ci(gitea): shared composite actions + pipeline generator for Gitea Actions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqpXh3hQMMaC74pTjFq4it

Gitea 1.25 cannot run reusable workflows (workflow_call), so the logic of
deploy-app.yml, smoke.yml and ci.yml moves into composite actions under
.gitea/actions/, and each repo gets a thin pipeline rendered by
tools/gitea-pipeline/render.py from repos.json. .github/workflows is left
untouched (Gitea ignores it once .gitea/workflows exists).

.gitea/actions/audit-direct-push/action.yml

@@ -0,0 +1,57 @@
+name: Audit - direct push to main
+description: >-
+  Tripwire (Gitea port of main-push-audit.yml): if the pushed commit is not tied
+  to a merged pull request, open an issue labelled policy-violation + audit.
+  Never blocks the push. Uses Gitea's /commits/{sha}/pull API.
+inputs:
+  token:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Check commit came from a merged PR
+      shell: bash
+      env:
+        TOKEN: ${{ inputs.token }}
+        PUSHER: ${{ github.event.pusher.username || github.event.pusher.login || github.actor }}
+        HEAD_MSG: ${{ github.event.head_commit.message }}
+      run: |
+        set -euo pipefail
+        API="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
+        H="Authorization: token $TOKEN"
+        SHA="$GITHUB_SHA"; S7="${SHA:0:7}"
+        for attempt in 1 2 3 4 5; do
+          code=$(curl -s -o pr.json -w '%{http_code}' -H "$H" "$API/commits/$SHA/pull" || echo 000)
+          if [ "$code" = 200 ] && python3 -c 'import json,sys; sys.exit(0 if json.load(open("pr.json")).get("merged") else 1)'; then
+            echo "OK: commit $S7 came from PR #$(python3 -c 'import json;print(json.load(open("pr.json"))["number"])')"
+            exit 0
+          fi
+          [ "$attempt" -lt 5 ] && sleep 10
+        done
+        # Ensure both labels exist, collect their ids.
+        ids=()
+        for L in policy-violation audit; do
+          id=$(curl -s -H "$H" "$API/labels?limit=100" | python3 -c "import json,sys; print(next((str(l['id']) for l in json.load(sys.stdin) if l['name']=='$L'),''))")
+          if [ -z "$id" ]; then
+            color=$([ "$L" = audit ] && echo '#1d76db' || echo '#d93f0b')
+            id=$(curl -s -H "$H" -H 'Content-Type: application/json' -X POST "$API/labels" \
+              -d "{\"name\":\"$L\",\"color\":\"$color\"}" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))')
+          fi
+          [ -n "$id" ] && ids+=("$id")
+        done
+        MSG=$(printf '%s' "$HEAD_MSG" | head -1)
+        python3 - "$S7" "${MSG:-(no message)}" "$PUSHER" "${ids[@]}" > issue.json <<'PY'
+        import json, os, sys
+        s7, msg, pusher, *ids = sys.argv[1:]
+        run = f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ.get('GITHUB_RUN_NUMBER','')}"
+        body = "\n".join([
+          "**Direct push to `main` detected** - commit was not associated with a merged PR.", "",
+          f"- Commit: `{s7}` - {msg}", f"- Pusher: @{pusher}", f"- Workflow run: {run}", "",
+          "The project policy is that all changes to `main` go through a pull request so they can be "
+          "reviewed before deploying to production. If this push was intentional (hotfix, infra change) "
+          "close this issue with a comment explaining why.", "",
+          "_Opened automatically by the audit-direct-push action (peptide-e2e)._"])
+        print(json.dumps({"title": f"Direct push to main: {s7}", "body": body, "labels": [int(i) for i in ids]}))
+        PY
+        code=$(curl -s -o /dev/null -w '%{http_code}' -H "$H" -H 'Content-Type: application/json' -X POST "$API/issues" --data-binary @issue.json)
+        echo "::warning::Opened audit issue for direct push $S7 (HTTP $code)"

