feat(ci): conditionner les déploiements et exposer les métriques

src/backend/package.json

@@ -6,7 +6,7 @@
   "scripts": {
     "start": "node src/index.js",
     "dev": "nodemon src/index.js",
-    "test": "node test/app-registry.test.js && node test/healthcheck.test.js && node test/webhook.test.js"
+    "test": "node test/app-registry.test.js && node test/healthcheck.test.js && node test/webhook.test.js && node test/gitea.test.js"
   },
   "dependencies": {
     "express": "^4.21.0",

src/backend/src/app-registry.js

@@ -44,6 +44,12 @@ function normalizeManifest(manifest, directory, environment) {
   if (!isHttpsUrl(manifest.urls[environment])) {
     throw new Error(`urls.${environment} absent ou invalide`);
   }
+  if (manifest.ci !== undefined && (
+    !manifest.ci || typeof manifest.ci !== 'object' || Array.isArray(manifest.ci) ||
+    (manifest.ci.required !== undefined && typeof manifest.ci.required !== 'boolean')
+  )) {
+    throw new Error('ci doit être un objet avec une propriété required booléenne');
+  }
 
   return {
     ...manifest,
@@ -51,6 +57,7 @@ function normalizeManifest(manifest, directory, environment) {
     directory,
     containerName: manifest.containerName || manifest.id,
     healthCheckUrl: manifest.urls[environment],
+    ci: { required: manifest.ci?.required === true },
   };
 }
 
@@ -131,14 +138,23 @@ function writeAppManifest({ appsBasePath, environment, app }) {
 }
 
 function findAppDirectoryByRepo(config, repositoryName) {
-  const { apps } = refreshApps(config);
-  const app = apps.find((candidate) => candidate.giteaRepo === repositoryName || candidate.id === repositoryName);
+  const app = findAppByRepo(config, repositoryName);
   return app ? app.directory : null;
 }
 
+/**
+ * Retourne le manifeste complet afin que le webhook applique les règles de
+ * promotion déclarées par l'application (notamment ci.required).
+ */
+function findAppByRepo(config, repositoryName) {
+  const { apps } = refreshApps(config);
+  return apps.find((candidate) => candidate.giteaRepo === repositoryName || candidate.id === repositoryName) || null;
+}
+
 module.exports = {
   discoverApps,
   refreshApps,
   writeAppManifest,
   findAppDirectoryByRepo,
+  findAppByRepo,
 };

src/backend/src/gitea.js

@@ -70,6 +70,48 @@ async function getBranches(owner, repo) {
   }
 }
 
+function toDurationSeconds(startedAt, completedAt) {
+  if (!startedAt || !completedAt) return null;
+  const milliseconds = new Date(completedAt).getTime() - new Date(startedAt).getTime();
+  return Number.isFinite(milliseconds) && milliseconds >= 0 ? Math.round(milliseconds / 1000) : null;
+}
+
+/** Normalise les exécutions CI pour le webhook et le dashboard. */
+function normalizeWorkflowRun(run) {
+  const startedAt = run.run_started_at || run.started_at || null;
+  const completedAt = run.updated_at || (run.status === 'completed' ? run.created_at : null);
+  return {
+    id: run.id,
+    name: run.name || run.workflow_id || 'Validation CI',
+    status: run.status || 'unknown',
+    conclusion: run.conclusion || null,
+    event: run.event || null,
+    commit: run.head_sha || null,
+    createdAt: run.created_at || null,
+    startedAt,
+    completedAt,
+    durationSeconds: toDurationSeconds(startedAt, completedAt),
+    url: run.html_url || null,
+  };
+}
+
+async function getWorkflowRuns(owner, repo, limit = 10) {
+  try {
+    const response = await giteaClient.get(`/repos/${owner}/${repo}/actions/runs`, {
+      params: { limit, page: 1 },
+    });
+    return (response.data.workflow_runs || []).map(normalizeWorkflowRun);
+  } catch (err) {
+    console.error(`Erreur Gitea getWorkflowRuns ${owner}/${repo}:`, err.message);
+    return [];
+  }
+}
+
+async function getWorkflowRunForCommit(owner, repo, commitHash) {
+  const runs = await getWorkflowRuns(owner, repo, 30);
+  return runs.find((run) => run.commit && run.commit.startsWith(commitHash)) || null;
+}
+
 /**
  * Récupérer tous les dépôts (avec retry en cas d'erreur DNS)
  */
@@ -113,6 +155,9 @@ module.exports = {
   getRepo,
   getCommits,
   getBranches,
+  getWorkflowRuns,
+  getWorkflowRunForCommit,
+  normalizeWorkflowRun,
   listRepos,
   createRepo,
   giteaClient,

src/backend/src/routes.js

@@ -4,7 +4,7 @@ const path = require('path');
 const fs = require('fs');
 const { authenticate, authMiddleware } = require('./auth');
 const { docker, getContainerInfo, getContainerLogs, listContainers, redeployApp, gitPull, startContainer, stopContainer, restartContainer, getServerMetrics } = require('./docker');
-const { getRepo, getCommits, getBranches, listRepos } = require('./gitea');
+const { getRepo, getCommits, getBranches, getWorkflowRuns, listRepos } = require('./gitea');
 const { checkAllApps, addDeploymentLog, updateDeploymentLog, getDeploymentLogs, getAllStatuses, getAppStatus, cleanupOrphanedDeployments } = require('./healthcheck');
 const { createApplication, getAvailableStacks, initDynamicApps } = require('./app-creator');
 const config = require('./config');
@@ -399,6 +399,16 @@ router.get('/gitea/repos/:owner/:repo/branches', authMiddleware, async (req, res
   }
 });
 
