From 8f4c7fa47a08be78312b67b0a920ff1bd59cf445 Mon Sep 17 00:00:00 2001 From: Xor290 Date: Sun, 20 Sep 2026 12:17:57 +0200 Subject: [PATCH] chore: build --- .github/workflows/backend-image.yml | 97 +++++++++++++--------------- .github/workflows/frontend-image.yml | 92 +++++++++++--------------- 2 files changed, 83 insertions(+), 106 deletions(-) diff --git a/.github/workflows/backend-image.yml b/.github/workflows/backend-image.yml index cf290dc..b3a973d 100644 --- a/.github/workflows/backend-image.yml +++ b/.github/workflows/backend-image.yml @@ -1,75 +1,66 @@ -name: backend-image +name: ci-api + +# CI pour control-plane/api (Go) : build, vet, tests, puis publication de l'image +# Docker sur push vers main. -# Construit l'image du backend (Go/Gin) et la pousse sur Docker Hub. -# - push sur main -> tags :latest et :sha- -# - tag vX.Y.Z -> tag :X.Y.Z (en plus du :sha-) -# - pull request -> build seul, rien n'est poussé -# -# Secrets à créer dans GitHub (Settings > Secrets and variables > Actions) : -# DOCKERHUB_USERNAME compte Docker Hub qui possède le dépôt d'images -# DOCKERHUB_TOKEN access token Docker Hub (droits Read & Write), jamais le mot de passe -# -# L'image est celle à renseigner dans VITRINE_BACKEND_IMAGE côté control-plane Omnex. on: push: branches: [main] - tags: ["v*"] paths: - "backend/**" - - ".github/workflows/backend-image.yml" pull_request: paths: - "backend/**" - - ".github/workflows/backend-image.yml" - workflow_dispatch: - -permissions: - contents: read - -# Un seul build par branche/tag : un nouveau push annule celui en cours. -concurrency: - group: backend-image-${{ github.ref }} - cancel-in-progress: true - -env: - IMAGE: xor1234/vitrine-backend + workflow_dispatch: {} jobs: - build: + test: runs-on: ubuntu-latest - timeout-minutes: 20 + defaults: + run: + working-directory: backend steps: - - uses: actions/checkout@v4 + - name: Checkout + uses: actions/checkout@v4 - - uses: docker/setup-buildx-action@v3 + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version: "1.26.0" + cache-dependency-path: backend/go.sum - # Pas de login sur les pull requests : les secrets n'y sont pas exposés - # (forks) et rien n'est poussé. - - name: Login Docker Hub - if: github.event_name != 'pull_request' + - name: Vet + run: go vet ./... + + - name: Test + run: go test ./... + + - name: Build + run: go build ./... + + - name: Install & run gosec + continue-on-error: true + run: | + go install github.com/securego/gosec/v2/cmd/gosec@latest + gosec ./... + + - name: Set up Docker Buildx + if: github.event_name == 'push' && github.ref == 'refs/heads/main' + uses: docker/setup-buildx-action@v3 + + - name: Log in to Docker Hub + if: github.event_name == 'push' && github.ref == 'refs/heads/main' uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Tags et labels de l'image - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.IMAGE }} - tags: | - type=raw,value=latest,enable={{is_default_branch}} - type=sha,format=short - type=semver,pattern={{version}} - - - name: Build et push + - name: Build & push api + if: github.event_name == 'push' && github.ref == 'refs/heads/main' uses: docker/build-push-action@v6 with: - context: backend - file: backend/Dockerfile - platforms: linux/amd64 - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha,scope=backend - cache-to: type=gha,mode=max,scope=backend + context: ./control-plane/api + file: ./control-plane/api/Dockerfile + push: true + tags: | + ${{ secrets.DOCKERHUB_USERNAME }}/vitrine-api:latest diff --git a/.github/workflows/frontend-image.yml b/.github/workflows/frontend-image.yml index a4621ac..9e2a600 100644 --- a/.github/workflows/frontend-image.yml +++ b/.github/workflows/frontend-image.yml @@ -1,75 +1,61 @@ -name: frontend-image +name: ci-web + +# CI pour web (Vite/React) : install, typecheck, tests, build, puis publication +# de l'image Docker sur push vers main. -# Construit l'image du frontend (SPA Vite/React + nginx) et la pousse sur Docker Hub. -# - push sur main -> tags :latest et :sha- -# - tag vX.Y.Z -> tag :X.Y.Z (en plus du :sha-) -# - pull request -> build seul, rien n'est poussé -# -# Secrets à créer dans GitHub (Settings > Secrets and variables > Actions) : -# DOCKERHUB_USERNAME compte Docker Hub qui possède le dépôt d'images -# DOCKERHUB_TOKEN access token Docker Hub (droits Read & Write), jamais le mot de passe -# -# L'image est celle à renseigner dans VITRINE_FRONTEND_IMAGE côté control-plane Omnex. on: push: branches: [main] - tags: ["v*"] paths: - "frontend/**" - - ".github/workflows/frontend-image.yml" pull_request: paths: - "frontend/**" - - ".github/workflows/frontend-image.yml" - workflow_dispatch: - -permissions: - contents: read - -# Un seul build par branche/tag : un nouveau push annule celui en cours. -concurrency: - group: frontend-image-${{ github.ref }} - cancel-in-progress: true - -env: - IMAGE: xor1234/vitrine-frontend + workflow_dispatch: {} jobs: - build: + test: runs-on: ubuntu-latest - timeout-minutes: 20 + defaults: + run: + working-directory: web steps: - - uses: actions/checkout@v4 + - name: Checkout + uses: actions/checkout@v4 - - uses: docker/setup-buildx-action@v3 + - name: Set up Node + uses: actions/setup-node@v4 + with: + node-version: "20" + cache: "npm" + cache-dependency-path: frontend/package-lock.json - # Pas de login sur les pull requests : les secrets n'y sont pas exposés - # (forks) et rien n'est poussé. - - name: Login Docker Hub - if: github.event_name != 'pull_request' + - name: Install dependencies + run: npm ci + + - name: Typecheck + run: npm run typecheck + + - name: Build + run: npm run build + + - name: Set up Docker Buildx + if: github.event_name == 'push' && github.ref == 'refs/heads/main' + uses: docker/setup-buildx-action@v3 + + - name: Log in to Docker Hub + if: github.event_name == 'push' && github.ref == 'refs/heads/main' uses: docker/login-action@v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Tags et labels de l'image - id: meta - uses: docker/metadata-action@v5 - with: - images: ${{ env.IMAGE }} - tags: | - type=raw,value=latest,enable={{is_default_branch}} - type=sha,format=short - type=semver,pattern={{version}} - - - name: Build et push + - name: Build & push web + if: github.event_name == 'push' && github.ref == 'refs/heads/main' uses: docker/build-push-action@v6 with: - context: frontend - file: frontend/Dockerfile - platforms: linux/amd64 - push: ${{ github.event_name != 'pull_request' }} - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - cache-from: type=gha,scope=frontend - cache-to: type=gha,mode=max,scope=frontend + context: ./web + file: ./web/Dockerfile + push: true + tags: | + ${{ secrets.DOCKERHUB_USERNAME }}/vitrine-web:latest