From 18bf678acf26a1dac20211225bae2337baac48e4 Mon Sep 17 00:00:00 2001 From: chillpad Date: Sun, 26 Jul 2026 16:32:45 +0300 Subject: [PATCH] remove upstream CI/CD workflows and dependabot config (not needed for private auto-sync fork) --- .github/dependabot.yml | 35 ---------- .github/workflows/ci.yml | 60 ---------------- .github/workflows/codeql.yml | 37 ---------- .github/workflows/docker.yml | 100 --------------------------- .github/workflows/lint.yml | 29 -------- .github/workflows/release-please.yml | 18 ----- .github/workflows/release.yml | 85 ----------------------- .github/workflows/security-audit.yml | 35 ---------- 8 files changed, 399 deletions(-) delete mode 100644 .github/dependabot.yml delete mode 100644 .github/workflows/ci.yml delete mode 100644 .github/workflows/codeql.yml delete mode 100644 .github/workflows/docker.yml delete mode 100644 .github/workflows/lint.yml delete mode 100644 .github/workflows/release-please.yml delete mode 100644 .github/workflows/release.yml delete mode 100644 .github/workflows/security-audit.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml deleted file mode 100644 index a835e5c..0000000 --- a/.github/dependabot.yml +++ /dev/null @@ -1,35 +0,0 @@ -version: 2 -updates: - - package-ecosystem: "npm" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 10 - groups: - # Схлопываем шумные обновления в один PR, чтобы не плодить десятки веток. - dev-dependencies: - dependency-type: "development" - production-minor-patch: - dependency-type: "production" - update-types: - - "minor" - - "patch" - labels: - - "dependencies" - - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - open-pull-requests-limit: 5 - labels: - - "dependencies" - - "ci" - - - package-ecosystem: "docker" - directory: "/" - schedule: - interval: "weekly" - labels: - - "dependencies" - - "docker" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index 92212a5..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,60 +0,0 @@ -name: CI - -on: - push: - branches: [main, dev] - pull_request: - branches: [main, dev] - -jobs: - lint: - uses: ./.github/workflows/lint.yml - - test: - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - cache: 'npm' - - - name: Install dependencies - run: npm ci - - - name: Run tests - run: npm run test - - build: - needs: [lint, test] - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - cache: 'npm' - - - name: Install dependencies - run: npm ci - - - name: Build - run: npm run build - env: - VITE_API_URL: /api - VITE_TELEGRAM_BOT_USERNAME: test_bot - VITE_APP_NAME: Cabinet - VITE_APP_LOGO: V - - - name: Upload build artifacts - uses: actions/upload-artifact@v4 - with: - name: dist - path: dist/ - retention-days: 7 diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 62647e2..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,37 +0,0 @@ -name: CodeQL - -on: - push: - branches: [main, dev] - pull_request: - branches: [main, dev] - schedule: - # Еженедельный полный проход, чтобы ловить новые правила даже без коммитов. - - cron: "27 3 * * 1" - -permissions: - contents: read - -jobs: - analyze: - name: Analyze (javascript-typescript) - runs-on: ubuntu-latest - permissions: - security-events: write - actions: read - contents: read - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Initialize CodeQL - uses: github/codeql-action/init@v4 - with: - languages: javascript-typescript - queries: security-and-quality - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v4 - with: - category: "/language:javascript-typescript" diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml deleted file mode 100644 index 6468ebb..0000000 --- a/.github/workflows/docker.yml +++ /dev/null @@ -1,100 +0,0 @@ -name: Docker Build - -on: - push: - branches: [main] - tags: - - 'v*' - pull_request: - branches: [main] - -env: - REGISTRY: ghcr.io - IMAGE_NAME: ${{ github.repository }} - -permissions: - contents: read - -jobs: - lint: - uses: ./.github/workflows/lint.yml - - build-and-push: - needs: lint - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - security-events: write - - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Log in to Container Registry - if: github.event_name != 'pull_request' - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} - tags: | - type=ref,event=branch - type=ref,event=pr - type=semver,pattern={{version}} - type=semver,pattern={{major}}.