demander IA de faire tous les modifications pour que le webapp soit pret au déploiement.

Force connection HTTPS, proxy-inversé, WSGI de production, reset cookie de conncection à chaque reconnection, limite sur les mdp, fichiers et One on One par minute, verification d'injection de SQL dans les champs d'entrées. renommage des fichiers lors du téléchargement, fichier de backup quotidien pour la bd et j'ai oublié quelque chose :(

.github/dependabot.yml

@@ -0,0 +1,40 @@
+# Dependabot configuration for automated dependency updates
+# 
+# Dependabot creates PRs when dependencies have new versions,
+# helping keep the application secure and up-to-date.
+
+version: 2
+updates:
+  # Python dependencies (pip)
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "America/Toronto"
+    # Group all updates into a single PR
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+    # Limit open PRs to avoid overwhelm
+    open-pull-requests-limit: 5
+    # Labels for PRs
+    labels:
+      - "dependencies"
+      - "security"
+    # Assign reviewer
+    reviewers:
+      - "cedrick2711"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      time: "09:00"
+      timezone: "America/Toronto"
+    labels:
+      - "dependencies"
+      - "ci"

.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+name: CI - Security & Lint
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+  workflow_dispatch:  # Allow manual triggers
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  security-audit:
+    name: Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: pip install pip-audit
+
+      - name: Scan for vulnerable dependencies
+        run: pip-audit --require-hashes --no-deps || pip-audit
+
+  lint:
+    name: Lint with Ruff
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Run ruff linter
+        run: ruff check . --output-format=github
+
+      - name: Run ruff formatter check
+        run: ruff format --check .
+
+  security-scan:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install app dependencies
+        run: pip install -r requirements.txt
+
+      - name: Run security scan
+        env:
+          SECRET_KEY: ${{ secrets.CI_SECRET_KEY || 'test-key-not-for-production-1234567890' }}
+          FLASK_DEBUG: 'false'
+        run: python security_scan.py --skip-http
+
+  test:
+    name: Tests
+    runs-on: ubuntu-latest
+    needs: [security-audit, lint]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt
+
+      - name: Run tests
+        run: |
+          echo "No tests configured yet. Add tests to the project."
+          # python -m pytest tests/ --cov=. --cov-report=xml
+        continue-on-error: true