Johan LEROY
fb06bf0062
Backend / Audit des dépendances (push) Successful in 1m30s
Frontend / Audit des dépendances (push) Successful in 7s
Backend / Lint, typage et tests (push) Successful in 4m15s
Frontend / build (push) Successful in 11m3s
Frontend / test (push) Failing after 5m7s
Frontend / SonarQube (push) Skipped
L'audit backend était la dernière étape du job de vérification : un lint ou un test en échec suffisait à le sauter, et `pip-audit` sans argument auditait l'environnement courant, donc aussi les 28 paquets injectés par son propre `--with`. Il audite maintenant l'export du verrou, dans un job dédié, en symétrie avec le frontend. Côté frontend, `npm audit` lit le verrou et n'a besoin ni de `npm ci` ni du job `build`. Le workflow déclare enfin ses permissions, comme backend.yml et ml.yml.
81 lines
2.1 KiB
YAML
81 lines
2.1 KiB
YAML
name: Frontend
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- "apps/frontend/**"
|
|
- ".github/workflows/frontend.yml"
|
|
pull_request:
|
|
paths:
|
|
- "apps/frontend/**"
|
|
- ".github/workflows/frontend.yml"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 24
|
|
cache: npm
|
|
cache-dependency-path: apps/frontend/package-lock.json
|
|
|
|
- run: npm ci
|
|
working-directory: apps/frontend
|
|
- run: npm run build
|
|
working-directory: apps/frontend
|
|
|
|
security-audit:
|
|
name: Audit des dépendances
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 24
|
|
# Seuil high : une vulnérabilité moderate de devDependency ne doit pas bloquer une livraison.
|
|
- run: npm audit --audit-level=high --package-lock-only
|
|
working-directory: apps/frontend
|
|
|
|
test:
|
|
needs: build
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
- uses: actions/setup-node@v6
|
|
with:
|
|
node-version: 24
|
|
cache: npm
|
|
cache-dependency-path: apps/frontend/package-lock.json
|
|
- run: npm ci
|
|
working-directory: apps/frontend
|
|
- run: npm test --watch=false --code-coverage --coverageReporters=lcov
|
|
working-directory: apps/frontend
|
|
- name: Upload coverage
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: frontend-coverage
|
|
path: apps/frontend/coverage/frontend/lcov.info
|
|
|
|
sonarqube:
|
|
needs: [build, test]
|
|
name: SonarQube
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Download coverage
|
|
uses: actions/download-artifact@v4
|
|
with:
|
|
name: frontend-coverage
|
|
path: apps/frontend/coverage/frontend
|
|
- name: SonarQube Scan
|
|
uses: SonarSource/sonarqube-scan-action@v8
|
|
env:
|
|
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
|