opt-out semantics for default-on scans

.gitea/workflows/quality.yml

@@ -1,21 +1,23 @@
 name: quality
-# Reusable Quality-Gate. Blockierend/Report-only wird in der Shell entschieden
-# (Giteas Parser kann ${{ }} nicht in continue-on-error/bool unmarshalen).
+# Reusable Quality-Gate. Semantik: Scans laufen per DEFAULT (opt-out via skip_*),
+# Sprach-Linter sind opt-in (python/node/php). Grund: Gitea wendet Input-Defaults
+# reusable-seitig NICHT an -> unset ist falsy, daher !skip_* = an.
+# blocking=true macht SAST/Vuln/Lint zum harten Gate (Secrets sind immer hart).
 # KEINE Docker-Hub-Pulls -> Tools via GitHub-Release/pip.
 on:
   workflow_call:
     inputs:
-      python:      { type: boolean, default: false }
-      node:        { type: boolean, default: false }
-      php:         { type: boolean, default: false }
-      secret_scan: { type: boolean, default: true }
-      sast:        { type: boolean, default: true }
-      vuln_scan:   { type: boolean, default: true }
-      blocking:    { type: boolean, default: false }
+      python:           { type: boolean, default: false }
+      node:             { type: boolean, default: false }
+      php:              { type: boolean, default: false }
+      skip_secret_scan: { type: boolean, default: false }
+      skip_sast:        { type: boolean, default: false }
+      skip_vuln:        { type: boolean, default: false }
+      blocking:         { type: boolean, default: false }
 
 jobs:
   secret-scan:
-    if: ${{ inputs.secret_scan }}
+    if: ${{ !inputs.skip_secret_scan }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -30,7 +32,7 @@ jobs:
           /tmp/gitleaks detect --source . --redact --no-banner --exit-code 1
 
   sast:
-    if: ${{ inputs.sast }}
+    if: ${{ !inputs.skip_sast }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -45,7 +47,7 @@ jobs:
           [ "$rc" -ne 0 ] && echo "::warning::semgrep findings (report-only)"; true
 
   vuln-scan:
-    if: ${{ inputs.vuln_scan }}
+    if: ${{ !inputs.skip_vuln }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4