fix(audit): fermer les frontieres restantes

2026-08-17 14:34:06 -04:00
parent f84cb4e3b6
commit 105a72700f
28 changed files with 1511 additions and 617 deletions
@@ -0,0 +1,45 @@
+name: CI - Security, Lint & Tests
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+# This workflow validates branches only. It has no deployment step and no
+# write permission, so an audit-branch push cannot alter main or production.
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: '3.12'
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt -r requirements-dev.txt
+
+      - name: Audit declared dependencies
+        run: pip-audit -r requirements.txt
+
+      - name: Lint and check formatting
+        run: |
+          ruff check .
+          ruff format --check .
+
+      - name: Run tests with coverage gate
+        run: pytest --cov=app --cov-report=term-missing --cov-report=xml
+
+      - name: Run repository security checks
+        env:
+          SECRET_KEY: audit-ci-key-not-for-production-1234567890
+          DATABASE_URL: 'sqlite:///:memory:'
+          FLASK_DEBUG: 'false'
+        run: python app/supporting_scripts/security_scan.py --skip-http