Fiabilisation des outils, compétences & MCP du chat #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Lint, typecheck and build | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Build | |
| run: npm run build | |
| env: | |
| DATABASE_URL: postgresql://placeholder:placeholder@localhost:5432/placeholder | |
| AUTH_SECRET: ci_placeholder_secret_long_enough_for_nextauth_validation | |
| ENCRYPTION_KEY: ci_placeholder_encryption_key_32_chars_for_aes_scrypt_test | |
| test: | |
| name: Unit tests (Vitest) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Run unit tests | |
| run: npm test | |
| audit: | |
| name: Vulnerabilities (npm audit) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - name: npm audit (production deps, high+) | |
| run: npm audit --omit=dev --audit-level=high | |
| licenses: | |
| name: Licence compliance (AGPL) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Check licences | |
| # Allowlist explicite de licences compatibles AGPL-3.0-or-later côté | |
| # redistribution. On exclut le package "louis" lui-même (private: | |
| # true, license: AGPL-3.0-or-later mais license-checker le marque | |
| # UNLICENSED à cause de private). | |
| run: | | |
| npx --yes license-checker --production \ | |
| --excludePackages "louis@$(node -p "require('./package.json').version")" \ | |
| --onlyAllow \ | |
| "MIT;ISC;Apache-2.0;Apache 2.0;BSD;BSD-2-Clause;BSD-3-Clause;BSD-3-Clause-Clear;0BSD;CC0-1.0;CC-BY-3.0;CC-BY-4.0;Unlicense;OFL-1.1;SIL-OFL-1.1;BlueOak-1.0.0;Python-2.0;WTFPL;MPL-2.0;LGPL-2.1-or-later;LGPL-3.0-or-later;LGPL-3.0-only;LGPL-3.0;GPL-3.0-or-later;AGPL-3.0-or-later;AGPL-3.0;Artistic-2.0;EPL-2.0" | |
| sbom: | |
| name: SBOM (CycloneDX) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| # `npm sbom` exige que l'arbre complet soit installé pour vérifier | |
| # l'intégrité avant export, même si on filtre les devDeps en sortie | |
| # via `--omit=dev`. On installe donc tout puis on filtre. | |
| - name: Install all dependencies | |
| run: npm ci | |
| - name: Generate SBOM CycloneDX (prod components only) | |
| run: npm run sbom | |
| - name: Validate SBOM JSON | |
| run: | | |
| jq '.bomFormat, .specVersion, (.components | length)' sbom.cdx.json | |
| test "$(jq -r '.bomFormat' sbom.cdx.json)" = "CycloneDX" | |
| - name: Upload SBOM artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: louis-sbom-cyclonedx | |
| path: sbom.cdx.json | |
| retention-days: 90 |