ci(frontend): teste sur Node 26, comme l'image

L'image frontend passe sur node:26-alpine3.22 ; la CI restait sur Node 24 et ne validait donc plus l'interpréteur qui construit le SPA. Angular 22.1.8 accepte >=26.0.0 ; Node 26 devient LTS le 28 octobre 2026, Node 24 passe en maintenance le 20.
chore(deps): bump node in /apps/frontend
2026-09-22 08:42:46 +02:00 · 2026-09-22 08:42:46 +02:00 · 2026-09-22 08:42:06 +02:00 · 2026-09-22 08:42:03 +02:00 · 2026-09-22 08:42:00 +02:00 · 2026-09-22 08:40:33 +02:00
9 changed files with 60 additions and 55 deletions
@@ -47,10 +47,10 @@ jobs:

    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: etl/airflow/uv.lock
@@ -78,7 +78,7 @@ jobs:

    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      - name: Construit l'image (contexte à la racine, elle COPY ml/ et apps/backend/)
        run: docker build -f etl/airflow/Dockerfile -t enervision-airflow:ci .
@@ -30,10 +30,10 @@ jobs:

    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -90,10 +90,10 @@ jobs:

    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -126,10 +126,10 @@ jobs:

    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -150,12 +150,12 @@ jobs:

    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      # Pourquoi : pas de cache ici. uvx n'installe pas le projet, le verrou n'alimente donc
      # aucune clé de cache ; la seule roue téléchargée est celle de Bandit.
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7

      # Pourquoi : le périmètre est `app`, le code livré. Les tests emploient légitimement des
      # secrets factices et des `assert` que Bandit signalerait sans qu'aucun n'atteigne la prod.
@@ -17,10 +17,10 @@ jobs:
  build:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json

@@ -33,10 +33,10 @@ jobs:
    name: Audit des dépendances
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
      # Seuil high : une vulnérabilité moderate de devDependency ne doit pas bloquer une livraison.
      - run: npm audit --audit-level=high --package-lock-only
        working-directory: apps/frontend
@@ -45,10 +45,10 @@ jobs:
    needs: build
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json
      - name : Installation des dépendances (Front)
@@ -58,7 +58,7 @@ jobs:
        run: npm test --watch=false --code-coverage --coverageReporters=lcov
        working-directory: apps/frontend
      - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: frontend-coverage
          path: apps/frontend/coverage/frontend/lcov.info
@@ -30,10 +30,10 @@ jobs:

    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: ml/uv.lock
@@ -67,12 +67,12 @@ jobs:

    steps:
      - name: Récupère le dépôt
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7

      # Pourquoi : pas de cache ici. uvx n'installe pas le projet, le verrou n'alimente donc
      # aucune clé de cache ; la seule roue téléchargée est celle de Bandit.
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7

      - name: Analyse le code livré (bloquant à partir de MEDIUM)
        run: uvx bandit==1.9.4 --recursive enervision_ml --severity-level medium --confidence-level medium
@@ -24,10 +24,10 @@ jobs:
  build-front:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json
      
@@ -40,10 +40,10 @@ jobs:
    needs: build-front
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
        with:
-          node-version: 24
+          node-version: 26
          cache: npm
          cache-dependency-path: apps/frontend/package-lock.json

@@ -56,7 +56,7 @@ jobs:
        working-directory: apps/frontend

      - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: frontend-coverage
          path: apps/frontend/coverage/frontend/lcov.info
@@ -64,9 +64,9 @@ jobs:
  build-back:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -95,9 +95,9 @@ jobs:
    needs: build-back
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: apps/backend/uv.lock
@@ -107,7 +107,7 @@ jobs:
        working-directory: apps/backend

      - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: backend-coverage
          path: apps/backend/coverage.xml
@@ -115,9 +115,9 @@ jobs:
  test-ml:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
      - name: Installe uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          cache-dependency-glob: ml/uv.lock
@@ -135,7 +135,7 @@ jobs:
        working-directory: ml

      - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: ml-coverage
          path: ml/coverage.xml
@@ -143,23 +143,26 @@ jobs:
  sonarqube:
    needs: [build-front, build-back, test-front, test-back, test-ml]
    name: SonarQube
+    # Pourquoi : GitHub ne fournit pas les secrets aux workflows lancés par dependabot[bot].
+    # Sans SONAR_TOKEN le scan échoue sans rien analyser ; build et tests restent joués.
+    if: github.actor != 'dependabot[bot]'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Téléchargement du rapport de couverture (Front)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: frontend-coverage
          path: apps/frontend/coverage/frontend
      - name: Téléchargement du rapport de couverture (Back)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: backend-coverage
          path: apps/backend
      - name: Téléchargement du rapport de couverture (ML)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: ml-coverage
          path: ml
@@ -9,8 +9,10 @@ series temporelles energetiques, deployee sur une machine on-premise.
 |-------|----------------------------------------------------------|
 | J1    | Valider la préparation de l'environnement et du repo     |
 | J2    | Valider le périmètre retenu et les choix technologiques  |
-| J3    | Valider l'architecture et la gestion de la sécurité      |
-| J4    | Valider la robustesse et assurer les livrables           |
+| J3    | Ingestion & backend                                      |
+| J4    | Architecture, sécurité & frontend                        |
+| J5    | Valider la robustesse et assurer les livrables           |
+| J6    | Amélioration possible                                    |

 Ce que la documentation apporte à chacun : [docs/architecture/00-vue-ensemble.md](docs/architecture/00-vue-ensemble.md).

@@ -18,15 +20,15 @@ Ce que la documentation apporte à chacun : [docs/architecture/00-vue-ensemble.m

 | Domaine    | Technologie                         | Emplacement         | Etat          |
 |------------|-------------------------------------|---------------------|---------------|
-| Backend    | FastAPI, Python 3.14                | `apps/backend`      | Initialise    |
-| Frontend   | Angular 22, Node 24 LTS             | `apps/frontend`     | Tableau de bord |
-| Base       | PostgreSQL 17 + TimescaleDB         | `db`                | Initialise    |
+| Backend    | FastAPI, Python 3.14                | `apps/backend`      | En place    |
+| Frontend   | Angular 22, Node 24 LTS             | `apps/frontend`     | En place |
+| Base       | PostgreSQL 17 + TimescaleDB         | `db`                | En place    |
 | ETL        | Apache Airflow                      | `etl/airflow`       | Trois DAGs    |
 | Infra      | Terraform (k3s single-node)         | `infra/terraform`   | Initialise    |
 | Reverse proxy | Nginx, TLS                       | `infra/proxy`       | En place      |
-| CI/CD      | GitHub Actions                      | `.github/workflows` | Backend en place |
+| CI/CD      | GitHub Actions                      | `.github/workflows` | En place |
 | Monitoring | Prometheus, Grafana, Alertmanager   | `monitoring`        | A initialiser |
-| ML         | LightGBM, MLflow                    | `ml`                | Entrainement initialise |
+| ML         | LightGBM, MLflow                    | `ml`                | En place |

 Le backend, la base et l'infrastructure (Terraform/k3s) sont initialises a ce stade. Le frontend
 sert un tableau de bord sur `/dashboard`, dont les données proviennent de fixtures : les endpoints
@@ -3,7 +3,7 @@
 # ==================

 # Image pour frontend
-FROM node:24-alpine3.22 AS builder
+FROM node:26-alpine3.22 AS builder

 WORKDIR /app

@@ -44,7 +44,7 @@ services:
    ports: !reset null

  proxy:
-    image: nginx:1.31-alpine
+    image: nginx:1.28-alpine
    depends_on:
      backend:
        condition: service_healthy
@@ -9,7 +9,7 @@ Terminaison TLS et routage de la stack déployée. Seul composant publié sur le
 - `tls/` : les deux fichiers que nginx lit, `fullchain.pem` et `privkey.pem`. Ignorés par git.
 - `acme-deploy-hook.sh` : recopie le résultat de certbot dans `tls/`.

-Pas de `Dockerfile` : l'image officielle `nginx:1.31-alpine` est utilisée telle quelle et la
+Pas de `Dockerfile` : l'image officielle `nginx:1.28-alpine` est utilisée telle quelle et la
 configuration est montée en volume par `docker-compose.prod.yml`.