.gitea/actions/ci-file-size/action.yml

@@ -0,0 +1,30 @@
+name: CI - 300-line rule
+description: Fail if any tracked *.php under the given paths exceeds 300 lines (estate hard rule).
+inputs:
+  paths:
+    required: false
+    default: includes
+runs:
+  using: composite
+  steps:
+    - name: Check for PHP files over 300 lines
+      shell: bash
+      env:
+        PATHS: ${{ inputs.paths }}
+      run: |
+        set -e
+        OFFENDERS=""
+        for DIR in $PATHS; do
+          if [ ! -e "$DIR" ]; then echo "Warning: path '$DIR' does not exist - skipping."; continue; fi
+          while IFS= read -r FILE; do
+            [ -z "$FILE" ] && continue
+            LINES=$(wc -l < "$FILE")
+            if [ "$LINES" -gt 300 ]; then OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"; fi
+          done < <(git ls-files -- "$DIR" | grep '\.php$' || true)
+        done
+        if [ -n "$OFFENDERS" ]; then
+          echo "::error::Files exceeding 300-line limit (estate hard rule):"
+          printf "%b" "$OFFENDERS"
+          exit 1
+        fi
+        echo "All tracked PHP files under '$PATHS' are within the 300-line limit."

.gitea/actions/ci-lint-js/action.yml

@@ -0,0 +1,33 @@
+name: CI - JS lint
+description: >-
+  npm run lint if the repo declares it, else node --check on every *.js
+  (Gitea port of lint-js). Node 22: the GitHub job used Node 20, which is
+  end-of-life.
+runs:
+  using: composite
+  steps:
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+        cache: npm
+
+    - name: Install npm dependencies
+      shell: bash
+      run: npm ci
+
+    - name: Lint JavaScript
+      shell: bash
+      run: |
+        if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
+          echo "npm run lint script found - running it."
+          npm run lint
+        else
+          echo "No 'lint' npm script - running node --check syntax scan."
+          find . -name '*.js' \
+            -not -path './vendor/*' \
+            -not -path './node_modules/*' \
+            -not -path './.git/*' \
+            -not -path './.peptide-e2e/*' \
+            -print0 | xargs -0 -r -I{} node --check {}
+        fi

.gitea/actions/ci-lint-php/action.yml

@@ -0,0 +1,24 @@
+name: CI - PHP lint
+description: PHP syntax check (Gitea port of the lint-php job in the reusable ci.yml).
+inputs:
+  php:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Setup PHP ${{ inputs.php }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php }}
+        coverage: none
+    - name: Syntax check all PHP files
+      shell: bash
+      run: |
+        set -e
+        find . -name '*.php' \
+          -not -path './vendor/*' \
+          -not -path './node_modules/*' \
+          -not -path './.git/*' \
+          -not -path './.github/*' \
+          -not -path './.gitea/*' \
+          -print0 | xargs -0 -r -n1 -P4 php -l > /dev/null

.gitea/actions/ci-phpcs/action.yml

@@ -0,0 +1,65 @@
+name: CI - PHPCS
+description: >-
+  WordPress Coding Standards (Gitea port of the phpcs job). On pull_request with
+  autofix enabled, runs phpcbf and pushes fixes back to the PR branch; the caller
+  must check out the PR head ref with a token that can push.
+inputs:
+  autofix:
+    required: false
+    default: 'true'
+runs:
+  using: composite
+  steps:
+    - name: Setup PHP
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: '8.1'
+        coverage: none
+        tools: composer:v2, phpcs
+
+    - name: Install WordPress Coding Standards
+      shell: bash
+      run: |
+        composer global config --no-plugins \
+          allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
+        composer global require --no-interaction \
+          "dealerdirect/phpcodesniffer-composer-installer:^1.0" \
+          "wp-coding-standards/wpcs:^3.0" \
+          "phpcsstandards/phpcsutils:^1.0" \
+          "phpcsstandards/phpcsextra:^1.0"
+
+    - name: Auto-fix with phpcbf (PR only, commit back if changed)
+      if: ${{ github.event_name == 'pull_request' && inputs.autofix == 'true' }}
+      shell: bash
+      run: |
+        PHPCS_CONFIG=""
+        if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+        elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+        elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+        fi
+        if [ -z "$PHPCS_CONFIG" ]; then echo "No phpcs config - phpcbf skipped."; exit 0; fi
+        phpcbf --standard="$PHPCS_CONFIG" --extensions=php \
+          --ignore=vendor/*,tests/*,node_modules/* . || true
+        if ! git diff --quiet; then
+          git config user.name "peptiderepo-ops"
+          git config user.email "ops@peptiderepo.com"
+          git add -A
+          git commit -m "style: auto-fix PHPCS violations via phpcbf"
+          git push
+        fi
+
+    - name: Run PHPCS strict (fail on remaining violations)
+      shell: bash
+      run: |
+        PHPCS_CONFIG=""
+        if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+        elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+        elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+        fi
+        if [ -z "$PHPCS_CONFIG" ]; then
+          echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found - PHPCS skipped."
+          exit 0
+        fi
+        phpcs --standard="$PHPCS_CONFIG" --extensions=php \
+          --ignore=vendor/*,tests/*,node_modules/* \
+          --warning-severity=0 --report=full .

