ci(gitea): shared composite actions + pipeline generator for Gitea Actions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AqpXh3hQMMaC74pTjFq4it

Gitea 1.25 cannot run reusable workflows (workflow_call), so the logic of
deploy-app.yml, smoke.yml and ci.yml moves into composite actions under
.gitea/actions/, and each repo gets a thin pipeline rendered by
tools/gitea-pipeline/render.py from repos.json. .github/workflows is left
untouched (Gitea ignores it once .gitea/workflows exists).

.gitea/actions/audit-direct-push/action.yml

@@ -0,0 +1,57 @@
+name: Audit - direct push to main
+description: >-
+  Tripwire (Gitea port of main-push-audit.yml): if the pushed commit is not tied
+  to a merged pull request, open an issue labelled policy-violation + audit.
+  Never blocks the push. Uses Gitea's /commits/{sha}/pull API.
+inputs:
+  token:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Check commit came from a merged PR
+      shell: bash
+      env:
+        TOKEN: ${{ inputs.token }}
+        PUSHER: ${{ github.event.pusher.username || github.event.pusher.login || github.actor }}
+        HEAD_MSG: ${{ github.event.head_commit.message }}
+      run: |
+        set -euo pipefail
+        API="$GITHUB_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY"
+        H="Authorization: token $TOKEN"
+        SHA="$GITHUB_SHA"; S7="${SHA:0:7}"
+        for attempt in 1 2 3 4 5; do
+          code=$(curl -s -o pr.json -w '%{http_code}' -H "$H" "$API/commits/$SHA/pull" || echo 000)
+          if [ "$code" = 200 ] && python3 -c 'import json,sys; sys.exit(0 if json.load(open("pr.json")).get("merged") else 1)'; then
+            echo "OK: commit $S7 came from PR #$(python3 -c 'import json;print(json.load(open("pr.json"))["number"])')"
+            exit 0
+          fi
+          [ "$attempt" -lt 5 ] && sleep 10
+        done
+        # Ensure both labels exist, collect their ids.
+        ids=()
+        for L in policy-violation audit; do
+          id=$(curl -s -H "$H" "$API/labels?limit=100" | python3 -c "import json,sys; print(next((str(l['id']) for l in json.load(sys.stdin) if l['name']=='$L'),''))")
+          if [ -z "$id" ]; then
+            color=$([ "$L" = audit ] && echo '#1d76db' || echo '#d93f0b')
+            id=$(curl -s -H "$H" -H 'Content-Type: application/json' -X POST "$API/labels" \
+              -d "{\"name\":\"$L\",\"color\":\"$color\"}" | python3 -c 'import json,sys;print(json.load(sys.stdin).get("id",""))')
+          fi
+          [ -n "$id" ] && ids+=("$id")
+        done
+        MSG=$(printf '%s' "$HEAD_MSG" | head -1)
+        python3 - "$S7" "${MSG:-(no message)}" "$PUSHER" "${ids[@]}" > issue.json <<'PY'
+        import json, os, sys
+        s7, msg, pusher, *ids = sys.argv[1:]
+        run = f"{os.environ['GITHUB_SERVER_URL']}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{os.environ.get('GITHUB_RUN_NUMBER','')}"
+        body = "\n".join([
+          "**Direct push to `main` detected** - commit was not associated with a merged PR.", "",
+          f"- Commit: `{s7}` - {msg}", f"- Pusher: @{pusher}", f"- Workflow run: {run}", "",
+          "The project policy is that all changes to `main` go through a pull request so they can be "
+          "reviewed before deploying to production. If this push was intentional (hotfix, infra change) "
+          "close this issue with a comment explaining why.", "",
+          "_Opened automatically by the audit-direct-push action (peptide-e2e)._"])
+        print(json.dumps({"title": f"Direct push to main: {s7}", "body": body, "labels": [int(i) for i in ids]}))
+        PY
+        code=$(curl -s -o /dev/null -w '%{http_code}' -H "$H" -H 'Content-Type: application/json' -X POST "$API/issues" --data-binary @issue.json)
+        echo "::warning::Opened audit issue for direct push $S7 (HTTP $code)"

