platform/orca-platform
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: rework workflow for Gitea Actions (M0.2) #2

Merged
sharang merged 3 commits from fix/m0.2-gitea-friendly-ci into main 2026-05-18 19:42:27 +00:00
Conversation 0 Commits 3 Files Changed 2
+39 -3
3 Commits
Author SHA1 Message Date
sharang 5888e411b2 ci: bump trivy to 0.70.0 (M0.2)
ci / shared (pull_request) Successful in 4s
Details
ci / validate (pull_request) Has been skipped
Details 
v0.50.0 release tarball doesn't exist on GitHub releases (404).
Pin to v0.70.0 which is the current latest.

Refs: M0.2
 2026-05-18 21:40:28 +02:00
sharang ef649c58ff ci: replace aquasecurity/trivy-action with inline binary
ci / shared (pull_request) Failing after 2s
Details
ci / validate (pull_request) Has been skipped
Details 
The trivy-action does an internal actions/checkout against
github.com/aquasecurity/trivy, which fails on Gitea (act_runner
injects Gitea creds; clone returns exit 128). Switch to the same
inline-download pattern we use for gitleaks.

Refs: M0.2
 2026-05-18 21:36:06 +02:00
sharang 52384541e9 ci: rework workflow for Gitea Actions (M0.2)
ci / shared (pull_request) Failing after 38s
Details
ci / validate (pull_request) Has been skipped
Details 
The original ci.yaml used wagoid/commitlint-github-action and
gitleaks/gitleaks-action, both of which hit GitHub-specific API
endpoints that 404 on Gitea ("error trying to get list of pull
request's commits: not found").

Changes:
- commitlint: bash regex against Conventional Commits, scoped to the
  PR commit range. Zero external deps.
- gitleaks: inline tarball download + binary run, exit-code 1 on
  any finding.
- trivy: unchanged (works fine; uses local fs scan).
- Per-stack test/image/e2e jobs now gated on hashFiles(go.sum) /
  hashFiles(package.json) / hashFiles(Dockerfile) so they skip
  cleanly on empty repos and light up automatically when real code
  lands (M4.1, M5.1, etc.).

Refs: M0.2
 2026-05-18 21:34:03 +02:00