.gitea/actions/ci-phpunit/action.yml

@@ -0,0 +1,65 @@
+name: CI - PHPUnit
+description: >-
+  composer test for one PHP version (Gitea port of the phpunit job). For
+  tests=wp-framework the caller declares a `mysql` service; on Gitea runners it is
+  reached by its service name, not 127.0.0.1 as on GitHub VMs.
+inputs:
+  php:
+    required: true
+  tests:
+    description: "stubs | brain-monkey | wp-framework"
+    required: false
+    default: stubs
+  db_host:
+    required: false
+    default: mysql
+runs:
+  using: composite
+  steps:
+    - name: Install subversion (wp-framework only)
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      run: command -v svn >/dev/null || (sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion)
+
+    - name: Setup PHP ${{ inputs.php }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php }}
+        coverage: none
+        tools: composer:v2
+        extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
+
+    - name: Install Composer dependencies
+      shell: bash
+      run: composer install --no-progress --no-interaction --prefer-dist
+
+    - name: Wait for MySQL (wp-framework only)
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      env:
+        DB_HOST: ${{ inputs.db_host }}
+      run: |
+        for i in $(seq 1 30); do
+          if (exec 3<>/dev/tcp/$DB_HOST/3306) 2>/dev/null; then echo "MySQL is up"; exit 0; fi
+          echo "Waiting for MySQL... ($i/30)"; sleep 2
+        done
+        echo "::error::MySQL at $DB_HOST:3306 never came up"; exit 1
+
+    - name: Install WordPress test suite (wp-framework only)
+      # skip-db-create=true: the service already created wp_tests.
+      # WP_CORE_DIR must end with a slash (concatenated verbatim into ABSPATH).
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      env:
+        WP_TESTS_DIR: /tmp/wordpress-tests-lib
+        WP_CORE_DIR: /tmp/wordpress/
+        DB_HOST: ${{ inputs.db_host }}
+      run: |
+        chmod +x bin/install-wp-tests.sh
+        bin/install-wp-tests.sh wp_tests root root "$DB_HOST:3306" latest true
+
+    - name: Run PHPUnit
+      shell: bash
+      env:
+        WP_TESTS_DIR: /tmp/wordpress-tests-lib
+      run: composer test

