Merge pull request 'fix: use metadata API for source-aware bumps instead of manifest.xml' (#32) from fix/metadata-api-source-check into main

Replaces manifest.xml file parsing with the MokoGitea /manifest API
endpoint which stores platform and entry_point as database fields.

Authored-by: Moko Consulting

.mokogitea/workflows/auto-bump.yml

@@ -41,9 +41,54 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
-          fetch-depth: 1
+          fetch-depth: 2
+
+      - name: Check for source changes
+        id: source-check
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          REPO="${{ github.repository }}"
+
+          # Fetch platform and entry_point from first-class repo metadata API
+          METADATA=$(curl -sf -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/manifest" 2>/dev/null || echo "{}")
+          PLATFORM=$(echo "$METADATA" | grep -oP '"platform"\s*:\s*"\K[^"]+' || true)
+          SOURCE_DIR=$(echo "$METADATA" | grep -oP '"entry_point"\s*:\s*"\K[^"]+' || true)
+
+          # Default source dirs by platform if entry_point not set
+          if [ -z "$SOURCE_DIR" ]; then
+            case "$PLATFORM" in
+              joomla)   SOURCE_DIR="src/ source/ htdocs/" ;;
+              dolibarr) SOURCE_DIR="src/ htdocs/" ;;
+              *)        SOURCE_DIR="" ;;
+            esac
+          fi
+
+          # If no platform or source dir, always bump (generic repos)
+          if [ -z "$SOURCE_DIR" ]; then
+            echo "has_source_changes=true" >> "$GITHUB_OUTPUT"
+            echo "No platform metadata — defaulting to bump"
+            exit 0
+          fi
+
+          # Check if the last commit touched any source files
+          CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || true)
+          HAS_CHANGES=false
+          for DIR in $SOURCE_DIR; do
+            DIR="${DIR%/}"
+            if echo "$CHANGED" | grep -q "^${DIR}/"; then
+              HAS_CHANGES=true
+              break
+            fi
+          done
+
+          echo "has_source_changes=$HAS_CHANGES" >> "$GITHUB_OUTPUT"
+          echo "Platform: ${PLATFORM:-generic}, Source: ${SOURCE_DIR}, Changes: ${HAS_CHANGES}"
 
       - name: Setup mokocli tools
+        if: steps.source-check.outputs.has_source_changes == 'true'
         run: |
           if ! command -v composer &> /dev/null; then
             sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
@@ -59,6 +104,7 @@ jobs:
           fi
 
       - name: Bump version
+        if: steps.source-check.outputs.has_source_changes == 'true'
         run: |
           php ${MOKO_CLI}/version_auto_bump.php \
             --path . --branch "${GITHUB_REF_NAME}" \

.mokogitea/workflows/pre-release.yml

@@ -55,11 +55,57 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          fetch-depth: 0
+          fetch-depth: 2
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           ref: ${{ github.ref_name }}
 
+      - name: Check for source changes
+        id: source-check
+        if: github.event_name == 'push'
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          REPO="${{ github.repository }}"
+
+          # Fetch platform and entry_point from first-class repo metadata API
+          METADATA=$(curl -sf -H "Authorization: token ${MOKOGITEA_TOKEN}" \
+            "${GITEA_URL}/api/v1/repos/${REPO}/manifest" 2>/dev/null || echo "{}")
+          PLATFORM=$(echo "$METADATA" | grep -oP '"platform"\s*:\s*"\K[^"]+' || true)
+          SOURCE_DIR=$(echo "$METADATA" | grep -oP '"entry_point"\s*:\s*"\K[^"]+' || true)
+
+          # Default source dirs by platform if entry_point not set
+          if [ -z "$SOURCE_DIR" ]; then
+            case "$PLATFORM" in
+              joomla)   SOURCE_DIR="src/ source/ htdocs/" ;;
+              dolibarr) SOURCE_DIR="src/ htdocs/" ;;
+              *)        SOURCE_DIR="" ;;
+            esac
+          fi
+
+          # If no platform or source dir, always build (generic repos)
+          if [ -z "$SOURCE_DIR" ]; then
+            echo "has_source_changes=true" >> "$GITHUB_OUTPUT"
+            echo "No platform metadata — defaulting to build"
+            exit 0
+          fi
+
+          # Check if the last commit touched any source files
+          CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || true)
+          HAS_CHANGES=false
+          for DIR in $SOURCE_DIR; do
+            DIR="${DIR%/}"
+            if echo "$CHANGED" | grep -q "^${DIR}/"; then
+              HAS_CHANGES=true
+              break
+            fi
+          done
+
+          echo "has_source_changes=$HAS_CHANGES" >> "$GITHUB_OUTPUT"
+          echo "Platform: ${PLATFORM:-generic}, Source: ${SOURCE_DIR}, Changes: ${HAS_CHANGES}"
+
       - name: Setup mokocli tools
+        if: github.event_name == 'workflow_dispatch' || steps.source-check.outputs.has_source_changes == 'true'
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
@@ -81,6 +127,7 @@ jobs:
           fi
 