+// Dernières validations CI avec statut et durée, utilisées par l'écran Gitea.
+router.get('/gitea/repos/:owner/:repo/actions/runs', authMiddleware, async (req, res) => {
+  try {
+    const runs = await getWorkflowRuns(req.params.owner, req.params.repo, 10);
+    res.json(runs);
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
 // ============ PUBLIC STATUS ROUTE (sans authentification) ============
 // Utilisé par le portail applicatif pour griser les tuiles des apps arrêtées
 router.get('/public/status', async (req, res) => {

src/backend/src/webhook.js

@@ -9,7 +9,8 @@ const { execFile } = require('child_process');
 const path = require('path');
 const fs = require('fs');
 const config = require('./config');
-const { findAppDirectoryByRepo } = require('./app-registry');
+const { findAppByRepo } = require('./app-registry');
+const { getWorkflowRunForCommit } = require('./gitea');
 
 const router = express.Router();
 
@@ -19,6 +20,8 @@ const DEPLOY_SCRIPT = '/opt/manus-deploy/scripts/deploy-app.sh';
 const LOG_DIR = '/var/log/manus-deploy';
 const DASHBOARD_APP_ID = 'manus-dashboard';
 const DASHBOARD_DEPLOY_REQUEST = path.join(APPS_BASE_PATH, DASHBOARD_APP_ID, '.deployment-request');
+const CI_GATE_TIMEOUT_MS = Number.parseInt(process.env.CI_GATE_TIMEOUT_MS, 10) || 5 * 60 * 1000;
+const CI_GATE_POLL_INTERVAL_MS = Number.parseInt(process.env.CI_GATE_POLL_INTERVAL_MS, 10) || 3000;
 
 // Déploiements en cours (évite les doubles déclenchements)
 const deployingApps = new Set();
@@ -44,6 +47,54 @@ function requestDashboardHostDeployment({ branch, commitHash, committer }) {
   fs.renameSync(temporaryRequest, DASHBOARD_DEPLOY_REQUEST);
 }
 
+function shouldRequireCi(app) {
+  return app?.ci?.required === true;
+}
+
+function saveDeploymentStatus(appName, status) {
+  try {
+    fs.mkdirSync(LOG_DIR, { recursive: true });
+    fs.writeFileSync(path.join(LOG_DIR, `${appName}-last-deploy.json`), JSON.stringify(status, null, 2));
+  } catch (error) {
+    console.error('[Webhook] Erreur sauvegarde statut:', error.message);
+  }
+}
+
+function wait(delay) {
+  return new Promise((resolve) => setTimeout(resolve, delay));
+}
+
+/**
+ * Une application déclarant ci.required ne peut être déployée que si le commit
+ * reçu dispose d’un run Gitea terminé avec succès.
+ */
+async function waitForSuccessfulCi(app, commitHash) {
+  const owner = app.giteaOwner || 'manus-admin';
+  const repo = app.giteaRepo || app.id;
+  const deadline = Date.now() + CI_GATE_TIMEOUT_MS;
+  let lastRun = null;
+
+  while (Date.now() < deadline) {
+    lastRun = await getWorkflowRunForCommit(owner, repo, commitHash);
+    if (lastRun?.status === 'completed') {
+      return {
+        allowed: lastRun.conclusion === 'success',
+        run: lastRun,
+        reason: lastRun.conclusion === 'success'
+          ? null
+          : `La CI est terminée avec le statut ${lastRun.conclusion || 'inconnu'}`,
+      };
+    }
+    await wait(CI_GATE_POLL_INTERVAL_MS);
+  }
+
+  return {
+    allowed: false,
+    run: lastRun,
+    reason: lastRun ? 'La CI n’a pas terminé dans le délai autorisé' : 'Aucune validation CI trouvée pour ce commit',
+  };
+}
+
 function verifyGiteaSignature(req) {
   if (!WEBHOOK_SECRET) {
     console.warn('[Webhook] AVERTISSEMENT: WEBHOOK_SECRET non défini. Validation désactivée.');
@@ -93,16 +144,41 @@ function runDeploy(appName, branch, commitHash, committer, broadcast) {
     if (broadcast) {
       broadcast({ type: 'deploy_finished', data: { app: appName, status, exitCode: code } });
     }
-    try {
-      fs.mkdirSync(LOG_DIR, { recursive: true });
-      fs.writeFileSync(path.join(LOG_DIR, `${appName}-last-deploy.json`), JSON.stringify({
-        app: appName, branch, commit: commitHash, committer, status, exitCode: code,
-        timestamp: new Date().toISOString(), output: output.slice(-3000),
-      }, null, 2));
-    } catch (e) { console.error('[Webhook] Erreur sauvegarde statut:', e.message); }
+    saveDeploymentStatus(appName, {
+      app: appName, branch, commit: commitHash, committer, status, exitCode: code,
+      timestamp: new Date().toISOString(), output: output.slice(-3000),
+    });
   });
 }
 
