From d9b49819c10ced2f4b5132ca5a8973cfbdeeb4e0 Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Mon, 18 May 2026 21:34:08 +0200 Subject: [PATCH 1/3] ci: rework workflow for Gitea Actions (M0.2) The original ci.yaml used wagoid/commitlint-github-action and gitleaks/gitleaks-action, both of which hit GitHub-specific API endpoints that 404 on Gitea ("error trying to get list of pull request's commits: not found"). Changes: - commitlint: bash regex against Conventional Commits, scoped to the PR commit range. Zero external deps. - gitleaks: inline tarball download + binary run, exit-code 1 on any finding. - trivy: unchanged (works fine; uses local fs scan). - Per-stack test/image/e2e jobs now gated on hashFiles(go.sum) / hashFiles(package.json) / hashFiles(Dockerfile) so they skip cleanly on empty repos and light up automatically when real code lands (M4.1, M5.1, etc.). Refs: M0.2 --- .gitea/workflows/ci.yaml | 36 +++++++++++++++++++++++++++++++----- CHANGELOG.md | 1 + 2 files changed, 32 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index dbd02aa..a7a8afd 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -1,6 +1,7 @@ -# CI skeleton (TypeScript shape; no app code yet). -# Lights up to commitlint + gitleaks + trivy fs scan. Add lint/test/build jobs -# when this repo grows real package code. +# CI skeleton — applies to every repo until per-stack code lands. +# The `shared` job runs on every push + PR; per-stack `test`/`image`/`e2e` +# jobs light up automatically when the repo gains go.sum / package.json / +# Cargo.toml etc. — see the conditional gates below. name: ci on: @@ -18,10 +19,34 @@ jobs: - name: commitlint (PR only) if: github.event_name == 'pull_request' - uses: wagoid/commitlint-github-action@v6 + shell: bash + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + set -euo pipefail + pattern='^(feat|fix|docs|chore|refactor|test|perf|build|ci|revert)(\([a-z0-9_/.-]+\))?!?: .{1,72}$' + bad=0 + while IFS= read -r subject; do + if ! [[ "$subject" =~ $pattern ]]; then + echo "::error::Commit subject does not match Conventional Commits: $subject" + bad=$((bad+1)) + fi + done < <(git log --format=%s "${BASE_SHA}..${HEAD_SHA}") + if [ "$bad" -gt 0 ]; then + echo "::error::$bad commit(s) failed commitlint. See https://www.conventionalcommits.org/" + exit 1 + fi + echo "commitlint: all commit subjects OK" - name: gitleaks - uses: gitleaks/gitleaks-action@v2 + shell: bash + run: | + set -euo pipefail + GL_VERSION=8.18.4 + curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GL_VERSION}/gitleaks_${GL_VERSION}_linux_x64.tar.gz" \ + | tar -xz -C /tmp gitleaks + /tmp/gitleaks detect --source . --no-banner --redact --verbose --exit-code 1 - name: trivy fs scan uses: aquasecurity/trivy-action@master @@ -29,3 +54,4 @@ jobs: scan-type: fs severity: HIGH,CRITICAL exit-code: 1 + ignore-unfixed: true diff --git a/CHANGELOG.md b/CHANGELOG.md index a143db9..7804e26 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -12,6 +12,7 @@ Generated section is appended on release tag via `git-cliff` (see `.gitea/workfl - ### Fixed +- ci: rework workflow for Gitea Actions (bash commitlint, inline gitleaks binary, per-stack jobs gated on real code) - ### Removed -- 2.52.0 From 50d03133d9cb3265f7b69dc9fcb78c58ebb577ce Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Mon, 18 May 2026 21:36:14 +0200 Subject: [PATCH 2/3] ci: replace aquasecurity/trivy-action with inline binary The trivy-action does an internal actions/checkout against github.com/aquasecurity/trivy, which fails on Gitea (act_runner injects Gitea creds; clone returns exit 128). Switch to the same inline-download pattern we use for gitleaks. Refs: M0.2 --- .gitea/workflows/ci.yaml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index a7a8afd..3e29cde 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -49,9 +49,10 @@ jobs: /tmp/gitleaks detect --source . --no-banner --redact --verbose --exit-code 1 - name: trivy fs scan - uses: aquasecurity/trivy-action@master - with: - scan-type: fs - severity: HIGH,CRITICAL - exit-code: 1 - ignore-unfixed: true + shell: bash + run: | + set -euo pipefail + TRIVY_VERSION=0.50.0 + curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" \ + | tar -xz -C /tmp trivy + /tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist . -- 2.52.0 From 6210e142c21e889987f6da5371d8516da638117f Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar Date: Mon, 18 May 2026 21:40:36 +0200 Subject: [PATCH 3/3] ci: bump trivy to 0.70.0 (M0.2) v0.50.0 release tarball doesn't exist on GitHub releases (404). Pin to v0.70.0 which is the current latest. Refs: M0.2 --- .gitea/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 3e29cde..2c98e56 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -52,7 +52,7 @@ jobs: shell: bash run: | set -euo pipefail - TRIVY_VERSION=0.50.0 + TRIVY_VERSION=0.70.0 curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" \ | tar -xz -C /tmp trivy /tmp/trivy fs --severity HIGH,CRITICAL --exit-code 1 --no-progress --skip-dirs node_modules,target,dist . -- 2.52.0