build(deps): bump the actions group across 1 directory with 7 updates #39
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI GitHub Actions - miroir du pipeline Azure DevOps. | |
| # | |
| # Le workload MAUI n'est pas installe sur ubuntu-latest : on cible le back-end | |
| # via FactoryTrack.Server.slnf. Un job separe compile MAUI sur windows-latest. | |
| name: CI | |
| on: | |
| push: | |
| branches: [main, master, 'feature/**', 'fix/**'] | |
| pull_request: | |
| branches: [main, master] | |
| env: | |
| DOTNET_CLI_TELEMETRY_OPTOUT: '1' | |
| DOTNET_NOLOGO: '1' | |
| BUILD_CONFIGURATION: 'Release' | |
| jobs: | |
| backend: | |
| name: Back-end (.NET, Sonar, Trivy) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout complet (Sonar blame) | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Installer .NET SDK 9 | |
| uses: actions/setup-dotnet@v6 | |
| with: | |
| dotnet-version: '9.0.x' | |
| - name: Cache NuGet | |
| uses: actions/cache@v6 | |
| with: | |
| path: ~/.nuget/packages | |
| key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj') }} | |
| restore-keys: nuget-${{ runner.os }}- | |
| - name: Installer JDK 17 (requis par SonarCloud scanner) | |
| uses: actions/setup-java@v5 | |
| with: | |
| distribution: temurin | |
| java-version: '17' | |
| - name: Installer dotnet-sonarscanner | |
| run: dotnet tool install --global dotnet-sonarscanner | |
| - name: SonarCloud begin | |
| # Skip si le secret est absent (ex: PR depuis fork ou setup initial pas fait). | |
| if: env.SONAR_TOKEN != '' | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| dotnet sonarscanner begin \ | |
| /k:"${{ vars.SONAR_PROJECT_KEY }}" \ | |
| /o:"${{ vars.SONAR_ORGANIZATION }}" \ | |
| /d:sonar.token="$SONAR_TOKEN" \ | |
| /d:sonar.host.url="https://sonarcloud.io" \ | |
| /d:sonar.exclusions="src/FactoryTrack.Mobile/**,**/obj/**,**/bin/**,db/init/**" \ | |
| /d:sonar.coverage.exclusions="tests/**,src/FactoryTrack.Simulator/**,src/FactoryTrack.Mobile/**" \ | |
| /d:sonar.cs.opencover.reportsPaths="**/coverage.opencover.xml" \ | |
| /d:sonar.cs.vstest.reportsPaths="**/TestResults/*.trx" | |
| - name: dotnet restore | |
| run: dotnet restore FactoryTrack.Server.slnf | |
| - name: dotnet build (Release) | |
| run: dotnet build FactoryTrack.Server.slnf --configuration $BUILD_CONFIGURATION --no-restore | |
| - name: Tests + couverture (OpenCover) | |
| run: | | |
| for projet in tests/FactoryTrack.UnitTests tests/FactoryTrack.IntegrationTests; do | |
| nom=$(basename "$projet") | |
| dotnet test "$projet/$nom.csproj" \ | |
| --configuration $BUILD_CONFIGURATION \ | |
| --no-build \ | |
| --logger "trx;LogFileName=${nom}.trx" \ | |
| -p:CollectCoverage=true \ | |
| -p:CoverletOutputFormat=opencover \ | |
| -p:CoverletOutput="${{ github.workspace }}/coverage/${nom}.opencover.xml" | |
| done | |
| - name: Publier les resultats de tests | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: test-results | |
| path: '**/TestResults/*.trx' | |
| - name: Publier la couverture | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage | |
| path: coverage/*.opencover.xml | |
| - name: SonarCloud end | |
| if: env.SONAR_TOKEN != '' | |
| env: | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| run: dotnet sonarscanner end /d:sonar.token="$SONAR_TOKEN" | |
| - name: Audit securite dependances | |
| run: | | |
| set -euo pipefail | |
| SORTIE=$(dotnet list FactoryTrack.Server.slnf package --vulnerable --include-transitive 2>&1 || true) | |
| echo "$SORTIE" | |
| if echo "$SORTIE" | grep -qE '>[[:space:]]+[A-Za-z0-9\.]+[[:space:]]'; then | |
| echo "::error::Dependances vulnerables detectees." | |
| exit 1 | |
| fi | |
| mobile: | |
| name: MAUI Windows | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-dotnet@v6 | |
| with: | |
| dotnet-version: '9.0.x' | |
| - name: Installer workloads MAUI | |
| run: dotnet workload install maui-android maui-windows | |
| - name: Build MAUI (Windows) | |
| run: dotnet build src/FactoryTrack.Mobile/FactoryTrack.Mobile.csproj -f net9.0-windows10.0.19041.0 --configuration ${{ env.BUILD_CONFIGURATION }} | |
| docker: | |
| name: Build & scan images Docker | |
| runs-on: ubuntu-latest | |
| needs: backend | |
| if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master') | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: docker compose build | |
| run: docker compose build api ingestion simulateur | |
| - name: Trivy - scan des images (HIGH/CRITICAL bloquant) | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: factorytrack-api | |
| severity: HIGH,CRITICAL | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| - name: Trivy - scan ingestion | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: factorytrack-ingestion | |
| severity: HIGH,CRITICAL | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| - name: Trivy - scan simulateur | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: factorytrack-simulateur | |
| severity: HIGH,CRITICAL | |
| exit-code: '1' | |
| ignore-unfixed: true |