.gitea/actions/ci-file-size/action.yml

@@ -0,0 +1,30 @@
+name: CI - 300-line rule
+description: Fail if any tracked *.php under the given paths exceeds 300 lines (estate hard rule).
+inputs:
+  paths:
+    required: false
+    default: includes
+runs:
+  using: composite
+  steps:
+    - name: Check for PHP files over 300 lines
+      shell: bash
+      env:
+        PATHS: ${{ inputs.paths }}
+      run: |
+        set -e
+        OFFENDERS=""
+        for DIR in $PATHS; do
+          if [ ! -e "$DIR" ]; then echo "Warning: path '$DIR' does not exist - skipping."; continue; fi
+          while IFS= read -r FILE; do
+            [ -z "$FILE" ] && continue
+            LINES=$(wc -l < "$FILE")
+            if [ "$LINES" -gt 300 ]; then OFFENDERS="${OFFENDERS}${LINES} lines: ${FILE}\n"; fi
+          done < <(git ls-files -- "$DIR" | grep '\.php$' || true)
+        done
+        if [ -n "$OFFENDERS" ]; then
+          echo "::error::Files exceeding 300-line limit (estate hard rule):"
+          printf "%b" "$OFFENDERS"
+          exit 1
+        fi
+        echo "All tracked PHP files under '$PATHS' are within the 300-line limit."

.gitea/actions/ci-lint-js/action.yml

@@ -0,0 +1,33 @@
+name: CI - JS lint
+description: >-
+  npm run lint if the repo declares it, else node --check on every *.js
+  (Gitea port of lint-js). Node 22: the GitHub job used Node 20, which is
+  end-of-life.
+runs:
+  using: composite
+  steps:
+    - name: Setup Node
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+        cache: npm
+
+    - name: Install npm dependencies
+      shell: bash
+      run: npm ci
+
+    - name: Lint JavaScript
+      shell: bash
+      run: |
+        if node -e "process.exit(require('./package.json').scripts?.lint ? 0 : 1)" 2>/dev/null; then
+          echo "npm run lint script found - running it."
+          npm run lint
+        else
+          echo "No 'lint' npm script - running node --check syntax scan."
+          find . -name '*.js' \
+            -not -path './vendor/*' \
+            -not -path './node_modules/*' \
+            -not -path './.git/*' \
+            -not -path './.peptide-e2e/*' \
+            -print0 | xargs -0 -r -I{} node --check {}
+        fi

.gitea/actions/ci-lint-php/action.yml

@@ -0,0 +1,24 @@
+name: CI - PHP lint
+description: PHP syntax check (Gitea port of the lint-php job in the reusable ci.yml).
+inputs:
+  php:
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Setup PHP ${{ inputs.php }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php }}
+        coverage: none
+    - name: Syntax check all PHP files
+      shell: bash
+      run: |
+        set -e
+        find . -name '*.php' \
+          -not -path './vendor/*' \
+          -not -path './node_modules/*' \
+          -not -path './.git/*' \
+          -not -path './.github/*' \
+          -not -path './.gitea/*' \
+          -print0 | xargs -0 -r -n1 -P4 php -l > /dev/null

