ci: verify docs and secure dependency updates #1 #5 #6

.gitea/workflows/security.yml

@@ -0,0 +1,31 @@
+name: Docs security
+
+on:
+  push:
+    branches:
+      - '**'
+  pull_request:
+  schedule:
+    - cron: '17 5 * * *'
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: https://github.com/actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Record checked revision
+        run: git rev-parse HEAD
+      - name: Scan history with Gitleaks 8.30.1
+        run: |
+          curl --fail --location --silent --show-error https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz -o /tmp/gitleaks.tar.gz
+          echo '551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/gitleaks.tar.gz' | sha256sum --check
+          mkdir -p /tmp/gitleaks-bin
+          tar -xzf /tmp/gitleaks.tar.gz -C /tmp/gitleaks-bin gitleaks
+          /tmp/gitleaks-bin/gitleaks git --log-opts=--all --redact=100 --no-banner
+      - uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+      - name: Audit runtime and development dependencies
+        run: npm audit --include=dev --audit-level=low

.gitea/workflows/verify.yml

@@ -0,0 +1,41 @@
+name: Docs verify
+
+on:
+  push:
+    branches:
+      - '**'
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: workspace/docs
+    steps:
+      - name: Checkout workspace root
+        uses: https://github.com/actions/checkout@v4
+        with:
+          repository: WealthLedger/main
+          ref: main
+          path: workspace
+      - uses: https://github.com/actions/checkout@v4
+        with:
+          path: workspace/docs
+      - name: Checkout linked repositories
+        run: |
+          git clone --depth 1 --branch main https://git.personal.ksv741.ru/WealthLedger/frontend.git ../frontend
+          git clone --depth 1 --branch main https://git.personal.ksv741.ru/WealthLedger/backend.git ../backend
+          git clone --depth 1 --branch main https://git.personal.ksv741.ru/WealthLedger/specs.git ../specs
+      - name: Record checked revisions
+        run: |
+          git rev-parse HEAD
+          git -C .. rev-parse HEAD
+          git -C ../frontend rev-parse HEAD
+          git -C ../backend rev-parse HEAD
+          git -C ../specs rev-parse HEAD
+      - uses: https://github.com/actions/setup-node@v4
+        with:
+          node-version-file: workspace/docs/.nvmrc
+      - run: npm ci
+      - name: Check Markdown and relative links
+        run: npm run verify