+async function gateAndDeploy(app, branch, commitHash, committer, broadcast) {
+  if (shouldRequireCi(app)) {
+    const ci = await waitForSuccessfulCi(app, commitHash);
+    if (!ci.allowed) {
+      const status = {
+        app: app.directory,
+        branch,
+        commit: commitHash,
+        committer,
+        status: 'blocked',
+        timestamp: new Date().toISOString(),
+        ci: ci.run,
+        reason: ci.reason,
+      };
+      console.warn(`[Webhook] Déploiement bloqué pour ${app.directory}: ${ci.reason}`);
+      saveDeploymentStatus(app.directory, status);
+      broadcast?.({ type: 'deploy_blocked', data: status });
+      return;
+    }
+  }
+
+  if (isHostManagedDeployment(app.directory)) {
+    requestDashboardHostDeployment({ branch, commitHash, committer });
+    return;
+  }
+  runDeploy(app.directory, branch, commitHash, committer, broadcast);
+}
+
 // POST /api/webhook/gitea
 router.post('/gitea', (req, res) => {
   if (!verifyGiteaSignature(req)) {
@@ -122,24 +198,20 @@ router.post('/gitea', (req, res) => {
   console.log(`[Webhook] Push: repo=${repoName}, branch=${branch}, commit=${commitHash}, by=${committer}`);
 
   // Le manifeste app.json associe le dépôt au dossier déployé : pas de mapping statique à maintenir.
-  const appName = findAppDirectoryByRepo(config, repoName);
-  if (!appName) return res.status(200).json({ message: `Dépôt ${repoName} non déployé ou sans manifeste valide` });
+  const app = findAppByRepo(config, repoName);
+  if (!app) return res.status(200).json({ message: `Dépôt ${repoName} non déployé ou sans manifeste valide` });
   if (branch !== 'main') return res.status(200).json({ message: `Branch ${branch} ignorée` });
 
-  if (isHostManagedDeployment(appName)) {
-    requestDashboardHostDeployment({ branch, commitHash, committer });
-    return res.status(202).json({
-      message: 'Redéploiement du dashboard confié au service hôte',
-      commit: commitHash,
-      branch,
-    });
-  }
-
-  res.status(202).json({ message: `Déploiement de ${appName} déclenché`, commit: commitHash, branch, committer });
+  res.status(202).json({
+    message: shouldRequireCi(app) ? `Validation CI requise avant déploiement de ${app.directory}` : `Déploiement de ${app.directory} déclenché`,
+    commit: commitHash,
+    branch,
+    ciRequired: shouldRequireCi(app),
+  });
 
   // Récupérer la fonction broadcast si disponible globalement
   const broadcastFn = global.wsBroadcast || null;
-  setImmediate(() => runDeploy(appName, branch, commitHash, committer, broadcastFn));
+  setImmediate(() => gateAndDeploy(app, branch, commitHash, committer, broadcastFn));
 });
 
 // GET /api/webhook/status/:appName
@@ -168,3 +240,5 @@ router.get('/status', (req, res) => {
 
 module.exports = router;
 module.exports.isHostManagedDeployment = isHostManagedDeployment;
+module.exports.shouldRequireCi = shouldRequireCi;
+module.exports.waitForSuccessfulCi = waitForSuccessfulCi;

src/backend/test/gitea.test.js

@@ -0,0 +1,18 @@
+const assert = require('node:assert/strict');
+const { normalizeWorkflowRun } = require('../src/gitea');
+
+const run = normalizeWorkflowRun({
+  id: 42,
+  name: 'Validation',
+  status: 'completed',
+  conclusion: 'success',
+  head_sha: 'abcdef123456',
+  created_at: '2026-08-18T10:00:00Z',
+  run_started_at: '2026-08-18T10:00:10Z',
+  updated_at: '2026-08-18T10:02:15Z',
+});
+
+assert.equal(run.commit, 'abcdef123456');
+assert.equal(run.durationSeconds, 125);
+assert.equal(run.conclusion, 'success');
+console.log('OK gitea');

src/backend/test/webhook.test.js

@@ -4,8 +4,11 @@
  * donc déléguer ce cas précis à un service systemd hôte.
  */
 const assert = require('node:assert/strict');
-const { isHostManagedDeployment } = require('../src/webhook');
+const { isHostManagedDeployment, shouldRequireCi } = require('../src/webhook');
 
 assert.equal(isHostManagedDeployment('manus-dashboard'), true);
 assert.equal(isHostManagedDeployment('itinova-contacts'), false);
+assert.equal(shouldRequireCi({ ci: { required: true } }), true);
+assert.equal(shouldRequireCi({ ci: { required: false } }), false);
+assert.equal(shouldRequireCi({}), false);
 console.log('OK webhook');