feat: add reusable Node check workflow

npm ci, then npm run <script> for each entry of the scripts input.
PR gate for frontends so Renovate can automerge npm updates.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

.gitea/workflows/node-check.yaml

@@ -0,0 +1,57 @@
+name: Node Check (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      node-version:
+        description: "Node.js version"
+        required: false
+        default: "22"
+        type: string
+      working-directory:
+        description: "Directory containing package.json and package-lock.json (relative to repo root)"
+        required: false
+        default: "."
+        type: string
+      scripts:
+        description: "Space-separated npm scripts, run in order with `npm run <script>` after `npm ci`, e.g. \"check test build\""
+        required: true
+        type: string
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    env:
+      SCRIPTS: ${{ inputs.scripts }}
+      CI: "true"
+
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ inputs.node-version }}
+          package-manager-cache: false
+
+      - name: Install
+        run: npm ci
+
+      - name: Run scripts
+        run: |
+          read -ra LIST <<< "$SCRIPTS"
+          if [ "${#LIST[@]}" -eq 0 ]; then
+            echo "::error::input 'scripts' is empty"
+            exit 1
+          fi
+          for s in "${LIST[@]}"; do
+            echo "::group::npm run $s"
+            npm run "$s"
+            echo "::endgroup::"
+          done

README.md

@@ -0,0 +1,34 @@
+# node-check
+
+Reusable Gitea Actions workflow: `npm ci` → `npm run <script>` for each script in a list. Meant as a PR gate for frontend code, for example so Renovate can automerge npm updates.
+
+## Usage
+
+```yaml
+on:
+  pull_request:
+
+jobs:
+  frontend:
+    uses: templates/node-check/.gitea/workflows/node-check.yaml@v1
+    with:
+      working-directory: src/MyApp.Web
+      scripts: "check test build"
+      # node-version: "22"
+```
+
+## Inputs
+
+| Name | Default | Description |
+|---|---|---|
+| `scripts` | (required) | npm scripts separated by spaces. They run in order and the job stops at the first failure. |
+| `working-directory` | `.` | Directory with `package.json` and `package-lock.json` |
+| `node-version` | `22` | Node.js version for `actions/setup-node` |
+
+No secrets. `npm ci` needs a committed `package-lock.json`.
+
+Branch protection: take the exact status-check name from the first PR run. Renaming the workflow `name:` or the job id `check` is a breaking change and needs a new major tag.
+
+## Versioning
+
+Only major tags (`v1`, `v2`, …). Fixes and new optional inputs move the existing tag. Changing or removing inputs, or changing behavior, needs a new major tag.