49 lines
1.8 KiB
Markdown
49 lines
1.8 KiB
Markdown
# CI
|
|
|
|
Gitea Actions workflow: `.gitea/workflows/ci.yml`. Runs on the self-hosted `bongbetic-ci` runner.
|
|
|
|
| Job | What | Blocks merge |
|
|
|---|---|---|
|
|
| `security` | Semgrep CE (`p/default`, `p/owasp-top-ten`, `--metrics off --error`) | yes |
|
|
| `lint` | Language linter(s) for this repo + `jscpd` duplication check (`.jscpd.json`) | yes |
|
|
| `ai-review` | PR-Agent review comment. Advisory only. | no |
|
|
|
|
Triggers: pull requests, pushes to `main`, a weekly scheduled run (Mondays 03:00, `security` only; it catches new
|
|
Semgrep registry rules), and manual `workflow_dispatch`.
|
|
|
|
Branch protection (once set) requires `CI / security (pull_request)` and `CI / lint (pull_request)`.
|
|
|
|
## Run locally
|
|
|
|
```sh
|
|
# Semgrep
|
|
podman run --rm -v "$PWD:/src:ro,Z" -w /src docker.io/semgrep/semgrep:1.178.0 \
|
|
semgrep scan --config p/default --config p/owasp-top-ten --metrics off --error
|
|
|
|
# Duplication
|
|
npx --yes jscpd@4.3.0 --config .jscpd.json .
|
|
```
|
|
|
|
Run your language linter the same way the `lint` job does (see the steps in `ci.yml`).
|
|
|
|
## Secrets and variables
|
|
|
|
Add in Gitea (repo or user settings). Never commit them.
|
|
|
|
- `OPENROUTER_API_KEY` (secret): LLM key for PR-Agent.
|
|
- `PR_AGENT_GITEA_TOKEN` (secret): token of the comment-only bot account.
|
|
- `PR_AGENT_MODEL`, `PR_AGENT_MAX_TOKENS` (optional variables).
|
|
|
|
Without the two secrets `ai-review` skips with a notice and the PR is not blocked.
|
|
|
|
## Notes
|
|
|
|
- Semgrep registry rules are fetched at run time and cannot be pinned.
|
|
- Tool and image versions in `ci.yml` are pinned. Bump them on purpose, in a PR.
|
|
- Silence a Semgrep finding only with a narrow `# nosemgrep: <rule-id> -- <reason>` on that line.
|
|
|
|
## Roll back
|
|
|
|
Revert the PR that added the workflow. If branch protection requires these checks, remove the required
|
|
checks first (Settings, Branches), or the revert PR cannot merge.
|