# CI

Gitea Actions workflow: `.gitea/workflows/ci.yml`. Runs on the self-hosted `bongbetic-ci` runner.

| Job | What | Blocks merge |
|---|---|---|
| `security` | Semgrep CE (`p/default`, `p/owasp-top-ten`, `--metrics off --error`) | yes |
| `lint` | Language linter(s) for this repo + `jscpd` duplication check (`.jscpd.json`) | yes |
| `ai-review` | PR-Agent review comment. Advisory only. | no |

Triggers: pull requests, pushes to `main`, a weekly scheduled run (Mondays 03:00, `security` only; it catches new
Semgrep registry rules), and manual `workflow_dispatch`.

Branch protection (once set) requires `CI / security (pull_request)` and `CI / lint (pull_request)`.

## Run locally

```sh
# Semgrep
podman run --rm -v "$PWD:/src:ro,Z" -w /src docker.io/semgrep/semgrep:1.178.0 \
  semgrep scan --config p/default --config p/owasp-top-ten --metrics off --error

# Duplication
npx --yes jscpd@4.3.0 --config .jscpd.json .
```

Run your language linter the same way the `lint` job does (see the steps in `ci.yml`).

## Secrets and variables

Add in Gitea (repo or user settings). Never commit them.

- `OPENROUTER_API_KEY` (secret): LLM key for PR-Agent.
- `PR_AGENT_GITEA_TOKEN` (secret): token of the comment-only bot account.
- `PR_AGENT_MODEL`, `PR_AGENT_MAX_TOKENS` (optional variables).

Without the two secrets `ai-review` skips with a notice and the PR is not blocked.

## Notes

- Semgrep registry rules are fetched at run time and cannot be pinned.
- Tool and image versions in `ci.yml` are pinned. Bump them on purpose, in a PR.
- Silence a Semgrep finding only with a narrow `# nosemgrep: <rule-id> -- <reason>` on that line.

## Roll back

Revert the PR that added the workflow. If branch protection requires these checks, remove the required
checks first (Settings, Branches), or the revert PR cannot merge.