Tuto CI pour GitHub

name: CI

on:
  push:
    branches: [main]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "Hello CI"

on:
  push:
    branches: [main]            # uniquement sur main
  pull_request:
    paths:                      # uniquement si ces fichiers changent
      - 'src/**'
      - 'package.json'
  workflow_dispatch:            # bouton manuel dans l'UI GitHub
  schedule:
    - cron: '0 4 * * 1'         # tous les lundis à 4h UTC

env:
  NODE_ENV: test

jobs:
  build:
    env:
      LOG_LEVEL: debug
    steps:
      - run: echo "NODE_ENV=$NODE_ENV LOG_LEVEL=$LOG_LEVEL"

# Step qui ne tourne que sur main
- name: Deploy
  if: github.ref == 'refs/heads/main'
  run: ./deploy.sh

# Step qui ne tourne que si le précédent a réussi
- if: success()
  run: echo "OK"

- uses: actions/checkout@v4

- uses: actions/setup-node@v4
  with:
    node-version-file: '.nvmrc'   # lit la version depuis .nvmrc
    cache: 'npm'                   # cache automatique de ~/.npm

- run: npm ci
- run: npm run lint
- run: npm test -- --coverage

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node: [20, 22]
        os: [ubuntu-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: 'npm'
      - run: npm ci
      - run: npm test

- run: npm test -- --coverage

- uses: actions/upload-artifact@v4
  with:
    name: coverage
    path: coverage/
    retention-days: 7

# Audit npm bloquant sur les vulnérabilités hautes
- run: npm audit --audit-level=high

# Review automatique des dépendances ajoutées dans une PR
- uses: actions/dependency-review-action@v4
  if: github.event_name == 'pull_request'

- run: ./deploy.sh
  env:
    API_TOKEN: ${{ secrets.API_TOKEN }}

permissions:
  contents: read           # lecture du code, c'est tout
  pull-requests: write     # commenter les PR
  # tous les autres scopes par défaut à 'none'

jobs:
  test:
    runs-on: ubuntu-latest
    # ...

# Action officielle GitHub : tag OK
- uses: actions/checkout@v4

# Action tierce : pinne le SHA
- uses: super/sketchy-action@e2f4a3b1c9d8...   # v2.1.0

permissions:
  id-token: write           # nécessaire pour OIDC
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123:role/github-deploy
          aws-region: eu-west-3

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  install:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: 'npm' }
      - run: npm ci

  lint:
    needs: install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: 'npm' }
      - run: npm ci
      - run: npm run lint

  test:
    needs: install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 22, cache: 'npm' }
      - run: npm ci
      - run: npm test

- uses: actions/cache@v4
  with:
    path: |
      .next/cache
      node_modules/.cache
    key: ${{ runner.os }}-build-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-build-

jobs:
  test:
    runs-on: ubuntu-latest
    steps: # ...

  deploy:
    needs: test
    if: github.ref == 'refs/heads/main'
    environment:
      name: production
      url: https://anais-formation-tech.fr
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: ./deploy.sh
        env:
          DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

on:
  push:
    tags: ['v*']

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          registry-url: 'https://registry.npmjs.org'
      - run: npm ci
      - run: npm test
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}