Initial commit

2026-10-20 15:14:56 +00:00
commit 2d8a54687a
4 changed files with 154 additions and 0 deletions
@@ -0,0 +1,48 @@
+# CI
+
+Gitea Actions workflow: `.gitea/workflows/ci.yml`. Runs on the self-hosted `bongbetic-ci` runner.
+
+| Job | What | Blocks merge |
+|---|---|---|
+| `security` | Semgrep CE (`p/default`, `p/owasp-top-ten`, `--metrics off --error`) | yes |
+| `lint` | Language linter(s) for this repo + `jscpd` duplication check (`.jscpd.json`) | yes |
+| `ai-review` | PR-Agent review comment. Advisory only. | no |
+
+Triggers: pull requests, pushes to `main`, a weekly scheduled run (Mondays 03:00, `security` only; it catches new
+Semgrep registry rules), and manual `workflow_dispatch`.
+
+Branch protection (once set) requires `CI / security (pull_request)` and `CI / lint (pull_request)`.
+
+## Run locally
+
+```sh
+# Semgrep
+podman run --rm -v "$PWD:/src:ro,Z" -w /src docker.io/semgrep/semgrep:1.178.0 \
+  semgrep scan --config p/default --config p/owasp-top-ten --metrics off --error
+
+# Duplication
+npx --yes jscpd@4.3.0 --config .jscpd.json .
+```
+
+Run your language linter the same way the `lint` job does (see the steps in `ci.yml`).
+
+## Secrets and variables
+
+Add in Gitea (repo or user settings). Never commit them.
+
+- `OPENROUTER_API_KEY` (secret): LLM key for PR-Agent.
+- `PR_AGENT_GITEA_TOKEN` (secret): token of the comment-only bot account.
+- `PR_AGENT_MODEL`, `PR_AGENT_MAX_TOKENS` (optional variables).
+
+Without the two secrets `ai-review` skips with a notice and the PR is not blocked.
+
+## Notes
+
+- Semgrep registry rules are fetched at run time and cannot be pinned.
+- Tool and image versions in `ci.yml` are pinned. Bump them on purpose, in a PR.
+- Silence a Semgrep finding only with a narrow `# nosemgrep: <rule-id> -- <reason>` on that line.
+
+## Roll back
+
+Revert the PR that added the workflow. If branch protection requires these checks, remove the required
+checks first (Settings, Branches), or the revert PR cannot merge.