.gitea/actions/ci-phpcs/action.yml

@@ -0,0 +1,65 @@
+name: CI - PHPCS
+description: >-
+  WordPress Coding Standards (Gitea port of the phpcs job). On pull_request with
+  autofix enabled, runs phpcbf and pushes fixes back to the PR branch; the caller
+  must check out the PR head ref with a token that can push.
+inputs:
+  autofix:
+    required: false
+    default: 'true'
+runs:
+  using: composite
+  steps:
+    - name: Setup PHP
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: '8.1'
+        coverage: none
+        tools: composer:v2, phpcs
+
+    - name: Install WordPress Coding Standards
+      shell: bash
+      run: |
+        composer global config --no-plugins \
+          allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
+        composer global require --no-interaction \
+          "dealerdirect/phpcodesniffer-composer-installer:^1.0" \
+          "wp-coding-standards/wpcs:^3.0" \
+          "phpcsstandards/phpcsutils:^1.0" \
+          "phpcsstandards/phpcsextra:^1.0"
+
+    - name: Auto-fix with phpcbf (PR only, commit back if changed)
+      if: ${{ github.event_name == 'pull_request' && inputs.autofix == 'true' }}
+      shell: bash
+      run: |
+        PHPCS_CONFIG=""
+        if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+        elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+        elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+        fi
+        if [ -z "$PHPCS_CONFIG" ]; then echo "No phpcs config - phpcbf skipped."; exit 0; fi
+        phpcbf --standard="$PHPCS_CONFIG" --extensions=php \
+          --ignore=vendor/*,tests/*,node_modules/* . || true
+        if ! git diff --quiet; then
+          git config user.name "peptiderepo-ops"
+          git config user.email "ops@peptiderepo.com"
+          git add -A
+          git commit -m "style: auto-fix PHPCS violations via phpcbf"
+          git push
+        fi
+
+    - name: Run PHPCS strict (fail on remaining violations)
+      shell: bash
+      run: |
+        PHPCS_CONFIG=""
+        if [ -f phpcs.xml ]; then PHPCS_CONFIG="phpcs.xml"
+        elif [ -f phpcs.xml.dist ]; then PHPCS_CONFIG="phpcs.xml.dist"
+        elif [ -f .phpcs.xml.dist ]; then PHPCS_CONFIG=".phpcs.xml.dist"
+        fi
+        if [ -z "$PHPCS_CONFIG" ]; then
+          echo "No phpcs.xml / phpcs.xml.dist / .phpcs.xml.dist found - PHPCS skipped."
+          exit 0
+        fi
+        phpcs --standard="$PHPCS_CONFIG" --extensions=php \
+          --ignore=vendor/*,tests/*,node_modules/* \
+          --warning-severity=0 --report=full .

.gitea/actions/ci-phpunit/action.yml

@@ -0,0 +1,65 @@
+name: CI - PHPUnit
+description: >-
+  composer test for one PHP version (Gitea port of the phpunit job). For
+  tests=wp-framework the caller declares a `mysql` service; on Gitea runners it is
+  reached by its service name, not 127.0.0.1 as on GitHub VMs.
+inputs:
+  php:
+    required: true
+  tests:
+    description: "stubs | brain-monkey | wp-framework"
+    required: false
+    default: stubs
+  db_host:
+    required: false
+    default: mysql
+runs:
+  using: composite
+  steps:
+    - name: Install subversion (wp-framework only)
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      run: command -v svn >/dev/null || (sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends subversion)
+
+    - name: Setup PHP ${{ inputs.php }}
+      uses: shivammathur/setup-php@v2
+      with:
+        php-version: ${{ inputs.php }}
+        coverage: none
+        tools: composer:v2
+        extensions: ${{ inputs.tests == 'wp-framework' && 'mysqli' || '' }}
+
+    - name: Install Composer dependencies
+      shell: bash
+      run: composer install --no-progress --no-interaction --prefer-dist
+
+    - name: Wait for MySQL (wp-framework only)
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      env:
+        DB_HOST: ${{ inputs.db_host }}
+      run: |
+        for i in $(seq 1 30); do
+          if (exec 3<>/dev/tcp/$DB_HOST/3306) 2>/dev/null; then echo "MySQL is up"; exit 0; fi
+          echo "Waiting for MySQL... ($i/30)"; sleep 2
+        done
+        echo "::error::MySQL at $DB_HOST:3306 never came up"; exit 1
+
+    - name: Install WordPress test suite (wp-framework only)
+      # skip-db-create=true: the service already created wp_tests.
+      # WP_CORE_DIR must end with a slash (concatenated verbatim into ABSPATH).
+      if: ${{ inputs.tests == 'wp-framework' }}
+      shell: bash
+      env:
+        WP_TESTS_DIR: /tmp/wordpress-tests-lib
+        WP_CORE_DIR: /tmp/wordpress/
+        DB_HOST: ${{ inputs.db_host }}
+      run: |
+        chmod +x bin/install-wp-tests.sh
+        bin/install-wp-tests.sh wp_tests root root "$DB_HOST:3306" latest true
+
+    - name: Run PHPUnit
+      shell: bash
+      env:
+        WP_TESTS_DIR: /tmp/wordpress-tests-lib
+      run: composer test

