Sécuriser Gitea et alerter sur les échecs CI

src/backend/test/webhook-setup.test.js

@@ -0,0 +1,14 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const root = path.resolve(__dirname, '../../..');
+const setup = fs.readFileSync(path.join(root, 'ops/setup-gitea-webhooks.py'), 'utf8');
+const compose = fs.readFileSync(path.join(root, 'docker-compose.yml'), 'utf8');
+
+assert.match(setup, /"events": \["push", "workflow_run"\]/);
+assert.match(setup, /secrets\.token_hex\(32\)/);
+assert.match(setup, /method=method/);
+assert.doesNotMatch(setup, /GITEA_PASSWORD/);
+assert.match(compose, /WEBHOOK_SECRET=\$\{WEBHOOK_SECRET:\?/);
+console.log('OK webhook setup');