Sécuriser Gitea et alerter sur les échecs CI

src/backend/test/token-rotation.test.js

@@ -0,0 +1,19 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const root = path.resolve(__dirname, '../../..');
+const rotation = fs.readFileSync(path.join(root, 'ops/gitea-token-rotation.sh'), 'utf8');
+const timer = fs.readFileSync(path.join(root, 'ops/gitea-token-rotation.timer'), 'utf8');
+const approvalPath = fs.readFileSync(path.join(root, 'ops/gitea-token-rotation-apply.path'), 'utf8');
+
+assert.match(rotation, /generate-access-token/);
+assert.match(rotation, /pending_approval/);
+assert.match(rotation, /GITEA_ROTATION_APPLIED/);
+assert.match(rotation, /chmod 0600/);
+assert.match(rotation, /rollback/);
+assert.doesNotMatch(rotation, /GITEA_PASSWORD/);
+assert.match(timer, /OnCalendar=\*-01,04,07,10-01 07:00:00/);
+assert.match(timer, /Persistent=true/);
+assert.match(approvalPath, /PathExists=.*approval\.request/);
+console.log('OK token rotation');