ci: add dependency-audit and changelog Gitea workflows
- audit.yml: weekly `dotnet list package --vulnerable` scan that files an issue on findings - changelog.yml: generate a changelog on `v*` tag pushes Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
mika kuns
101
.gitea/workflows/audit.yml
Normal file
101
.gitea/workflows/audit.yml
Normal file
@@ -0,0 +1,101 @@
|
|||||||
|
name: Dependency Audit
|
||||||
|
|
||||||
|
on:
|
||||||
|
schedule:
|
||||||
|
- cron: '0 6 * * 1' # Mondays 06:00 UTC
|
||||||
|
workflow_dispatch: {}
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
audit:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
env:
|
||||||
|
DOTNET_ROOT: /home/mika/.dotnet
|
||||||
|
GITEA_API: https://git.kuns.dev/api/v1
|
||||||
|
REPO: releases/ClaudeDo
|
||||||
|
ISSUE_TITLE: 'Dependency audit: vulnerable packages detected'
|
||||||
|
steps:
|
||||||
|
- name: Checkout main
|
||||||
|
env:
|
||||||
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
git clone --depth 1 --branch main \
|
||||||
|
"https://oauth2:${TOKEN}@git.kuns.dev/${REPO}.git" src
|
||||||
|
|
||||||
|
- name: Scan for vulnerable / outdated packages
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
export PATH="$DOTNET_ROOT:$PATH"
|
||||||
|
cd src
|
||||||
|
|
||||||
|
: > audit.log
|
||||||
|
: > vuln.md
|
||||||
|
found=0
|
||||||
|
|
||||||
|
# .slnx tooling needs .NET 9; iterate per-project to stay on .NET 8.
|
||||||
|
while IFS= read -r proj; do
|
||||||
|
echo "==== $proj ====" | tee -a audit.log
|
||||||
|
dotnet restore "$proj" >/dev/null
|
||||||
|
|
||||||
|
vuln="$(dotnet list "$proj" package --vulnerable --include-transitive 2>&1)"
|
||||||
|
echo "$vuln" | tee -a audit.log
|
||||||
|
if echo "$vuln" | grep -qi "has the following vulnerable"; then
|
||||||
|
found=1
|
||||||
|
{
|
||||||
|
printf '#### `%s`\n\n```\n' "$proj"
|
||||||
|
echo "$vuln"
|
||||||
|
printf '```\n\n'
|
||||||
|
} >> vuln.md
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Outdated is informational only — never fails the run.
|
||||||
|
dotnet list "$proj" package --outdated 2>&1 | tee -a audit.log || true
|
||||||
|
echo "" | tee -a audit.log
|
||||||
|
done < <(find . -name '*.csproj' | sort)
|
||||||
|
|
||||||
|
if [ "$found" -ne 0 ]; then
|
||||||
|
echo "::error::Vulnerable packages detected — see log above." >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "No vulnerable packages found."
|
||||||
|
|
||||||
|
- name: Report vulnerabilities to a Gitea issue
|
||||||
|
if: failure()
|
||||||
|
env:
|
||||||
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||||
|
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
cd src
|
||||||
|
|
||||||
|
if [ -s vuln.md ]; then
|
||||||
|
DETAILS="$(cat vuln.md)"
|
||||||
|
else
|
||||||
|
DETAILS="The audit job failed before producing findings — check the run log."
|
||||||
|
fi
|
||||||
|
BODY="$(printf 'Automated weekly dependency audit found vulnerable packages.\n\n%s\n\n[View workflow run](%s)' \
|
||||||
|
"$DETAILS" "$RUN_URL")"
