Automazione Pianificata con GitHub Actions: Casi d'Uso DevOps Reali

# Formato: minuto  ora  giorno-del-mese  mese  giorno-della-settimana
#
# Esempi:
# 0 9 * * 1-5      Ogni giorno feriale alle 09:00
# 0 0 * * *        Ogni giorno a mezzanotte
# 30 6 * * 1       Ogni lunedì alle 06:30
# 0 */4 * * *      Ogni 4 ore
# 0 9 1 * *        Primo di ogni mese alle 09:00

name: Nightly Audit

on:
  schedule:
    - cron: '0 2 * * *'   # 02:00 UTC ogni giorno
  workflow_dispatch:        # attivabile manualmente dall'UI o API
    inputs:
      dry_run:
        description: 'Esegui in modalità dry-run (non aprire issue)'
        type: boolean
        default: false

name: Nightly Dependency Audit

on:
  schedule:
    - cron: '0 2 * * *'
  workflow_dispatch:

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      issues: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - name: Run pip-audit
        id: audit
        run: |
          pip install pip-audit
          pip-audit --output json > audit-results.json || echo "VULNERABILITIES_FOUND=true" >> $GITHUB_ENV

      - name: Apri issue se trovate vulnerabilità
        if: env.VULNERABILITIES_FOUND == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const results = fs.readFileSync('audit-results.json', 'utf8');
            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `[Security] Vulnerabilità nelle dipendenze trovate - ${new Date().toISOString().split('T')[0]}`,
              body: `## Risultati Audit Vulnerabilità\n\`\`\`json\n${results}\n\`\`\`\n\nAttivato dal workflow di audit notturno.`,
              labels: ['security', 'dependencies']
            });

name: Weekly AWS Cost Check

on:
  schedule:
    - cron: '0 7 * * 1'   # Lunedì 07:00 UTC
  workflow_dispatch:

jobs:
  cost-check:
    runs-on: ubuntu-latest
    steps:
      - name: Ottieni costo AWS degli ultimi 7 giorni
        id: cost
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: eu-central-1
        run: |
          END=$(date -u +%Y-%m-%d)
          START=$(date -u -d '7 days ago' +%Y-%m-%d)
          AMOUNT=$(aws ce get-cost-and-usage \
            --time-period Start=$START,End=$END \
            --granularity MONTHLY \
            --metrics "UnblendedCost" \
            --query 'ResultsByTime[0].Total.UnblendedCost.Amount' \
            --output text)
          echo "COST=$AMOUNT" >> $GITHUB_ENV
          echo "Spesa settimanale: $AMOUNT USD"

      - name: Avvisa Slack se la spesa supera la soglia
        if: ${{ env.COST > 500 }}
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
        run: |
          curl -s -X POST "$SLACK_WEBHOOK" \
            -H "Content-Type: application/json" \
            -d "{\"text\": \":warning: La spesa settimanale AWS è \$$COST USD (soglia: \$500). Controlla il Cost Explorer.\"}"

name: Certificate Expiry Check

on:
  schedule:
    - cron: '0 8 * * 1'   # Lunedì 08:00 UTC
  workflow_dispatch:

jobs:
  cert-check:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        host:
          - api.example.com
          - app.example.com
    steps:
      - name: Controlla certificato per ${{ matrix.host }}
        env:
          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK_URL }}
        run: |
          EXPIRY=$(echo | openssl s_client -servername ${{ matrix.host }} \
            -connect ${{ matrix.host }}:443 2>/dev/null \
            | openssl x509 -noout -enddate \
            | cut -d= -f2)
          EXPIRY_EPOCH=$(date -d "$EXPIRY" +%s)
          NOW_EPOCH=$(date +%s)
          DAYS_LEFT=$(( (EXPIRY_EPOCH - NOW_EPOCH) / 86400 ))
          echo "Il certificato per ${{ matrix.host }} scade tra $DAYS_LEFT giorni ($EXPIRY)"
          if [ "$DAYS_LEFT" -lt 30 ]; then
            curl -s -X POST "$SLACK_WEBHOOK" \
              -H "Content-Type: application/json" \
              -d "{\"text\": \":rotating_light: Il certificato per *${{ matrix.host }}* scade tra *$DAYS_LEFT giorni* ($EXPIRY). Rinnova immediatamente.\"}"
          fi

name: Weekly Dependency Update

on:
  schedule:
    - cron: '0 6 * * 1'   # Lunedì 06:00 UTC
  workflow_dispatch:

jobs:
  update:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Aggiorna dipendenze
        run: npm update

      - name: Crea pull request se qualcosa è cambiato
        uses: peter-evans/create-pull-request@v6
        with:
          commit-message: 'chore: aggiornamento settimanale dipendenze'
          title: 'chore: aggiornamento settimanale dipendenze'
          body: 'Aggiornamento automatico settimanale delle dipendenze tramite GitHub Actions.'
          branch: automated/weekly-deps-update
          delete-branch: true
          labels: dependencies

name: Nightly Audit

on:
  schedule:
    - cron: '0 2 * * *'
  workflow_dispatch:

concurrency:
  group: nightly-audit
  cancel-in-progress: true

jobs:
  audit:
    # ...