capyadmin/ci-workflows
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: reusable secret scanning, SAST, dependency and lint workflows

Browse source
This commit is contained in:
James Johnson 2026-10-18 21:31:47 +01:00
parent c9ecafca2f
commit 1e0113c05f
No known key found for this signature in database
GPG key ID: 4DD5E522F8940E76
6 changed files with 257 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

66
README.md Normal file
View file

@ -0,0 +1,66 @@
# ci-workflows
Shared reusable Forgejo Actions workflows for every repo on git.capybara.network.
| Workflow | Tool | Fails on |
|---|---|---|
| `secrets.yml` | gitleaks, full git history | any secret not listed in `.gitleaksignore` |
| `sast.yml` | semgrep, `p/default` | any finding not suppressed with `nosemgrep` or `.semgrepignore` |
| `deps.yml` | osv-scanner | a known vulnerability in a lockfile or manifest, unless ignored in `osv-scanner.toml` |
| `lint.yml` | shellcheck, ruff, hadolint, yamllint, actionlint, `tofu fmt` + tflint | lint errors; each linter runs only if matching files exist |
The tools are baked into the runner image (`flux-talos`,
`clusters/talos/apps/forgejo-runner/image/Dockerfile`); these workflows install
nothing at run time.
## Using them
Add `.forgejo/workflows/checks.yml` to a repo:
```yaml
name: checks
on:
push:
branches: [main]
pull_request:
jobs:
secrets:
runs-on: ubuntu-latest
uses: capyadmin/ci-workflows/.forgejo/workflows/secrets.yml@v1
sast:
runs-on: ubuntu-latest
uses: capyadmin/ci-workflows/.forgejo/workflows/sast.yml@v1
deps:
runs-on: ubuntu-latest
uses: capyadmin/ci-workflows/.forgejo/workflows/deps.yml@v1
lint:
runs-on: ubuntu-latest
uses: capyadmin/ci-workflows/.forgejo/workflows/lint.yml@v1
```
Two Forgejo 11 constraints shape this, both verified on this instance on 18 Oct 2026:
- **This repo must stay public.** The runner fetches a cross-repo reusable
workflow anonymously; with the repo private the calling job fails. Never put
anything secret here.
- **The calling job needs `runs-on`.** Forgejo 11 expands the reusable workflow
in the runner, not the server, so the caller has to be scheduled onto one.
GitHub forbids this combination; `lint.yml` tells actionlint to ignore it.
Inputs (all optional) are documented at the top of each workflow, e.g.:
```yaml
lint:
runs-on: ubuntu-latest
uses: capyadmin/ci-workflows/.forgejo/workflows/lint.yml@v1
with:
ruff-format: true
shellcheck-severity: error
```
## Versioning
`v1` is a moving tag on the latest compatible commit. A change that could
newly fail existing callers (a stricter default, a new linter switched on by
default) goes out as `v2`.