.gitea/actions/deploy/action.yml

@@ -0,0 +1,100 @@
+name: Deploy to Hostinger
+description: >-
+  rsync one plugin/theme to staging or production on Hostinger. Gitea port of the
+  GitHub reusable deploy-app.yml (Gitea 1.25 has no workflow_call): same rsync
+  excludes, retry-on-throttle (Hostinger rate-limits runner IPs), best-effort
+  plugin-inventory guard and health check. New: records the deployed commit in
+  ~/.peptide-deploys/<stage>/<target> (outside public_html) for deploy-health.
+
+inputs:
+  stage:
+    description: "staging | production"
+    required: true
+  target_path:
+    description: "wp-content subpath, e.g. wp-content/plugins/prautoblogger"
+    required: true
+  ssh_private_key:
+    required: true
+  ssh_host:
+    required: true
+  ssh_port:
+    required: true
+  ssh_username:
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: rsync to ${{ inputs.stage }} (retry-on-throttle + inventory guard)
+      shell: bash
+      env:
+        STAGE: ${{ inputs.stage }}
+        TARGET_PATH: ${{ inputs.target_path }}
+        SSH_PRIVATE_KEY: ${{ inputs.ssh_private_key }}
+        SSH_HOST: ${{ inputs.ssh_host }}
+        SSH_PORT: ${{ inputs.ssh_port }}
+        SSH_USERNAME: ${{ inputs.ssh_username }}
+      run: |
+        set -euo pipefail
+        case "$STAGE" in staging|production) ;; *) echo "::error::stage must be staging or production"; exit 1 ;; esac
+        case "$TARGET_PATH" in
+          *..*) echo "::error::'..' not allowed in target_path"; exit 1 ;;
+          wp-content/plugins/?*|wp-content/themes/?*|wp-content/mu-plugins/?*) ;;
+          *) echo "::error::refusing target_path '$TARGET_PATH'"; exit 1 ;;
+        esac
+        WORK=$(mktemp -d); trap 'rm -rf "$WORK"' EXIT
+        printf '%s\n' "$SSH_PRIVATE_KEY" > "$WORK/key"; chmod 600 "$WORK/key"
+        ssh-keyscan -p "$SSH_PORT" "$SSH_HOST" > "$WORK/known_hosts" 2>/dev/null || true
+        SSHOPT="-i $WORK/key -p $SSH_PORT -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$WORK/known_hosts -o ConnectTimeout=30 -o BatchMode=yes"
+        R="$SSH_USERNAME@$SSH_HOST"
+        BASE="/home/$SSH_USERNAME/domains/peptiderepo.com/public_html"
+        if [ "$STAGE" = staging ]; then DEST="$BASE/staging/$TARGET_PATH"; else DEST="$BASE/$TARGET_PATH"; fi
+
+        PRE=0
+        if [ "$STAGE" = production ]; then
+          PRE=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l" 2>/dev/null || echo 0)
+          echo "Pre-deploy active plugins (best-effort): $PRE"
+        fi
+
+        n=0
+        until [ "$n" -ge 4 ]; do
+          rsync -avz --delete \
+            --exclude '.git' --exclude '.github' --exclude '.gitea' --exclude 'tests' --exclude 'node_modules' \
+            --exclude 'vendor' --exclude 'composer.json' --exclude 'composer.lock' \
+            --exclude 'phpunit.xml' --exclude 'phpunit.xml.dist' --exclude 'phpcs.xml.dist' \
+            --exclude '.phpcs.xml.dist' --exclude 'ARCHITECTURE.md' --exclude 'CONVENTIONS.md' \
+            --exclude 'CHANGELOG.md' --exclude 'qa-reviews' \
+            -e "ssh $SSHOPT" \
+            ./ "$R:$DEST/" && break
+          n=$((n+1)); echo "$STAGE rsync failed (attempt $n/4) - Hostinger may be throttling runner IPs; retrying in 25s..."; sleep 25
+        done
+        [ "$n" -lt 4 ] || { echo "::error::$STAGE rsync failed after 4 attempts"; exit 1; }
+
+        if [ "$STAGE" = production ]; then
+          # Same remote command as the GitHub pipeline (the litespeed purge there runs
+          # relative to $HOME, i.e. is effectively a no-op; kept as-is, see port notes).
+          POST=$(ssh -n $SSHOPT "$R" "wp --path=$BASE plugin list --status=active --field=name 2>/dev/null | wc -l; find wp-content/litespeed/ -type f -delete 2>/dev/null; touch .lscache_purge 2>/dev/null || true" 2>/dev/null | head -1 || echo 0)
+          echo "Post-deploy active plugins (best-effort): $POST"
+          if [ "${PRE:-0}" -gt 0 ] && [ "${POST:-0}" -gt 0 ] && [ "${POST:-0}" -lt "${PRE:-0}" ]; then
+            echo "::error::active plugin count dropped ${PRE} -> ${POST} after deploy"; exit 1
+          fi
+        fi
+
+        SLUG=$(printf '%s' "$TARGET_PATH" | tr '/' '_')
+        ssh -n $SSHOPT "$R" "mkdir -p ~/.peptide-deploys/$STAGE && printf '%s %s %s\n' '$GITHUB_SHA' '$GITHUB_REPOSITORY' \"\$(date -u +%FT%TZ)\" > ~/.peptide-deploys/$STAGE/$SLUG" \
+          || echo "::warning::could not record deployed commit for deploy-health"
+        echo "Deployed ${GITHUB_SHA:0:7} to $STAGE:$TARGET_PATH"
+
+    - name: Health check (${{ inputs.stage }})
+      shell: bash
+      env:
+        STAGE: ${{ inputs.stage }}
+      run: |
+        sleep 5
+        if [ "$STAGE" = staging ]; then
+          echo "Staging responded: HTTP $(curl -s -o /dev/null -w '%{http_code}' https://staging.peptiderepo.com/ || echo 000)"
+          exit 0
+        fi
+        S=$(curl -s -o /dev/null -w '%{http_code}' https://peptiderepo.com)
+        if [ "$S" != "200" ] && [ "$S" != "403" ]; then echo "::error::site returned HTTP $S"; exit 1; fi
+        echo "Production healthy (HTTP $S)"

