Repository navigation
Portfolio vocal : v0 RAG, voix clonée, vrai corpus, sécurité et CI #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI de PortFolio-AI : tests, build et controles de securite. | |
| # | |
| # Hors perimetre, par construction : le STT (wheels ROCm Windows uniquement), | |
| # le TTS et l'inference reelle (GPU + modeles de plusieurs Go). Les tests | |
| # d'integration (test_pertinence) se sautent d'eux-memes sans Qdrant/Ollama. | |
| # | |
| # Actions epinglees par SHA de commit (le tag est en commentaire) : un tag | |
| # peut etre deplace, un SHA non. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| backend: | |
| name: Backend (tests) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| cache-dependency-path: backend/tests/requirements-dev.txt | |
| - run: pip install -r backend/tests/requirements-dev.txt | |
| - run: python -m pytest backend/tests -q | |
| frontend: | |
| name: Frontend (tests, typecheck, build) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| defaults: | |
| run: | |
| working-directory: frontend | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - run: npm ci | |
| - run: npx vitest run | |
| - run: npx tsc --noEmit | |
| # Le build echoue sans NEXT_PUBLIC_API_URL (garde-fou de VoiceChat.tsx). | |
| - run: npm run build | |
| env: | |
| NEXT_PUBLIC_API_URL: https://example.invalid/api | |
| docker: | |
| name: Docker (build du service rag) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - run: docker compose build rag | |
| securite: | |
| name: Securite (secrets, dependances) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 # tout l'historique : un secret supprime reste dans git | |
| - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| # Dependances epinglees de ce qui tourne en production (RAG + API). | |
| - run: pip install pip-audit | |
| - run: pip-audit -r backend/rag/requirements.txt -r backend/api/requirements.txt | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: "22" | |
| - run: npm audit --omit=dev --audit-level=high | |
| working-directory: frontend |