From c0a8cdb683953e515757071c288bfdf9e7b4b40a Mon Sep 17 00:00:00 2001 From: Sergey Krylov Date: Sun, 13 Sep 2026 19:58:30 +0300 Subject: [PATCH] ci: verify docs and secure dependency updates #1 #5 #6 --- .gitea/workflows/security.yml | 31 ++++++++++++++++++++++++++ .gitea/workflows/verify.yml | 41 +++++++++++++++++++++++++++++++++++ CONTRIBUTING.md | 19 ++++++++++++++++ package-lock.json | 6 ++--- package.json | 5 +++++ renovate.json | 27 ++++++++++++++++++++++- 6 files changed, 125 insertions(+), 4 deletions(-) create mode 100644 .gitea/workflows/security.yml create mode 100644 .gitea/workflows/verify.yml diff --git a/.gitea/workflows/security.yml b/.gitea/workflows/security.yml new file mode 100644 index 0000000..876617f --- /dev/null +++ b/.gitea/workflows/security.yml @@ -0,0 +1,31 @@ +name: Docs security + +on: + push: + branches: + - '**' + pull_request: + schedule: + - cron: '17 5 * * *' + +jobs: + security: + runs-on: ubuntu-latest + steps: + - uses: https://github.com/actions/checkout@v4 + with: + fetch-depth: 0 + - name: Record checked revision + run: git rev-parse HEAD + - name: Scan history with Gitleaks 8.30.1 + run: | + curl --fail --location --silent --show-error https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz + echo '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb /tmp/gitleaks.tar.gz' | sha256sum --check + mkdir -p /tmp/gitleaks-bin + tar -xzf /tmp/gitleaks.tar.gz -C /tmp/gitleaks-bin gitleaks + /tmp/gitleaks-bin/gitleaks git --log-opts=--all --redact=100 --no-banner + - uses: https://github.com/actions/setup-node@v4 + with: + node-version-file: .nvmrc + - name: Audit runtime and development dependencies + run: npm audit --include=dev --audit-level=low diff --git a/.gitea/workflows/verify.yml b/.gitea/workflows/verify.yml new file mode 100644 index 0000000..5cedb11 --- /dev/null +++ b/.gitea/workflows/verify.yml @@ -0,0 +1,41 @@ +name: Docs verify + +on: + push: + branches: + - '**' + +jobs: + verify: + runs-on: ubuntu-latest + defaults: + run: + working-directory: workspace/docs + steps: + - name: Checkout workspace root + uses: https://github.com/actions/checkout@v4 + with: + repository: WealthLedger/main + ref: main + path: workspace + - uses: https://github.com/actions/checkout@v4 + with: + path: workspace/docs + - name: Checkout linked repositories + run: | + git clone --depth 1 --branch main https://git.personal.ksv741.ru/WealthLedger/frontend.git ../frontend + git clone --depth 1 --branch main https://git.personal.ksv741.ru/WealthLedger/backend.git ../backend + git clone --depth 1 --branch main https://git.personal.ksv741.ru/WealthLedger/specs.git ../specs + - name: Record checked revisions + run: | + git rev-parse HEAD + git -C .. rev-parse HEAD + git -C ../frontend rev-parse HEAD + git -C ../backend rev-parse HEAD + git -C ../specs rev-parse HEAD + - uses: https://github.com/actions/setup-node@v4 + with: + node-version-file: workspace/docs/.nvmrc + - run: npm ci + - name: Check Markdown and relative links + run: npm run verify diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f948c20..962c851 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -163,3 +163,22 @@ npm run verify разработчик от вопроса к объяснению и требованию; агент от типа задачи к нужным ограничениям, ADR и репозиторию. Отчёт различает синтаксис, ссылки, рендер, смысловую сверку и оставшиеся ограничения. + +### CI и обновления зависимостей + +`.gitea/workflows/verify.yml` запускает этот gate на каждом push ветки с Node +из `.nvmrc` и установкой через `npm ci`. Checkout docs размещается внутри +workspace из `WealthLedger/main`, рядом с frontend, backend и specs. Соседние +репозитории берутся из `main`; SHA всех пяти участников сохраняются в логе. +Ошибка checkout, Markdown или относительной ссылки завершает job с FAIL. +Это проверка ссылок на выбранные revisions, без Mermaid-render и semantic review. + +`security.yml` при push, PR и ежедневно проверяет всю Git-историю через +Gitleaks 8.30.1 с redacted-выводом и все npm dependencies через +`npm audit --include=dev --audit-level=low`. Override `smol-toml` исправляет +DoS в TOML parser markdownlint-cli2; его можно удалить, когда родительский +пакет примет исправленную версию. + +Renovate объединяет minor/patch updates; major требует согласования в +Dependency Dashboard, automerge не включён. Required checks включаются +отдельно в Gitea; workflow сам по себе не запрещает merge. diff --git a/package-lock.json b/package-lock.json index 3c3fa02..c2906d2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1319,9 +1319,9 @@ } }, "node_modules/smol-toml": { - "version": "1.7.0", - "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.0.tgz", - "integrity": "sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==", + "version": "1.8.0", + "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.8.0.tgz", + "integrity": "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==", "dev": true, "license": "BSD-3-Clause", "engines": { diff --git a/package.json b/package.json index 6f1fb73..f5249a3 100644 --- a/package.json +++ b/package.json @@ -12,5 +12,10 @@ "devDependencies": { "markdownlint-cli2": "0.23.2", "markdownlint-rule-relative-links": "5.1.2" + }, + "overrides": { + "markdownlint-cli2@0.23.2": { + "smol-toml": "1.8.0" + } } } diff --git a/renovate.json b/renovate.json index 7190a60..8f0899c 100644 --- a/renovate.json +++ b/renovate.json @@ -1,3 +1,28 @@ { - "$schema": "https://docs.renovatebot.com/renovate-schema.json" + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended", + ":semanticCommitTypeAll(chore)" + ], + "timezone": "Europe/Moscow", + "labels": [ + "dependencies" + ], + "dependencyDashboard": true, + "rangeStrategy": "bump", + "packageRules": [ + { + "matchUpdateTypes": [ + "minor", + "patch" + ], + "groupName": "non-major dependencies" + }, + { + "matchUpdateTypes": [ + "major" + ], + "dependencyDashboardApproval": true + } + ] }