.gitea/actions/smoke/action.yml

@@ -0,0 +1,70 @@
+name: Smoke tests (staging)
+description: >-
+  Playwright smoke suite from peptide-e2e against staging. Gitea port of
+  smoke.yml. Checks peptide-e2e out into .peptide-e2e so it never clobbers the
+  caller's checkout. Uses upload-artifact@v3 (Gitea does not support v4).
+
+inputs:
+  base_url:
+    required: false
+    default: https://staging.peptiderepo.com
+  wp_admin_user:
+    required: true
+  wp_admin_password:
+    required: true
+  e2e_ref:
+    required: false
+    default: main
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout peptide-e2e
+      uses: actions/checkout@v4
+      with:
+        repository: peptide-repo/peptide-e2e
+        ref: ${{ inputs.e2e_ref }}
+        path: .peptide-e2e
+
+    - name: Set up Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '22'
+        cache: npm
+        cache-dependency-path: .peptide-e2e/package-lock.json
+
+    - name: Install dependencies
+      shell: bash
+      working-directory: .peptide-e2e
+      run: npm ci
+
+    - name: Install Playwright browsers
+      # OS deps are pre-installed on the runner host; --with-deps needs sudo.
+      shell: bash
+      working-directory: .peptide-e2e
+      run: npx playwright install chromium
+
+    - name: Run smoke tests
+      shell: bash
+      working-directory: .peptide-e2e
+      env:
+        BASE_URL: ${{ inputs.base_url }}
+        WP_ADMIN_USER: ${{ inputs.wp_admin_user }}
+        WP_ADMIN_PASSWORD: ${{ inputs.wp_admin_password }}
+      run: npx playwright test
+
+    - name: Upload test report
+      if: always()
+      uses: actions/upload-artifact@v3
+      with:
+        name: playwright-report
+        path: .peptide-e2e/playwright-report/
+        retention-days: 14
+
+    - name: Upload failure screenshots/videos
+      if: failure()
+      uses: actions/upload-artifact@v3
+      with:
+        name: playwright-failures
+        path: .peptide-e2e/test-results/
+        retention-days: 7