Repository navigation
chore(deps): bump node from e67514e to 50c8e8c
#118
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| paths-ignore: | |
| - ".cursor/**" | |
| pull_request: | |
| branches: [main] | |
| paths-ignore: | |
| - ".cursor/**" | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| quality: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - run: npm ci | |
| - name: Contrôles qualité (lint, typecheck, tests, audit) | |
| env: | |
| NEXTAUTH_SECRET: ci-test-nextauth-secret-32chars-minimum-ok | |
| DATABASE_URL: postgresql://ci:ci@localhost:5432/ci | |
| run: npm run ci:full | |
| docker: | |
| runs-on: ubuntu-latest | |
| # Parallèle à quality : wall-clock PR ≈ max(quality, docker). | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e | |
| - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f | |
| # Dependabot : GITHUB_TOKEN read-only → pas d'écriture buildcache GHCR. | |
| if: github.actor != 'dependabot[bot]' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| # Validation Dockerfile uniquement : pas d'image PR sur GHCR. | |
| # Le push productif reste sur le job release. | |
| - name: Build (PR) | |
| if: github.actor != 'dependabot[bot]' | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | |
| with: | |
| context: . | |
| push: false | |
| cache-from: | | |
| type=registry,ref=ghcr.io/${{ github.repository }}/buildcache:latest | |
| type=gha,scope=markit | |
| cache-to: | | |
| type=registry,ref=ghcr.io/${{ github.repository }}/buildcache:latest,mode=max | |
| type=gha,mode=max,scope=markit | |
| - name: Build (Dependabot) | |
| if: github.actor == 'dependabot[bot]' | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | |
| with: | |
| context: . | |
| push: false | |
| cache-from: type=gha,scope=markit | |
| cache-to: type=gha,mode=max,scope=markit | |
| release: | |
| name: semantic-release | |
| runs-on: ubuntu-latest | |
| needs: quality | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Token GitHub App (release) | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| app-id: ${{ secrets.RELEASE_APP_ID }} | |
| private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }} | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Identité Git (commits chore(release)) | |
| run: | | |
| git config user.name "${{ steps.app-token.outputs.app-slug }}[bot]" | |
| git config user.email "${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com" | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 | |
| with: | |
| node-version-file: .nvmrc | |
| cache: npm | |
| - run: npm ci | |
| - name: semantic-release | |
| env: | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| # Évite pre-push → npm run ci pendant le push @semantic-release/git | |
| # (quality a déjà validé la branche ; NEXTAUTH_SECRET absent ici sinon). | |
| HUSKY: "0" | |
| run: npm run release | |
| - name: Détecter la release publiée | |
| id: release | |
| run: | | |
| tag="$(git tag --points-at HEAD | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$' | sort -V | tail -n 1 || true)" | |
| if [[ -z "$tag" ]]; then | |
| echo "published=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| echo "published=true" >> "$GITHUB_OUTPUT" | |
| echo "tag=$tag" >> "$GITHUB_OUTPUT" | |
| if [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "latest=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "latest=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e | |
| if: steps.release.outputs.published == 'true' | |
| - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f | |
| if: steps.release.outputs.published == 'true' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 | |
| if: steps.release.outputs.published == 'true' | |
| id: release-meta | |
| with: | |
| images: ghcr.io/${{ github.repository }} | |
| tags: | | |
| type=raw,value=${{ steps.release.outputs.tag }} | |
| type=semver,pattern={{version}},value=${{ steps.release.outputs.tag }} | |
| type=semver,pattern={{major}}.{{minor}},value=${{ steps.release.outputs.tag }} | |
| type=raw,value=latest,enable=${{ steps.release.outputs.latest == 'true' }} | |
| - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | |
| if: steps.release.outputs.published == 'true' | |
| with: | |
| context: . | |
| push: true | |
| tags: ${{ steps.release-meta.outputs.tags }} | |
| labels: ${{ steps.release-meta.outputs.labels }} | |
| cache-from: | | |
| type=registry,ref=ghcr.io/${{ github.repository }}/buildcache:latest | |
| type=gha,scope=markit | |
| cache-to: | | |
| type=registry,ref=ghcr.io/${{ github.repository }}/buildcache:latest,mode=max | |
| type=gha,mode=max,scope=markit |