 L'overlay emploie les marqueurs `!override` et `!reset`, qui demandent **Docker Compose 2.24.4
@@ -82,7 +82,7 @@ docker run --rm \
  -v "$PWD/infra/proxy/nginx.conf:/etc/nginx/nginx.conf:ro" \
  -v "$PWD/infra/proxy/conf.d:/etc/nginx/conf.d:ro" \
  -v "$PWD/infra/proxy/tls:/etc/nginx/tls:ro" \
-  nginx:1.31-alpine nginx -t
+  nginx:1.28-alpine nginx -t
 ```

 Monter `infra/proxy/` entier sur `/etc/nginx` échouerait : `mime.types` vient de l'image.
Author	SHA1	Message	Date
Johan LEROY	985466e9cc	ci(frontend): teste sur Node 26, comme l'image Frontend / Audit des dépendances (push) Successful in 6s Details SonarQube / test-ml (push) Failing after 5m46s Details Frontend / build (push) Successful in 9m47s Details SonarQube / build-front (push) Successful in 9m54s Details SonarQube / build-back (push) Successful in 10m30s Details Frontend / test (push) Failing after 5m3s Details SonarQube / test-front (push) Failing after 5m8s Details SonarQube / test-back (push) Failing after 5m22s Details SonarQube / SonarQube (push) Skipped Details L'image frontend passe sur node:26-alpine3.22 ; la CI restait sur Node 24 et ne validait donc plus l'interpréteur qui construit le SPA. Angular 22.1.8 accepte >=26.0.0 ; Node 26 devient LTS le 28 octobre 2026, Node 24 passe en maintenance le 20.	2026-09-22 08:42:46 +02:00
dependabot[bot]andJohan LEROY	c347212c93	chore(deps): bump node in /apps/frontend Bumps node from 24-alpine3.22 to 26-alpine3.22. --- updated-dependencies: - dependency-name: node dependency-version: 26-alpine3.22 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-22 08:42:46 +02:00
Johan LEROY	c67c7802c1	Merge pull request #131 from ineszang/dependabot/github_actions/actions/download-artifact-8 chore(deps): bump actions/download-artifact from 4 to 8	2026-09-22 08:42:06 +02:00
Johan LEROY	e824423889	Merge pull request #128 from ineszang/dependabot/github_actions/actions/upload-artifact-7 chore(deps): bump actions/upload-artifact from 4 to 7	2026-09-22 08:42:03 +02:00
Johan LEROY	436147c8cb	Merge pull request #132 from ineszang/dependabot/github_actions/actions/setup-node-7 chore(deps): bump actions/setup-node from 6 to 7	2026-09-22 08:42:00 +02:00
Johan LEROYandGitHub	8fb7ab8680	Merge pull request #130 from ineszang/dependabot/github_actions/astral-sh/setup-uv-7 chore(deps): bump astral-sh/setup-uv from 5 to 7	2026-09-22 08:40:33 +02:00
dependabot[bot]andGitHub	19f4ddc62f	chore(deps): bump actions/upload-artifact from 4 to 7 Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-22 06:37:24 +00:00
dependabot[bot]andGitHub	282472bae9	chore(deps): bump actions/download-artifact from 4 to 8 Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 8. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v8) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '8' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-22 06:37:23 +00:00
dependabot[bot]andGitHub	8d80cdc79d	chore(deps): bump actions/setup-node from 6 to 7 Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-22 06:37:23 +00:00
dependabot[bot]andGitHub	b61287c8d2	chore(deps): bump astral-sh/setup-uv from 5 to 7 Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 5 to 7. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](https://github.com/astral-sh/setup-uv/compare/v5...v7) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-22 06:37:20 +00:00
Johan LEROYandGitHub	a4be46c6e6	Merge pull request #129 from ineszang/dependabot/github_actions/actions/checkout-7 chore(deps): bump actions/checkout from 4 to 7	2026-09-22 08:36:32 +02:00
dependabot[bot]andGitHub	66a65991b5	chore(deps): bump actions/checkout from 4 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>	2026-09-22 06:33:45 +00:00
Johan LEROYandGitHub	095cb4559b	Merge pull request #142 from ineszang/chore/sonar-skip-dependabot chore(ci): ignore le scan SonarQube pour les PR Dependabot	2026-09-22 08:31:48 +02:00
Johan LEROY	401d5a3174	chore(ci): ignore le scan SonarQube pour les PR Dependabot SonarQube / build-back (push) Successful in 1m20s Details SonarQube / test-ml (push) Failing after 1m11s Details SonarQube / build-front (push) Successful in 9m44s Details SonarQube / test-back (push) Failing after 59s Details SonarQube / test-front (push) Failing after 5m8s Details SonarQube / SonarQube (push) Skipped Details GitHub ne fournit pas les secrets du dépôt aux workflows déclenchés par dependabot[bot] : SONAR_TOKEN arrive vide et le scan échoue sans rien analyser, ce qui marque rouge toutes les PR de mise à jour de dépendances. Les jobs de build et de tests du workflow restent joués sur ces PR.	2026-09-22 08:28:03 +02:00
PhyriosandGitHub	cf50d3d36c	Revise project milestones in README Updated project milestones in the README to reflect new tasks and structure.	2026-09-21 14:42:41 +02:00
PhyriosandGitHub	4afcfb3ced	Update project status in README.md	2026-09-21 14:28:56 +02:00