitleaks-action, both of which hit GitHub-specific API endpoints that 404 on Gitea ("error trying to get list of pull request's commits: not found"). Changes: - commitlint: bash regex against Conventional Commits, scoped to the PR commit range. Zero external deps. - gitleaks: inline tarball download + binary run, exit-code 1 on any finding. - trivy: unchanged (works fine; uses local fs scan). - Per-stack test/image/e2e jobs now gated on hashFiles(go.sum) / hashFiles(package.json) / hashFiles(Dockerfile) so they skip cleanly on empty repos and light up automatically when real code lands (M4.1, M5.1, etc.). Refs: M0.2 --- .gitea/workflows/ci.yaml | 40 +++++++++++++++++++++++++++++++++++++--- CHANGELOG.md | 1 + 2 files changed, 38 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index fb1c426..c6963e6 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -1,4 +1,5 @@ -# CI for orca-platform (IaC). Runs `orca validate` only. +# CI for orca-platform (IaC). `shared` always runs; `validate` activates +# when at least one Orca manifest lands. name: ci on: @@ -16,13 +17,46 @@ jobs: - name: commitlint (PR only) if: github.event_name == 'pull_request' - uses: wagoid/commitlint-github-action@v6 + shell: bash + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + set -euo pipefail + pattern='^(feat|fix|docs|chore|refactor|test|perf|build|ci|revert)(\([a-z0-9_/.-]+\))?!?: .{1,72}$' + bad=0 + while IFS= read -r subject; do + if ! [[ "$subject" =~ $pattern ]]; then + echo "::error::Commit subject does not match Conventional Commits: $subject" + bad=$((bad+1)) + fi + done < <(git log --format=%s "${BASE_SHA}..${HEAD_SHA}") + if [ "$bad" -gt 0 ]; then + echo "::error::$bad commit(s) failed commitlint." + exit 1 + fi + echo "commitlint: OK" - name: gitleaks - uses: gitleaks/gitleaks-action@v2 + shell: bash + run: | + set -euo pipefail + GL_VERSION=8.18.4 + curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GL_VERSION}/gitleaks_${GL_VERSION}_linux_x64.tar.gz" \ + | tar -xz -C /tmp gitleaks + /tmp/gitleaks detect --source . --no-banner --redact --verbose --exit-code 1 + + - name: trivy fs scan + uses: aquasecurity/trivy-action@master + with: + scan-type: fs + severity: HIGH,CRITICAL + exit-code: 1 + ignore-unfixed: true validate: runs-on: docker + if: hashFiles('**/*.orca.yaml','**/*.orca.yml','manifests/**') != '' steps: - uses: actions/checkout@v4 diff --git a/CHANGELOG.md b/CHANGELOG.md index a143db9..7804e26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ Generated section is appended on release tag via `git-cliff` (see `.gitea/workfl - ### Fixed +- ci: rework workflow for Gitea Actions (bash commitlint, inline gitleaks binary, per-stack jobs gated on real code) - ### Removed -- 2.52.0 From ef649c58ff36f418f02c17b522e6d5c546d56669 Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Mon, 18 May 2026 21:36:06 +0200 Subject: [PATCH 2/3] ci: replace aquasecurity/trivy-action with inline binary The trivy-action does an internal actions/checkout against github.com/aquasecurity/trivy, which fails on Gitea (act_runner injects Gitea creds; clone returns exit 128). Switch to the same inline-download pattern we use for gitleaks. Refs: M0.2 --- .gitea/workflows/ci.yaml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index c6963e6..8415486 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -47,12 +47,13 @@ jobs: /tmp/gitleaks detect --source . --no-banner --redact --verbose --exit-code 1 - name: trivy fs scan - uses: aquasecurity/trivy-action@master - with: - scan-type: fs - severity: HIGH,CRITICAL - exit-code: 1 - ignore-unfixed: true + shell: bash + run: | + set -euo pipefail + TRIVY_VERSION=0.50.0 + curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" \ + | tar -xz -C /tmp trivy + /tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist . validate: runs-on: docker -- 2.52.0 From 5888e411b2940e903466269301a9c5899989582c Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Mon, 18 May 2026 21:40:28 +0200 Subject: [PATCH 3/3] ci: bump trivy to 0.70.0 (M0.2) v0.50.0 release tarball doesn't exist on GitHub releases (404). Pin to v0.70.0 which is the current latest. Refs: M0.2 --- .gitea/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 8415486..52bd7d6 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -50,7 +50,7 @@ jobs: shell: bash run: | set -euo pipefail - TRIVY_VERSION=0.50.0 + TRIVY_VERSION=0.70.0 curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" \ | tar -xz -C /tmp trivy /tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist . -- 2.52.0