.gitea/actions/deploy/action.yml

@@ -0,0 +1,100 @@
+name: Deploy to Hostinger
+description: >-
+  rsync one plugin/theme to staging or production on Hostinger. Gitea port of the
+  GitHub reusable deploy-app.yml (Gitea 1.25 has no workflow_call): same rsync
+  excludes, retry-on-throttle (Hostinger rate-limits runner IPs), best-effort
+  plugin-inventory guard and health check. New: records the deployed commit in
+  ~/.peptide-deploys/<stage>/<target> (outside public_html) for deploy-health.
+
+inputs:
+  stage:
+    description: "staging | production"
+    required: true
+  target_path:
+    description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger"
+    required: true
+  ssh_private_key:
+    required: true
+  ssh_host:
+    required: true
+  ssh_port:
+    required: true
+  ssh_username:
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: rsync to ${{ inputs.stage }} (retry-on-throttle + inventory guard)
+      shell: bash
+      env:
+        STAGE: ${{ inputs.stage }}
+        TARGET_PATH: ${{ inputs.target_path }}
+        SSH_PRIVATE_KEY: ${{ inputs.ssh_private_key }}
+        SSH_HOST: ${{ inputs.ssh_host }}
+        SSH_PORT: ${{ inputs.ssh_port }}
+        SSH_USERNAME: ${{ inputs.ssh_username }}
+      run: |
+        set -euo pipefail
+        case "$STAGE" in staging|production) ;; *) echo "::error::stage must be staging or production"; exit 1 ;; esac
+        case "$TARGET_PATH" in
+          *..*) echo "::error::'..' not allowed in target_path"; exit 1 ;;
+          wp-content/plugins/?*|wp-content/themes/?*|wp-content/mu-plugins/?*) ;;
+          *) echo "::error::refusing target_path '$TARGET_PATH'"; exit 1 ;;
+        esac
+        WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+        printf '%s\n' "$SSH_PRIVATE_KEY" > "$WORK/key"; chmod 600 "$WORK/key"
+        ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > "$WORK/known_hosts" 2>/dev/null || true
+        SSHOPT="-i $WORK/key -p $SSH_PORT -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$WORK/known_hosts -o ConnectTimeout=30 -o BatchMode=yes"
+        R="$SSH_USERNAME@$SSH_HOST"
+        BASE="/home/$SSH_USERNAME/domains/peptiderepo.com/public_html"
+        if [ "$STAGE" = staging ]; then DEST="$BASE/staging/$TARGET_PATH"; else DEST="$BASE/$TARGET_PATH"; fi
+
+        PRE=0
+        if [ "$STAGE" = production ]; then
+          PRE=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" 2>/dev/null || echo 0)
+          echo "Pre-deploy active plugins (best-effort): $PRE"
+        fi
+
+        n=0
+        until [ "$n" -ge 4 ]; do
+          rsync -avz --delete \
+            --exclude '.git' --exclude '.github' --exclude '.gitea' --exclude 'tests' --exclude 'node_modules' \
+            --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
+            --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
+            --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
+            --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
+            -e "ssh $SSHOPT" \
+            ./ "$R:$DEST/" && break
+          n=$((n+1)); echo "$STAGE rsync failed (attempt $n/4) - Hostinger may be throttling runner IPs; retrying in 25s..."; sleep 25
+        done
+        [ "$n" -lt 4 ] || { echo "::error::$STAGE rsync failed after 4 attempts"; exit 1; }
+
+        if [ "$STAGE" = production ]; then
+          # Same remote command as the GitHub pipeline (the litespeed purge there runs
+          # relative to $HOME, i.e. is effectively a no-op; kept as-is, see port notes).
+          POST=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l; find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true" 2>/dev/null | head -1 || echo 0)
+          echo "Post-deploy active plugins (best-effort): $POST"
+          if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
+            echo "::error::active plugin count dropped ${PRE} -> ${POST} after deploy"; exit 1
+          fi
+        fi
+
+        SLUG=$(printf '%s' "$TARGET_PATH" | tr '/' '_')
+        ssh -n $SSHOPT "$R" "mkdir -p ~/.peptide-deploys/$STAGE && printf '%s %s %s\n' '$GITHUB_SHA' '$GITHUB_REPOSITORY' \"\$(date -u +%FT%TZ)\" > ~/.peptide-deploys/$STAGE/$SLUG" \
+          || echo "::warning::could not record deployed commit for deploy-health"
+        echo "Deployed ${GITHUB_SHA:0:7} to $STAGE:$TARGET_PATH"
+
+    - name: Health check (${{ inputs.stage }})
+      shell: bash
+      env:
+        STAGE: ${{ inputs.stage }}
+      run: |
+        sleep 5
+        if [ "$STAGE" = staging ]; then
+          echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
+          exit 0
+        fi
+        S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
+        if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "::error::site returned HTTP $S"; exit 1; fi
+        echo "Production healthy (HTTP $S)"