{{minor}} - type=semver,pattern={{major}} - type=sha - type=raw,value=latest,enable={{is_default_branch}} - - - name: Build and push Docker image - id: build - uses: docker/build-push-action@v5 - with: - context: . - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha - cache-to: type=gha,mode=max - build-args: | - VITE_API_URL=/api - VITE_TELEGRAM_BOT_USERNAME= - VITE_APP_NAME=Cabinet - VITE_APP_LOGO=V - - # OCI-референсы требуют lowercase, а github.repository сохраняет регистр - # (BEDOLAGA-DEV/…) — Trivy падал бы на 'repository name must be lowercase'. - - name: Lowercase image name for Trivy - if: github.event_name != 'pull_request' - id: image - run: echo "name=${IMAGE_NAME,,}" >> "$GITHUB_OUTPUT" - - # Сканируем запушенный образ на CVE. Пока non-blocking (exit-code: 0): - # находки уезжают в Security → Code scanning, но сборку не роняют. - # Для ужесточения — поставить severity-фильтр в exit-code и убрать PR-гейт. - - name: Scan image with Trivy - if: github.event_name != 'pull_request' - uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 - with: - image-ref: ${{ env.REGISTRY }}/${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }} - format: sarif - output: trivy-results.sarif - severity: HIGH,CRITICAL - exit-code: "0" - - - name: Upload Trivy results to Security tab - if: github.event_name != 'pull_request' - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: trivy-results.sarif - category: trivy diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml deleted file mode 100644 index e6fe497..0000000 --- a/.github/workflows/lint.yml +++ /dev/null @@ -1,29 +0,0 @@ -name: Lint & Format - -on: - workflow_call: - -jobs: - lint: - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - cache: 'npm' - - - name: Install dependencies - run: npm ci - - - name: Run linter - run: npm run lint - - - name: Check formatting - run: npm run format:check - - - name: Run TypeScript check - run: npx tsc --noEmit diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml deleted file mode 100644 index e7c070d..0000000 --- a/.github/workflows/release-please.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: Release Please - -on: - push: - branches: - - main - -permissions: - contents: write - pull-requests: write - -jobs: - release-please: - runs-on: ubuntu-latest - steps: - - uses: googleapis/release-please-action@v4 - with: - release-type: node diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 32ccc19..0000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,85 +0,0 @@ -name: Release - -on: - push: - tags: - - 'v*' - -permissions: - contents: write - -jobs: - lint: - uses: ./.github/workflows/lint.yml - - create-release: - needs: lint - runs-on: ubuntu-latest - - steps: - - name: Checkout code - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: '20' - cache: 'npm' - - - name: Install dependencies - run: npm ci - - - name: Build application - run: npm run build - env: - VITE_API_URL: /api - VITE_TELEGRAM_BOT_USERNAME: - VITE_APP_NAME: Bedolaga Cabinet - VITE_APP_LOGO: V - - - name: Create dist archive - run: | - cd dist - tar -czf ../bedolaga-cabinet-${{ github.ref_name }}.tar.gz . - cd .. - zip -r bedolaga-cabinet-${{ github.ref_name }}.zip dist/ - - - name: Generate changelog - id: changelog - run: | - # Get previous tag - PREV_TAG=$(git describe --tags --abbrev=0 ${{ github.ref_name }}^ 2>/dev/null || echo "") - - if [ -z "$PREV_TAG" ]; then - echo "changelog=First release" >> $GITHUB_OUTPUT - else - CHANGELOG=$(git log ${PREV_TAG}..${{ github.ref_name }} --pretty=format:"- %s (%h)" --no-merges) - echo "changelog<> $GITHUB_OUTPUT - echo "$CHANGELOG" >> $GITHUB_OUTPUT - echo "EOF" >> $GITHUB_OUTPUT - fi - - - name: Create GitHub Release - uses: softprops/action-gh-release@v1 - with: - body: | - ## Changes - - ${{ steps.changelog.outputs.changelog }} - - ## Docker Image - - ```bash - docker pull ghcr.io/${{ github.repository }}:${{ github.ref_name }} - ``` - - ## Installation - - See [README.md](https://github.com/${{ github.repository }}/blob/${{ github.ref_name }}/README.md) for installation instructions. - files: | - bedolaga-cabinet-${{ github.ref_name }}.tar.gz - bedolaga-cabinet-${{ github.ref_name }}.zip - draft: false - prerelease: ${{ contains(github.ref_name, 'beta') || contains(github.ref_name, 'alpha') || contains(github.ref_name, 'rc') }} diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml deleted file mode 100644 index 82d0bda..0000000 --- a/.github/workflows/security-audit.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Security Audit - -on: - push: - branches: [main, dev] - pull_request: - branches: [main, dev] - schedule: - - cron: "27 4 * * 1" - -permissions: - contents: read - -jobs: - npm-audit: - name: npm audit - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: "20" - cache: "npm" - - - name: Install dependencies - run: npm ci - - # Пока non-blocking: сообщаем о HIGH/CRITICAL, но не валим пайплайн. - # Когда долги по зависимостям разгребём — убрать continue-on-error. - - name: Run npm audit (high+) - continue-on-error: true - run: npm audit --audit-level=high