add reusable quality workflow

2026-08-25 12:33:27 +00:00
parent b599156c76
commit eacc96abbb
1 changed files with 106 additions and 0 deletions
@@ -0,0 +1,106 @@
+name: quality
+# Reusable Quality-Gate fuer digiflo/sanube/keim/etb/swd/florian-projects.
+# Aufruf pro Repo:  jobs.quality.uses: digiflo/ci-templates/.gitea/workflows/quality.yml@main
+# Grundsatz: KEINE Docker-Hub-Pulls (Server-IP hat unauth Pull-Limit) -> Tools via GitHub-Release/pip.
+on:
+  workflow_call:
+    inputs:
+      python:      { type: boolean, default: false }
+      node:        { type: boolean, default: false }
+      php:         { type: boolean, default: false }
+      secret_scan: { type: boolean, default: true }
+      sast:        { type: boolean, default: true }
+      vuln_scan:   { type: boolean, default: true }
+      blocking:    { type: boolean, default: false }   # true => SAST/Vuln/Lint brechen den Build ab
+
+jobs:
+  secret-scan:            # Secrets = IMMER blockierend (unabhaengig von 'blocking')
+    if: ${{ inputs.secret_scan }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      - name: gitleaks
+        run: |
+          set -eo pipefail
+          GLV=$(curl -fsSL -o /dev/null -w '%{url_effective}' https://github.com/gitleaks/gitleaks/releases/latest | sed 's#.*/tag/v##')
+          [ -n "$GLV" ] || GLV=8.21.2
+          echo "::notice::gitleaks v$GLV"
+          curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GLV}/gitleaks_${GLV}_linux_x64.tar.gz" | tar -xz -C /tmp gitleaks
+          /tmp/gitleaks detect --source . --redact --no-banner --exit-code 1
+
+  sast:
+    if: ${{ inputs.sast }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: semgrep
+        continue-on-error: ${{ !inputs.blocking }}
+        run: |
+          set -eo pipefail
+          python3 -m pip install --quiet --user semgrep
+          export PATH="$HOME/.local/bin:$PATH"
+          SEMGREP_SEND_METRICS=off semgrep scan --config p/ci --error --quiet
+
+  vuln-scan:
+    if: ${{ inputs.vuln_scan }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: trivy fs
+        continue-on-error: ${{ !inputs.blocking }}
+        run: |
+          set -eo pipefail
+          curl -fsSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /tmp
+          /tmp/trivy fs --scanners vuln,misconfig,secret --severity HIGH,CRITICAL --exit-code 1 --no-progress .
+
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: actionlint
+        continue-on-error: ${{ !inputs.blocking }}
+        run: |
+          set -eo pipefail
+          bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+          ./actionlint -color
+
+  python-lint:
+    if: ${{ inputs.python }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: ruff
+        continue-on-error: ${{ !inputs.blocking }}
+        run: |
+          set -eo pipefail
+          python3 -m pip install --quiet --user ruff
+          export PATH="$HOME/.local/bin:$PATH"
+          ruff check --output-format=github .
+          ruff format --check .
+
+  node-lint:
+    if: ${{ inputs.node }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: eslint
+        continue-on-error: ${{ !inputs.blocking }}
+        run: |
+          set -eo pipefail
+          if [ -f package.json ]; then npx --yes eslint . ; else echo "kein package.json - skip"; fi
+
+  php-lint:
+    if: ${{ inputs.php }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: php -l (+ phpstan wenn konfiguriert)
+        continue-on-error: ${{ !inputs.blocking }}
+        run: |
+          set -eo pipefail
+          find . -name '*.php' -not -path '*/vendor/*' -print0 | xargs -0 -r -n1 -P4 php -l >/dev/null
+          if [ -f phpstan.neon ] || [ -f phpstan.neon.dist ]; then
+            composer install --no-interaction --no-progress || true
+            vendor/bin/phpstan analyse --no-progress || true
+          fi