.gitea/actions/smoke/action.yml

@@ -0,0 +1,70 @@
+name: Smoke tests (staging)
+description: >-
+  Playwright smoke suite from peptide-e2e against staging. Gitea port of
+  smoke.yml. Checks peptide-e2e out into .peptide-e2e so it never clobbers the
+  caller's checkout. Uses upload-artifact@v3 (Gitea does not support v4).
+
+inputs:
+  base_url:
+    required: false
+    default: https://staging.peptiderepo.com
+  wp_admin_user:
+    required: true
+  wp_admin_password:
+    required: true
+  e2e_ref:
+    required: false
+    default: main
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout peptide-e2e
+      uses: actions/checkout@v4
+      with:
+        repository: peptide-repo/peptide-e2e
+        ref: ${{ inputs.e2e_ref }}
+        path: .peptide-e2e
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+        cache: npm
+        cache-dependency-path: .peptide-e2e/package-lock.json
+
+    - name: Install dependencies
+      shell: bash
+      working-directory: .peptide-e2e
+      run: npm ci
+
+    - name: Install Playwright browsers
+      # OS deps are pre-installed on the runner host; --with-deps needs sudo.
+      shell: bash
+      working-directory: .peptide-e2e
+      run: npx playwright install chromium
+
+    - name: Run smoke tests
+      shell: bash
+      working-directory: .peptide-e2e
+      env:
+        BASE_URL: ${{ inputs.base_url }}
+        WP_ADMIN_USER: ${{ inputs.wp_admin_user }}
+        WP_ADMIN_PASSWORD: ${{ inputs.wp_admin_password }}
+      run: npx playwright test
+
+    - name: Upload test report
+      if: always()
+      uses: actions/upload-artifact@v3
+      with:
+        name: playwright-report
+        path: .peptide-e2e/playwright-report/
+        retention-days: 14
+
+    - name: Upload failure screenshots/videos
+      if: failure()
+      uses: actions/upload-artifact@v3
+      with:
+        name: playwright-failures
+        path: .peptide-e2e/test-results/
+        retention-days: 7

.gitea/workflows/pipeline.yml

@@ -0,0 +1,39 @@
+# GENERATED by peptide-e2e/tools/gitea-pipeline/render.py from repos.json.
+# Do not edit by hand: change repos.json or the template and re-render.
+name: CI / Deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request: {}
+  workflow_dispatch: {}
+
+concurrency:
+  group: pipeline-peptide-e2e-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  lint-php:
+    name: PHP Lint (${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ["8.1", "8.2", "8.3"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/ci-lint-php@main
+        with:
+          php: ${{ matrix.php }}
+
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref || github.ref_name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions/ci-phpcs@main
+        with:
+          autofix: 'false'