|
||||||
|
|
||||||
|
# Reuse an existing open issue if one is already tracking this.
|
||||||
|
EXISTING="$(curl -sS \
|
||||||
|
-H "Authorization: token ${TOKEN}" \
|
||||||
|
"${GITEA_API}/repos/${REPO}/issues?state=open&type=issues&limit=50" \
|
||||||
|
| jq -r --arg t "$ISSUE_TITLE" '.[] | select(.title==$t) | .number' | head -n1)"
|
||||||
|
|
||||||
|
if [ -n "$EXISTING" ]; then
|
||||||
|
echo "Commenting on existing issue #$EXISTING"
|
||||||
|
jq -n --arg body "$BODY" '{body:$body}' \
|
||||||
|
| curl -sS --fail-with-body -X POST \
|
||||||
|
-H "Authorization: token ${TOKEN}" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d @- \
|
||||||
|
"${GITEA_API}/repos/${REPO}/issues/${EXISTING}/comments" >/dev/null
|
||||||
|
else
|
||||||
|
echo "Creating new issue"
|
||||||
|
jq -n --arg title "$ISSUE_TITLE" --arg body "$BODY" '{title:$title, body:$body}' \
|
||||||
|
| curl -sS --fail-with-body -X POST \
|
||||||
|
-H "Authorization: token ${TOKEN}" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
-d @- \
|
||||||
|
"${GITEA_API}/repos/${REPO}/issues" >/dev/null
|
||||||
|
fi
|
||||||
85
.gitea/workflows/changelog.yml
Normal file
85
.gitea/workflows/changelog.yml
Normal file
@@ -0,0 +1,85 @@
|
|||||||
|
name: Changelog
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
tags:
|
||||||
|
- 'v*'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
changelog:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
env:
|
||||||
|
REPO: releases/ClaudeDo
|
||||||
|
steps:
|
||||||
|
- name: Checkout main (full history)
|
||||||
|
env:
|
||||||
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
git clone "https://oauth2:${TOKEN}@git.kuns.dev/${REPO}.git" src
|
||||||
|
cd src
|
||||||
|
git fetch --tags --force
|
||||||
|
git checkout main
|
||||||
|
|
||||||
|
- name: Regenerate CHANGELOG.md
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
cd src
|
||||||
|
|
||||||
|
emit_group() {
|
||||||
|
# $1 range, $2 conventional-type, $3 heading
|
||||||
|
local range="$1" type="$2" title="$3" lines
|
||||||
|
lines="$(git log "$range" --no-merges --pretty=format:'%s|%h' \
|
||||||
|
| grep -E "^${type}(\([^)]*\))?(!)?: " || true)"
|
||||||
|
[ -z "$lines" ] && return 0
|
||||||
|
printf '### %s\n\n' "$title"
|
||||||
|
while IFS='|' read -r subject hash; do
|
||||||
|
printf -- '- %s (%s)\n' "${subject#*: }" "$hash"
|
||||||
|
done <<< "$lines"
|
||||||
|
printf '\n'
|
||||||
|
}
|
||||||
|
|
||||||
|
emit_section() {
|
||||||
|
# $1 range, $2 tag, $3 date
|
||||||
|
printf '## %s — %s\n\n' "$2" "$3"
|
||||||
|
emit_group "$1" feat "Features"
|
||||||
|
emit_group "$1" fix "Fixes"
|
||||||
|
emit_group "$1" perf "Performance"
|
||||||
|
emit_group "$1" refactor "Refactoring"
|
||||||
|
emit_group "$1" docs "Documentation"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Tags ascending by semver so we can pair each with its predecessor.
|
||||||
|
mapfile -t TAGS < <(git tag --sort=v:refname | grep -E '^v' || true)
|
||||||
|
|
||||||
|
{
|
||||||
|
printf '# Changelog\n\n'
|
||||||
|
for ((i=${#TAGS[@]}-1; i>=0; i--)); do
|
||||||
|
TAG="${TAGS[$i]}"
|
||||||
|
DATE="$(git log -1 --format=%ad --date=short "$TAG")"
|
||||||
|
if (( i > 0 )); then
|
||||||
|
RANGE="${TAGS[$((i-1))]}..${TAG}"
|
||||||
|
else
|
||||||
|
RANGE="$TAG"
|
||||||
|
fi
|
||||||
|
emit_section "$RANGE" "$TAG" "$DATE"
|
||||||
|
done
|
||||||
|
} > CHANGELOG.md
|
||||||
|
|
||||||
|
cat CHANGELOG.md
|
||||||
|
|
||||||
|
- name: Commit and push if changed
|
||||||
|
env:
|
||||||
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
cd src
|
||||||
|
if git diff --quiet -- CHANGELOG.md; then
|
||||||
|
echo "CHANGELOG.md unchanged; nothing to commit."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
git config user.name "ClaudeDo CI"
|
||||||
|
git config user.email "ci@kuns.dev"
|
||||||
|
git add CHANGELOG.md
|
||||||
|
git commit -m "docs(changelog): update for ${GITHUB_REF_NAME}"
|
||||||
|
git push origin main
|
||||||
Reference in New Issue
Block a user