ci-ai: KI-Schicht für die Gitea-CI (PR-Review, Security-Erklärung, CI-Failure-Analyse)

Provider-agnostische LLM-Anbindung (Anthropic jetzt, Jetson/Ollama später per
Env-Var umschaltbar). Stdlib-only Skripte + Beispiel-Workflows. GitLab-Duo-Parität
für self-hosted Gitea + act_runner.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workflows/security.example.yml

@@ -0,0 +1,60 @@
+# Feature B (+C) — Security-Scan, HART blockierend, mit KI-Klartext-Erklärung.
+# In ein Ziel-Repo kopieren nach: .gitea/workflows/security.yml
+#
+# Ablauf: scannen (ohne sofort abzubrechen) -> Gate (failt hart bei Funden) ->
+# bei Fehler erklärt die KI die Funde im PR. So failt der Check verlässlich UND
+# der Erklär-Schritt sieht beide Reports.
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+
+jobs:
+  scan:
+    runs-on: eulernest
+    container: ghcr.io/catthehacker/ubuntu:act-latest
+    steps:
+      - name: Checkout (volle Historie für Gitleaks)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Gitleaks (Secret-Scan)
+        id: gitleaks
+        continue-on-error: true
+        run: |
+          curl -sSL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_linux_x64.tar.gz \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks detect --source . --report-format json --report-path /tmp/gitleaks.json --no-banner \
+            | tee /tmp/gitleaks.txt; echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
+
+      - name: Trivy (fs + IaC, HIGH/CRITICAL)
+        id: trivy
+        continue-on-error: true
+        run: |
+          curl -sSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
+            | sh -s -- -b /usr/local/bin
+          trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL \
+            --exit-code 1 --no-progress . | tee /tmp/trivy.txt; echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
+
+      - name: Gate — hart blockieren bei Funden
+        run: |
+          cat /tmp/gitleaks.txt /tmp/trivy.txt > /tmp/scan.log 2>/dev/null || true
+          if [ "${{ steps.gitleaks.outputs.code }}" != "0" ] || [ "${{ steps.trivy.outputs.code }}" != "0" ]; then
+            echo "Security-Funde — Check schlägt fehl (hart blockierend)."; exit 1
+          fi
+          echo "Keine HIGH/CRITICAL-Funde."
+
+      - name: KI erklärt die Funde (nur bei Fehler)
+        if: failure()
+        env:
+          AI_PROVIDER: anthropic
+          AI_MODEL: claude-3-5-haiku-latest
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GITEA_TOKEN: ${{ github.token }}
+          GITEA_API: https://git.eulernest.eu/api/v1
+        run: |
+          git clone --depth 1 https://git.eulernest.eu/user2595/ci-ai.git /opt/ci-ai
+          python3 /opt/ci-ai/scripts/ai_explain.py security /tmp/scan.log