tools/gitea-pipeline/render.py

@@ -0,0 +1,253 @@
+#!/usr/bin/env python3
+"""Render .gitea/workflows/pipeline.yml for a peptide-repo repository.
+
+Why this exists: Gitea 1.25 cannot run reusable workflows (workflow_call), so
+the shared CI/deploy logic lives in composite actions under .gitea/actions/ in
+peptide-e2e, and each repo gets a thin generated job graph that calls them.
+Edit repos.json or this template, never the generated files.
+
+usage: render.py <repo-name> [repos.json]   -> prints the workflow to stdout
+"""
+import json
+import sys
+
+A = "https://git.protopeer.com/peptide-repo/peptide-e2e/.gitea/actions"
+DEFAULTS = {"tests": "stubs", "has_js": False, "line_limit_paths": "includes",
+            "enforce_300": True, "phpcs_autofix": True, "audit": True,
+            "php_versions": ["8.1", "8.2", "8.3"], "extras": []}
+MAIN_PUSH = "github.event_name == 'push' && github.ref == 'refs/heads/main'"
+
+EXTRAS = {
+    "check-constants": """
+  check-constants:
+    name: Check PRAUTOBLOGGER_* constants
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.1'
+          coverage: none
+      # Fails if any PRAUTOBLOGGER_* constant referenced in shipped PHP is neither
+      # defined in prautoblogger.php nor guarded by defined() (v0.19.0 incident class).
+      - run: php scripts/check-constants.php
+      - name: Self-test the scanner
+        run: php scripts/check-constants.php --self-test
+""",
+    "validate-psa-version": """
+  validate:
+    name: Validate PSA_VERSION constant
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: |
+          if grep -q "define( 'PSA_VERSION'" peptide-search-ai.php; then
+            version=$(grep "define( 'PSA_VERSION'" peptide-search-ai.php | sed "s/.*'\\([^']*\\)'.*/\\1/")
+            echo "PSA_VERSION: $version"
+          else
+            echo "::error::PSA_VERSION not found"; exit 1
+          fi
+""",
+    "security-audit": """
+  security-audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check for common PHP security issues
+        shell: bash
+        run: |
+          echo ":: Checking for direct SQL queries without prepare..."
+          if grep -r "query\\s*(\\s*['\\"].*\\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null \\
+            | grep -v "\\$wpdb->prepare" \\
+            | grep -v "uninstall\\.php" \\
+            | grep -v "class-peptide-news-activator\\.php" \\
+            | grep -v "class-peptide-news-logger\\.php" \\
+            | grep -v "DROP TABLE" \\
+            | grep -v "TRUNCATE" \\
+            && [ ${PIPESTATUS[0]} -eq 0 ]; then
+            echo "WARNING: Found potential unescaped SQL queries. Use wpdb->prepare() for all dynamic SQL."
+            exit 1
+          fi
+          echo ":: Checking for eval() usage..."
+          if grep -r "eval\\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "ERROR: eval() found. This is a critical security risk."; exit 1
+          fi
+          echo ":: Checking for base64_decode without validation..."
+          if grep -r "base64_decode\\s*(" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "WARNING: Found base64_decode(). Ensure the input is properly validated."
+          fi
+          echo ":: Checking for file_get_contents with user input..."
+          if grep -r "file_get_contents\\s*(\\s*\\$" --include="*.php" --exclude-dir=vendor . 2>/dev/null; then
+            echo "WARNING: Found file_get_contents with variable. Ensure input is validated and restricted."
+          fi
+          echo "All security checks passed."
+""",
+}
+EXTRA_JOB_ID = {"check-constants": "check-constants", "validate-psa-version": "validate",
+                "security-audit": "security-audit"}
+
+
+def render(name, cfg):
+    c = {**DEFAULTS, **cfg}
+    php = json.dumps(c["php_versions"])
+    out = [f"""# GENERATED by peptide-e2e/tools/gitea-pipeline/render.py from repos.json.
+# Do not edit by hand: change repos.json or the template and re-render.
+name: CI / Deploy
+
+on:
+  push:
+    branches: [main]
+  pull_request: {{}}
+  workflow_dispatch: {{}}
+
+concurrency:
+  group: pipeline-{name}-${{{{ github.ref }}}}
+  cancel-in-progress: false
+
+jobs:
+  lint-php:
+    name: PHP Lint (${{{{ matrix.php }}}})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: {php}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-lint-php@main
+        with:
+          php: ${{{{ matrix.php }}}}
+
+  phpcs:
+    name: PHPCS (WordPress standards)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{{{ github.head_ref || github.ref_name }}}}
+          token: ${{{{ secrets.GITHUB_TOKEN }}}}
+      - uses: {A}/ci-phpcs@main
+        with:
+          autofix: '{str(c["phpcs_autofix"]).lower()}'
+"""]
+    ci_jobs = ["lint-php", "phpcs"]
+    if c["enforce_300"]:
+        out.append(f"""
+  file-size:
+    name: 300-line rule ({c["line_limit_paths"]})
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-file-size@main
+        with:
+          paths: {c["line_limit_paths"]}
+""")
+        ci_jobs.append("file-size")
+    if c["tests"] != "none":
+        svc = ""
+        if c["tests"] == "wp-framework":
+            svc = """    services:
+      mysql:
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: wp_tests
+        options: >-
+          --health-cmd="mysqladmin ping"
+          --health-interval=10s
+          --health-timeout=5s
+          --health-retries=5
+"""
+        out.append(f"""
+  phpunit:
+    name: PHPUnit - {c["tests"]} (PHP ${{{{ matrix.php }}}})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: {php}
+{svc}    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-phpunit@main
+        with:
+          php: ${{{{ matrix.php }}}}
+          tests: {c["tests"]}
+""")
+        ci_jobs.append("phpunit")
+    if c["has_js"]:
+        out.append(f"""
+  lint-js:
+    name: JS Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/ci-lint-js@main
+""")
+        ci_jobs.append("lint-js")
+    for x in c["extras"]:
+        out.append(EXTRAS[x])
+        ci_jobs.append(EXTRA_JOB_ID[x])
+    if c["target_path"]:
+        needs = json.dumps(ci_jobs)
+        deploy_with = f"""          target_path: {c["target_path"]}
+          ssh_private_key: ${{{{ secrets.SSH_PRIVATE_KEY }}}}
+          ssh_host: ${{{{ secrets.SSH_HOST }}}}
+          ssh_port: ${{{{ secrets.SSH_PORT }}}}
+          ssh_username: ${{{{ secrets.SSH_USERNAME }}}}"""
+        out.append(f"""
+  deploy-staging:
+    name: Deploy to staging
+    needs: {needs}
+    if: ${{{{ {MAIN_PUSH} }}}}
+    runs-on: peptide-vps
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/deploy@main
+        with:
+          stage: staging
+{deploy_with}
+
+  smoke:
+    name: Smoke tests (staging)
+    needs: deploy-staging
+    runs-on: peptide-vps
+    timeout-minutes: 15
+    steps:
+      - uses: {A}/smoke@main
+        with:
+          wp_admin_user: ${{{{ secrets.STAGING_WP_ADMIN_USER }}}}
+          wp_admin_password: ${{{{ secrets.STAGING_WP_ADMIN_PASSWORD }}}}
+
+  deploy-production:
+    name: Deploy to production
+    # Smoke is a gate: production runs only if staging deploy AND smoke succeeded.
+    # PROD_DEPLOY_ENABLED (org variable) is the cutover switch / kill switch.
+    needs: [deploy-staging, smoke]
+    if: ${{{{ vars.PROD_DEPLOY_ENABLED == 'true' && {MAIN_PUSH} }}}}
+    runs-on: peptide-vps
+    steps:
+      - uses: actions/checkout@v4
+      - uses: {A}/deploy@main
+        with:
+          stage: production
+{deploy_with}
+""")
+    if c["audit"]:
+        out.append(f"""
+  audit-direct-push:
+    name: Audit - commit came from a PR
+    if: ${{{{ {MAIN_PUSH} }}}}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: {A}/audit-direct-push@main
+        with:
+          token: ${{{{ secrets.GITHUB_TOKEN }}}}
+""")
+    return "".join(out)
+
+
+if __name__ == "__main__":
+    repos = json.load(open(sys.argv[2] if len(sys.argv) > 2 else __file__.rsplit("/", 1)[0] + "/repos.json"))
+    name = sys.argv[1]
+    sys.stdout.write(render(name, repos[name]))

