actions

.github/workflows/ci.yml

@@ -0,0 +1,158 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run pipeline:recipes
+      - run: npm run check:quality
+      - run: npm run lint
+      - run: npm run typecheck
+      - run: npm run test:coverage
+      - name: Upload coverage
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-summary
+          path: |
+            coverage/coverage-summary.json
+            coverage/lcov.info
+
+  e2e-and-a11y:
+    runs-on: ubuntu-latest
+    needs: quality
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run pipeline:recipes
+      - run: npx playwright install --with-deps
+      - run: npm run test:e2e
+      - name: Upload quality summaries (a11y + perf)
+        uses: actions/upload-artifact@v7
+        with:
+          name: quality-e2e
+          path: quality-out/
+          if-no-files-found: warn
+
+  lighthouse:
+    runs-on: ubuntu-latest
+    needs: quality
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run audit:lighthouse
+      # .lighthouseci est dans .gitignore : upload-artifact exclut ces fichiers → aucun artefact « lighthouse-ci ».
+      # Copie vers un dossier non ignoré pour forcer l’upload réel des LHR.
+      - name: Stage LHCI reports for artifact
+        run: |
+          rm -rf __lhci_artifact__
+          mkdir -p __lhci_artifact__
+          cp -R .lighthouseci/. __lhci_artifact__/
+          test "$(find __lhci_artifact__ -type f | wc -l)" -gt 0 || { echo "::error::LHCI n'a produit aucun fichier"; exit 1; }
+      - name: Upload Lighthouse CI output
+        uses: actions/upload-artifact@v7
+        with:
+          name: lighthouse-ci
+          path: __lhci_artifact__
+          if-no-files-found: error
+
+  android-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v4
+      - run: sdkmanager "platforms;android-35" "build-tools;35.0.0"
+      - run: npm ci
+      - run: npm run pipeline:recipes
+      - run: npm run build:web
+      - run: npm run mobile:sync
+      - name: Gradle assembleDebug
+        working-directory: apps/mobile/android
+        run: chmod +x gradlew && ./gradlew assembleDebug --no-daemon
+
+  pull-request-report:
+    if: github.event_name == 'pull_request'
+    needs: [quality, e2e-and-a11y, lighthouse]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: mkdir -p incoming
+      - run: npm audit --json > incoming/audit.json || true
+      # Même version majeure que upload-artifact (@v7) : v8 peut ne pas résoudre les artefacts v7.
+      - uses: actions/download-artifact@v8
+        with:
+          name: coverage-summary
+          path: incoming/coverage
+      - uses: actions/download-artifact@v8
+        with:
+          name: quality-e2e
+          path: incoming/e2e
+      - uses: actions/download-artifact@v8
+        with:
+          name: lighthouse-ci
+          path: incoming/lhci
+      - run: node scripts/ci/pr-quality-report.mjs incoming incoming/pr-body.md
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const fs = require('fs');
+            const marker = '<!-- ben-to-quality-report -->';
+            const body = marker + '\n' + fs.readFileSync('incoming/pr-body.md','utf8');
+            const issue_number = context.payload.pull_request.number;
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number,
+              per_page: 100
+            });
+            const existing = comments.find(c => c.body.includes(marker));
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number,
+                body
+              });
+            }

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      # L’action officielle `dependency-review-action` suppose Dependency graph + GitHub Advanced Security
+      # (réglages du dépôt). Sans GHAS elle échoue toujours sur les dépôts non éligibles.
+      # Même garde-fou que Security / deps-and-secrets : lockfile installable + npm audit.
+      - run: npm ci
+      - run: npm audit --audit-level=high

.github/workflows/mobile-release.yml

@@ -0,0 +1,50 @@
+name: Mobile Release
+
+on:
+  push:
+    tags:
+      - "mobile-v*"
+  workflow_dispatch:
+
+jobs:
+  android:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 21
+      - name: Setup Android SDK
+        uses: android-actions/setup-android@v4
+      - run: sdkmanager "platforms;android-35" "build-tools;35.0.0"
+      - run: npm ci
+      - run: npm run build:web
+      - run: npm run mobile:sync
+      - name: Gradle bundleDebug (sans keystore Play — artefact de validation CI)
+        working-directory: apps/mobile/android
+        run: chmod +x gradlew && ./gradlew bundleDebug --no-daemon
+      - uses: actions/upload-artifact@v7
+        with:
+          name: android-bundle-debug
+          path: apps/mobile/android/app/build/outputs/bundle/debug/*.aab
+          if-no-files-found: error
+
+  ios:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run build:web
+      - run: npm run mobile:sync
+      - name: iOS — projet non versionné ou machine locale
+        run: |
+          if [ -d apps/mobile/ios/App ]; then echo "Projet iOS présent — ouvrir Xcode pour archive."; else echo "Pas de dossier ios dans ce clone — ignorer pour Android-only."; fi

.github/workflows/security.yml

@@ -0,0 +1,51 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 5 * * 1"
+
+jobs:
+  codeql:
+    # PR depuis fork : pas d’upload SARIF vers le dépôt cible (permissions GitHub).
+    # Dépôt sans « Code scanning » activé (Settings → Code security) : l’upload échoue ;
+    # `upload: false` garde l’analyse CodeQL sans appeler l’API. Quand le scanning est
+    # activé sur le repo, retirer `upload: false` (comportement par défaut = upload).
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@v4
+        with:
+          upload: false
+
+  deps-and-secrets:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # Historique complet : gitleaks compare github.event.before..after sur push ;
+      # un clone depth=1 ne contient pas le parent, d’où « unknown revision ».
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - run: npm ci
+      - run: npm run audit:deps
+      - name: Secret scan
+        # v2 — SHA épinglé (supply chain) ; tag : https://github.com/gitleaks/gitleaks-action/releases
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}