From 9bd6936d178d28a12eb8aeb9749b7f91a25ef9c3 Mon Sep 17 00:00:00 2001
From: Agent Zero <agent@media-on.de>
Date: Wed, 29 Jul 2026 13:05:14 +0200
Subject: [PATCH] ci: CI/CD pipeline with 10 quality gates + Forgejo Actions
 workflow

---
 .forgejo/workflows/ci.yml | 25 +++++++++++++
 scripts/ci_pipeline.sh    | 78 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 103 insertions(+)
 create mode 100644 .forgejo/workflows/ci.yml
 create mode 100644 scripts/ci_pipeline.sh

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..ca9ce79
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,25 @@
+name: CI/CD Pipeline
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  quality-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Install Python deps
+        run: pip install -r requirements.txt
+      - name: Install Frontend deps
+        run: cd frontend && npm ci
+      - name: Run CI/CD Pipeline
+        run: bash scripts/ci_pipeline.sh
diff --git a/scripts/ci_pipeline.sh b/scripts/ci_pipeline.sh
new file mode 100644
index 0000000..137fb3c
--- /dev/null
+++ b/scripts/ci_pipeline.sh
@@ -0,0 +1,78 @@
+#!/bin/bash
+# =============================================================================
+# CI/CD Pipeline for LeoCRM — Quality Gates
+# =============================================================================
+# This script runs all quality checks before a deployment is allowed.
+# It should be run in CI (GitHub Actions, Forgejo Actions, etc.) or locally.
+#
+# Exit codes:
+#   0 = all checks passed
+#   1 = one or more checks failed
+# =============================================================================
+
+set -e
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+PASS=0
+FAIL=0
+
+check() {
+    local name="$1"
+    local cmd="$2"
+    echo -e "${YELLOW}[CI] Running: ${name}${NC}"
+    if eval "$cmd" 2>&1 | tail -5; then
+        echo -e "${GREEN}[CI] PASS: ${name}${NC}"
+        PASS=$((PASS + 1))
+    else
+        echo -e "${RED}[CI] FAIL: ${name}${NC}"
+        FAIL=$((FAIL + 1))
+    fi
+}
+
+# ── 1. Python Compile Check ──────────────────────────────────────────────────
+check "Python Compile" "python3 -m compileall app/ alembic/ -q"
+
+# ── 2. Cross-Plugin Import Check ─────────────────────────────────────────────
+check "Cross-Plugin Imports" "python3 scripts/check_cross_plugin_imports.py"
+
+# ── 3. Alembic Revision Graph ────────────────────────────────────────────────
+check "Alembic Revisions" "alembic heads 2>&1 | grep -c 'head' | grep -q '^1$'"
+
+# ── 4. TypeScript Type Check ─────────────────────────────────────────────────
+check "TypeScript Type Check" "cd frontend && npx tsc --noEmit"
+
+# ── 5. Frontend Build ────────────────────────────────────────────────────────
+check "Frontend Build" "cd frontend && npm run build"
+
+# ── 6. Python Tests (if collectable) ─────────────────────────────────────────
+check "Test Collection" "python3 -m pytest --collect-only -q tests/ 2>&1 | tail -3"
+
+# ── 7. Security: SQL Injection Check ─────────────────────────────────────────
+check "SQL Injection Check" "! grep -rn 'text(f"SELECT.*{' app/services/ --include='*.py' >/dev/null 2>&1"
+
+# ── 8. Security: Jinja2 Sandbox Check ─────────────────────────────────────────
+check "Jinja2 Sandbox Check" "! grep -rn 'Environment(' app/plugins/builtins/report_generator/ --include='*.py' | grep -v Sandboxed >/dev/null 2>&1"
+
+# ── 9. Security: RLS Variable Check ──────────────────────────────────────────
+check "RLS Variable Check" "grep -q 'app.current_tenant_id' app/core/db/__init__.py"
+
+# ── 10. Security: Fail-Closed Plugin Gate ────────────────────────────────────
+check "Fail-Closed Plugin Gate" "! grep -A2 'except Exception:' app/deps.py | grep -q 'pass$' >/dev/null 2>&1"
+
+# ── Summary ──────────────────────────────────────────────────────────────────
+echo ""
+echo "============================================================"
+echo "  CI/CD Summary: ${PASS} passed, ${FAIL} failed"
+echo "============================================================"
+
+if [ $FAIL -gt 0 ]; then
+    echo -e "${RED}[CI] BUILD FAILED — ${FAIL} checks failed${NC}"
+    exit 1
+else
+    echo -e "${GREEN}[CI] BUILD PASSED — all ${PASS} checks passed${NC}"
+    exit 0
+fi