tools/gitea-pipeline/repos.json

@@ -0,0 +1,11 @@
+{
+  "_comment": "Per-repo pipeline settings. Edit here, then run render.py and commit the generated .gitea/workflows/pipeline.yml in each repo. Values mirror each repo's former GitHub ci.yml / deploy.yml inputs.",
+  "peptide-repo-core":                {"target_path": "wp-content/plugins/peptide-repo-core",                "tests": "stubs"},
+  "prautoblogger":                    {"target_path": "wp-content/plugins/prautoblogger",                    "tests": "brain-monkey", "extras": ["check-constants"]},
+  "peptide-search-ai":                {"target_path": "wp-content/plugins/peptide-search-ai",                "tests": "stubs", "has_js": true, "extras": ["validate-psa-version"]},
+  "peptide-starter-theme":            {"target_path": "wp-content/themes/peptide-starter",                   "tests": "wp-framework", "has_js": true, "line_limit_paths": "inc"},
+  "pr-vision":                        {"target_path": "wp-content/plugins/pr-vision",                        "tests": "stubs"},
+  "peptide-news-plugin":              {"target_path": "wp-content/plugins/peptide-news-plugin",              "tests": "stubs", "has_js": true, "extras": ["security-audit"]},
+  "peptide-reconstitution-calculator":{"target_path": "wp-content/plugins/peptide-reconstitution-calculator","tests": "stubs", "has_js": true},
+  "peptide-e2e":                      {"target_path": null, "tests": "none", "enforce_300": false, "phpcs_autofix": false, "audit": false}
+}