fix: shell-based blocking, valid schema

.gitea/workflows/quality.yml

@@ -1,7 +1,7 @@
 name: quality
-# Reusable Quality-Gate fuer digiflo/sanube/keim/etb/swd/florian-projects.
-# Aufruf pro Repo:  jobs.quality.uses: digiflo/ci-templates/.gitea/workflows/quality.yml@main
-# Grundsatz: KEINE Docker-Hub-Pulls (Server-IP hat unauth Pull-Limit) -> Tools via GitHub-Release/pip.
+# Reusable Quality-Gate. Blockierend/Report-only wird in der Shell entschieden
+# (Giteas Parser kann ${{ }} nicht in continue-on-error/bool unmarshalen).
+# KEINE Docker-Hub-Pulls -> Tools via GitHub-Release/pip.
 on:
   workflow_call:
     inputs:
@@ -11,18 +11,18 @@ on:
       secret_scan: { type: boolean, default: true }
       sast:        { type: boolean, default: true }
       vuln_scan:   { type: boolean, default: true }
-      blocking:    { type: boolean, default: false }   # true => SAST/Vuln/Lint brechen den Build ab
+      blocking:    { type: boolean, default: false }
 
 jobs:
-  secret-scan:            # Secrets = IMMER blockierend (unabhaengig von 'blocking')
+  secret-scan:
     if: ${{ inputs.secret_scan }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with: { fetch-depth: 0 }
-      - name: gitleaks
+      - name: gitleaks (Secrets = immer blockierend)
         run: |
-          set -eo pipefail
+          set -o pipefail
           GLV=$(curl -fsSL -o /dev/null -w '%{url_effective}' https://github.com/gitleaks/gitleaks/releases/latest | sed 's#.*/tag/v##')
           [ -n "$GLV" ] || GLV=8.21.2
           echo "::notice::gitleaks v$GLV"
@@ -35,12 +35,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: semgrep
-        continue-on-error: ${{ !inputs.blocking }}
         run: |
-          set -eo pipefail
+          set -o pipefail
           python3 -m pip install --quiet --user semgrep
           export PATH="$HOME/.local/bin:$PATH"
-          SEMGREP_SEND_METRICS=off semgrep scan --config p/ci --error --quiet
+          rc=0
+          SEMGREP_SEND_METRICS=off semgrep scan --config p/ci --error --quiet || rc=$?
+          if [ "${{ inputs.blocking }}" = "true" ] && [ "$rc" -ne 0 ]; then exit "$rc"; fi
+          [ "$rc" -ne 0 ] && echo "::warning::semgrep findings (report-only)"; true
 
   vuln-scan:
     if: ${{ inputs.vuln_scan }}
@@ -48,22 +50,27 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: trivy fs
-        continue-on-error: ${{ !inputs.blocking }}
         run: |
-          set -eo pipefail
+          set -o pipefail
           curl -fsSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /tmp
-          /tmp/trivy fs --scanners vuln,misconfig,secret --severity HIGH,CRITICAL --exit-code 1 --no-progress .
+          rc=0
+          /tmp/trivy fs --scanners vuln,misconfig,secret --severity HIGH,CRITICAL --exit-code 1 --no-progress . || rc=$?
+          if [ "${{ inputs.blocking }}" = "true" ] && [ "$rc" -ne 0 ]; then exit "$rc"; fi
+          [ "$rc" -ne 0 ] && echo "::warning::trivy findings (report-only)"; true
 
   actionlint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - name: actionlint
-        continue-on-error: ${{ !inputs.blocking }}
         run: |
-          set -eo pipefail
+          set -o pipefail
           bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
-          ./actionlint -color
+          files=$(ls .gitea/workflows/*.y*ml .github/workflows/*.y*ml 2>/dev/null || true)
+          rc=0
+          if [ -n "$files" ]; then ./actionlint -color $files || rc=$?; else echo "keine Workflows"; fi
+          if [ "${{ inputs.blocking }}" = "true" ] && [ "$rc" -ne 0 ]; then exit "$rc"; fi
+          [ "$rc" -ne 0 ] && echo "::warning::actionlint findings (report-only)"; true
 
   python-lint:
     if: ${{ inputs.python }}
@@ -71,13 +78,15 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: ruff
-        continue-on-error: ${{ !inputs.blocking }}
         run: |
-          set -eo pipefail
+          set -o pipefail
           python3 -m pip install --quiet --user ruff
           export PATH="$HOME/.local/bin:$PATH"
-          ruff check --output-format=github .
-          ruff format --check .
+          rc=0
+          ruff check --output-format=github . || rc=$?
+          ruff format --check . || rc=$?
+          if [ "${{ inputs.blocking }}" = "true" ] && [ "$rc" -ne 0 ]; then exit "$rc"; fi
+          [ "$rc" -ne 0 ] && echo "::warning::ruff findings (report-only)"; true
 
   node-lint:
     if: ${{ inputs.node }}
@@ -85,22 +94,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: eslint
-        continue-on-error: ${{ !inputs.blocking }}
         run: |
-          set -eo pipefail
-          if [ -f package.json ]; then npx --yes eslint . ; else echo "kein package.json - skip"; fi
+          set -o pipefail
+          if [ ! -f package.json ]; then echo "kein package.json - skip"; exit 0; fi
+          rc=0
+          npx --yes eslint . || rc=$?
+          if [ "${{ inputs.blocking }}" = "true" ] && [ "$rc" -ne 0 ]; then exit "$rc"; fi
+          [ "$rc" -ne 0 ] && echo "::warning::eslint findings (report-only)"; true
 
   php-lint:
     if: ${{ inputs.php }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: php -l (+ phpstan wenn konfiguriert)
-        continue-on-error: ${{ !inputs.blocking }}
+      - name: php -l
         run: |
-          set -eo pipefail
-          find . -name '*.php' -not -path '*/vendor/*' -print0 | xargs -0 -r -n1 -P4 php -l >/dev/null
-          if [ -f phpstan.neon ] || [ -f phpstan.neon.dist ]; then
-            composer install --no-interaction --no-progress || true
-            vendor/bin/phpstan analyse --no-progress || true
-          fi
+          set -o pipefail
+          rc=0
+          find . -name '*.php' -not -path '*/vendor/*' -print0 | xargs -0 -r -n1 -P4 php -l >/dev/null || rc=$?
+          if [ "${{ inputs.blocking }}" = "true" ] && [ "$rc" -ne 0 ]; then exit "$rc"; fi
+          [ "$rc" -ne 0 ] && echo "::warning::php -l findings (report-only)"; true