MSI-CONTROL-CENTER/CI.md

CI

Gitea Actions workflow: .gitea/workflows/ci.yml. Runs on the self-hosted bongbetic-ci runner.

Job	What	Blocks merge
security	Semgrep CE (p/default, p/owasp-top-ten, --metrics off --error)	yes
lint	Language linter(s) for this repo + jscpd duplication check (.jscpd.json)	yes
ai-review	PR-Agent review comment. Advisory only.	no

Triggers: pull requests, pushes to main, a weekly scheduled run (Mondays 03:00, security only; it catches new Semgrep registry rules), and manual workflow_dispatch.

Branch protection (once set) requires CI / security (pull_request) and CI / lint (pull_request).

Run locally

# Semgrep
podman run --rm -v "$PWD:/src:ro,Z" -w /src docker.io/semgrep/semgrep:1.178.0 \
  semgrep scan --config p/default --config p/owasp-top-ten --metrics off --error

# Duplication
npx --yes jscpd@4.3.0 --config .jscpd.json .

Run your language linter the same way the lint job does (see the steps in ci.yml).

Secrets and variables

Add in Gitea (repo or user settings). Never commit them.

• OPENROUTER_API_KEY (secret): LLM key for PR-Agent.
• PR_AGENT_GITEA_TOKEN (secret): token of the comment-only bot account.
• PR_AGENT_MODEL, PR_AGENT_MAX_TOKENS (optional variables).

Without the two secrets ai-review skips with a notice and the PR is not blocked.

Notes

• Semgrep registry rules are fetched at run time and cannot be pinned.
• Tool and image versions in ci.yml are pinned. Bump them on purpose, in a PR.
• Silence a Semgrep finding only with a narrow # nosemgrep: <rule-id> -- <reason> on that line.

Roll back

Revert the PR that added the workflow. If branch protection requires these checks, remove the required checks first (Settings, Branches), or the revert PR cannot merge.