       - name: Detect platform
+        if: github.event_name == 'workflow_dispatch' || steps.source-check.outputs.has_source_changes == 'true'
         id: platform
         run: |
           # Auto-detect and update platform if not set in manifest
@@ -88,6 +135,7 @@ jobs:
           php ${MOKO_CLI}/manifest_read.php --path . --github-output
 
       - name: Resolve metadata and bump version
+        if: github.event_name == 'workflow_dispatch' || steps.source-check.outputs.has_source_changes == 'true'
         id: meta
         run: |
           # Auto-detect stability from branch name on push, or use input on dispatch
@@ -164,6 +212,7 @@ jobs:
           echo "=== Pre-Release: ${EXT_ELEMENT} ${VERSION}${SUFFIX} ==="
 
       - name: Create release
+        if: github.event_name == 'workflow_dispatch' || steps.source-check.outputs.has_source_changes == 'true'
         id: release
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
@@ -175,6 +224,7 @@ jobs:
             --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
 
       - name: Update release notes from CHANGELOG.md
+        if: github.event_name == 'workflow_dispatch' || steps.source-check.outputs.has_source_changes == 'true'
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
@@ -210,6 +260,7 @@ jobs:
           fi
 
       - name: Build package and upload
+        if: github.event_name == 'workflow_dispatch' || steps.source-check.outputs.has_source_changes == 'true'
         id: package
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
@@ -224,6 +275,7 @@ jobs:
       # No need to build, commit, or sync updates.xml from workflows
 
       - name: "Delete lesser pre-release channels (cascade)"
+        if: github.event_name == 'workflow_dispatch' || steps.source-check.outputs.has_source_changes == 'true'
         continue-on-error: true
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"

.mokogitea/workflows/security-audit.yml

@@ -1,82 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.gitea/workflows/security-audit.yml
-# VERSION: 01.00.00
-# BRIEF: Dependency vulnerability scanning for composer and npm packages
-
-name: "Universal: Security Audit"
-
-on:
-  schedule:
-    - cron: '0 6 * * 1'  # Weekly on Monday at 06:00 UTC
-  pull_request:
-    branches:
-      - main
-    paths:
-      - 'composer.json'
-      - 'composer.lock'
-      - 'package.json'
-      - 'package-lock.json'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-security' }}
-
-jobs:
-  audit:
-    name: Dependency Audit
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Composer audit
-        if: hashFiles('composer.lock') != ''
-        run: |
-          echo "=== Composer Security Audit ==="
-          if ! command -v composer &> /dev/null; then
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq php-cli composer >/dev/null 2>&1
-          fi
-          composer audit --format=plain 2>&1 | tee /tmp/composer-audit.txt
-          RESULT=$?
-          if [ $RESULT -ne 0 ]; then
-            echo "::warning::Composer vulnerabilities found"
-            echo "composer_vulnerable=true" >> "$GITHUB_ENV"
-          else
-            echo "No known vulnerabilities in composer dependencies"
-          fi
-
-      - name: NPM audit
-        if: hashFiles('package-lock.json') != ''
-        run: |
-          echo "=== NPM Security Audit ==="
-          npm audit --production 2>&1 | tee /tmp/npm-audit.txt || true
-          if npm audit --production 2>&1 | grep -q "found 0 vulnerabilities"; then
-            echo "No known vulnerabilities in npm dependencies"
-          else
-            echo "::warning::NPM vulnerabilities found"
-            echo "npm_vulnerable=true" >> "$GITHUB_ENV"
-          fi
-
-      - name: Notify on vulnerabilities
-        if: env.composer_vulnerable == 'true' || env.npm_vulnerable == 'true'
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          curl -sS \
-            -H "Title: ${REPO} has vulnerable dependencies" \
-            -H "Tags: lock,warning" \
-            -H "Priority: high" \
-            -d "Security audit found vulnerabilities. Review dependency updates." \
-            "${NTFY_URL}/${NTFY_TOPIC}" || true