From d4f5a198a3dcc7e752b82c8e0ddb749ef800a05e Mon Sep 17 00:00:00 2001
From: Jarian <jarianc>
Date: Sun, 5 Jul 2026 02:46:31 +0000
Subject: [PATCH] CI: add generalized workflow

---
 .gitea/workflows/ci.yml | 143 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 143 insertions(+)
 create mode 100644 .gitea/workflows/ci.yml

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
new file mode 100644
index 0000000..fb31d5a
--- /dev/null
+++ b/.gitea/workflows/ci.yml
@@ -0,0 +1,143 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+env:
+  GITEA_URL: https://git.home.ms
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    container:
+      image: gitea-job-image
+    steps:
+      - name: Clone repo
+        run: |
+          rm -rf $GITHUB_WORKSPACE/*
+          git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
+          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+
+      - name: Run ruff (Python lint)
+        if: always()
+        run: |
+          if [[ -f pyproject.toml ]]; then
+            pip3 install ruff
+            ruff check .
+          else
+            echo "No Python project detected, skipping ruff"
+          fi
+
+      - name: Run npm lint (JS/TS)
+        if: always()
+        run: |
+          if [[ -f package.json ]]; then
+            npm ci
+            npm run lint --if-present || true
+          else
+            echo "No Node.js project detected, skipping npm lint"
+          fi
+
+  test:
+    runs-on: ubuntu-latest
+    container:
+      image: gitea-job-image
+    steps:
+      - name: Clone repo
+        run: |
+          rm -rf $GITHUB_WORKSPACE/*
+          git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
+          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+
+      - name: Run pytest (Python)
+        if: always()
+        run: |
+          if [[ -f pyproject.toml ]]; then
+            python3 -m pip install --upgrade pip
+            pip3 install -e ".[dev]" 2>/dev/null || pip3 install -e . 2>/dev/null || true
+            pip3 install pytest
+            pytest tests/ -v --tb=short 2>/dev/null || true
+          else
+            echo "No Python project detected, skipping pytest"
+          fi
+
+      - name: Run npm test (JS/TS)
+        if: always()
+        run: |
+          if [[ -f package.json ]]; then
+            npm ci
+            npm run test --if-present || true
+          else
+            echo "No Node.js project detected, skipping npm test"
+          fi
+
+      - name: Run Go tests
+        if: always()
+        run: |
+          if [[ -f go.mod ]]; then
+            go test ./...
+          else
+            echo "No Go project detected, skipping go test"
+          fi
+
+  docker-build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone repo
+        run: |
+          rm -rf $GITHUB_WORKSPACE/*
+          git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
+          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+
+      - name: Build Docker image
+        if: always()
+        run: |
+          if [[ -f Dockerfile ]]; then
+            docker build -t $GITHUB_REPOSITORY:test --no-cache .
+          else
+            echo "No Dockerfile found, skipping docker build"
+          fi
+
+  security:
+    runs-on: ubuntu-latest
+    container:
+      image: gitea-job-image
+    steps:
+      - name: Clone repo
+        run: |
+          rm -rf $GITHUB_WORKSPACE/*
+          git clone --depth 1 $GITEA_URL/$GITHUB_REPOSITORY $GITHUB_WORKSPACE
+          git -C $GITHUB_WORKSPACE checkout $GITHUB_SHA 2>/dev/null || true
+
+      - name: Run bandit (Python SAST)
+        if: always()
+        run: |
+          if [[ -f pyproject.toml ]]; then
+            pip3 install bandit
+            bandit -r . --severity-level high --confidence-level high --exclude tests/,test_*
+          else
+            echo "No Python project detected, skipping bandit"
+          fi
+
+      - name: Run npm audit (JS/TS)
+        if: always()
+        run: |
+          if [[ -f package.json ]]; then
+            npm ci
+            npm audit --audit-level=high 2>/dev/null || echo "npm audit: vulnerabilities found (non-blocking)"
+          else
+            echo "No Node.js project detected, skipping npm audit"
+          fi
+
+  build-result:
+    needs: [lint, test, docker-build, security]
+    runs-on: ubuntu-latest
+    container:
+      image: gitea-job-image
+    if: always()
+    steps:
+      - name: Summary
+        run: echo "All CI checks completed"