feat: global reusable workflows (workflow_call) + thin caller template

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/reusable-security.yml

@@ -0,0 +1,84 @@
+# GLOBALER, wiederverwendbarer Security-Scan (Feature B + C).
+# Aufruf aus einem beliebigen Repo (siehe workflows/caller.example.yml):
+#   jobs:
+#     security:
+#       uses: user2595/ci-ai/.gitea/workflows/reusable-security.yml@main
+#       secrets: inherit
+#
+# Voraussetzungen (einmalig zentral):
+#   - Runner instanzweit registriert (Label `eulernest`)
+#   - anonymer Clone für public Repos erlaubt (für den ci-ai-Clone)
+#   - optional ANTHROPIC_API_KEY als Org-/Instanz-Secret (für die KI-Erklärung)
+#
+# python:3.12-slim (Debian: bash) + Memory-Cap (Pi). ⚠ ARM64-Binaries.
+# Gitleaks (Secrets) + Trivy config (IaC) — hart blockierend über den Gate-Schritt.
+name: ci-ai · security (reusable)
+
+on:
+  workflow_call:
+    secrets:
+      ANTHROPIC_API_KEY:
+        required: false
+
+env:
+  GITLEAKS_VERSION: "8.18.4"
+
+jobs:
+  scan:
+    runs-on: eulernest
+    container:
+      image: python:3.12-slim
+      options: "--memory=768m --memory-swap=1024m"
+    steps:
+      - name: Tooling
+        run: apt-get update -qq && apt-get install -y -qq --no-install-recommends git curl ca-certificates tar
+
+      - name: Ziel-Repo auschecken (Auto-Token des aufrufenden Repos)
+        env:
+          GITEA_TOKEN: ${{ github.token }}
+        run: git clone --depth 1 "https://x-access-token:${GITEA_TOKEN}@git.eulernest.eu/${GITHUB_REPOSITORY}.git" src
+
+      - name: Gitleaks (Secret-Scan, ARM64)
+        id: gl
+        continue-on-error: true
+        run: |
+          set +e
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_arm64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          cd src
+          gitleaks detect --no-git --source . --redact > /tmp/gl.log 2>&1
+          echo "code=$?" >> "$GITHUB_OUTPUT"
+          tail -n 3 /tmp/gl.log; cat /tmp/gl.log >> /tmp/scan.log
+
+      - name: Trivy (IaC/config, leicht)
+        id: tv
+        continue-on-error: true
+        run: |
+          set +e
+          curl -sSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
+            | sh -s -- -b /usr/local/bin
+          cd src
+          trivy config --severity HIGH,CRITICAL --exit-code 1 . > /tmp/tv.log 2>&1
+          echo "code=$?" >> "$GITHUB_OUTPUT"
+          tail -n 8 /tmp/tv.log; cat /tmp/tv.log >> /tmp/scan.log
+
+      - name: Gate — hart blockieren bei Funden
+        run: |
+          echo "gitleaks=${{ steps.gl.outputs.code }}  trivy=${{ steps.tv.outputs.code }}"
+          if [ "${{ steps.gl.outputs.code }}" != "0" ] || [ "${{ steps.tv.outputs.code }}" != "0" ]; then
+            echo "Security-Funde -> Check schlägt fehl (hart blockierend)."; exit 1
+          fi
+          echo "Keine HIGH/CRITICAL-Funde."
+
+      - name: KI erklärt die Funde (bei Fehler; skippt sauber ohne Key)
+        if: failure()
+        continue-on-error: true
+        env:
+          AI_PROVIDER: anthropic
+          AI_MODEL: claude-3-5-haiku-latest
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GITEA_TOKEN: ${{ github.token }}
+          GITEA_API: https://git.eulernest.eu/api/v1
+        run: |
+          git clone --depth 1 https://git.eulernest.eu/user2595/ci-ai.git /opt/ci-ai
+          python3 /opt/ci-ai/scripts/ai_explain.py security /tmp/scan.log