Pipeline qualité & outillage

// quality-gates.ts - 5 gates séquentiels
const gates = [
  { name: 'Compilation + Clippy', cmd: 'cargo build && cargo clippy -- -D warnings' },
  { name: 'Unit Tests', cmd: 'cargo test' },
  { name: 'Security', cmd: 'cargo audit && npm audit' },
  { name: 'Coverage', cmd: 'cargo tarpaulin --threshold 35' },
  { name: 'Frontend', cmd: 'npm run typecheck && npm run lint' },
];

for (const gate of gates) {
  console.log(`\n--- Gate: ${gate.name} ---`);
  const result = execSync(gate.cmd, { stdio: 'pipe' });
  if (result.status !== 0) {
    console.error(`FAILED: ${gate.name}`);
    process.exit(1);
  }
  console.log(`PASSED: ${gate.name}`);
}

// security-owasp-tests.ts - Tests OWASP Top 10
const owaspChecks = [
  { name: 'HTTPS Enforcement', test: () => checkRedirectToHttps(url) },
  { name: 'Rate Limiting', test: () => floodEndpoint(url, 100) },
  { name: 'Security Headers', test: () => validateHeaders(url, [
    'Strict-Transport-Security',
    'Content-Security-Policy',
    'X-Frame-Options',
    'X-Content-Type-Options',
    'Referrer-Policy',
  ])},
  { name: 'SQL Injection', test: () => testSqlInjection(url, payloads) },
  { name: 'XSS Sanitization', test: () => testXssPayloads(url, xssVectors) },
  { name: 'CSRF Protection', test: () => testCsrfToken(url) },
];

// mutation-test.ts - cargo-mutants pour Rust
import { execSync } from 'child_process';

const KILL_RATE_TARGET = 70;

// Lancer les mutations sur les crates critiques
const result = execSync('cargo mutants --package monitoring-domain', {
  encoding: 'utf-8',
});

// Parser le résultat
const match = result.match(/killed: (\d+).*total: (\d+)/);
const killRate = (parseInt(match[1]) / parseInt(match[2])) * 100;

if (killRate < KILL_RATE_TARGET) {
  console.error(`Kill rate ${killRate}% < target ${KILL_RATE_TARGET}%`);
  process.exit(1);
}
console.log(`Mutation kill rate: ${killRate}% (target: ${KILL_RATE_TARGET}%)`);

# Lancer un audit Marble Minotaur en mode CI
npx tsx src/cli.ts https://mon-app.com \
  --ci \
  --ci-threshold 70 \
  --output json

# Résultat :
# {
#   "score": 82,
#   "pages_crawled": 14,
#   "auditors": {
#     "seo": { "score": 95, "issues": 1 },
#     "accessibility": { "score": 78, "issues": 4 },
#     "performance": { "score": 88, "issues": 2 },
#     "security_headers": { "score": 72, "issues": 3 },
#     "forms": { "score": 90, "issues": 0 },
#     "i18n": { "score": 85, "issues": 1 },
#     "images": { "score": 92, "issues": 1 }
#   }
# }

# Lancer un audit complet via Claude Code skill
/audit-industrialisation

# Audits individuels
/audit-architecture    # ADRs, API design, coupling, scalability
/audit-security        # TLS, auth, secrets, incident response
/audit-testing         # Strategy, coverage, flaky tests
/audit-quality         # Code quality, dependencies, data validation
/audit-observability   # Logging, metrics, tracing, alerting
/audit-ci-cd           # Pipelines, métriques DORA, déploiement
/audit-compliance      # GDPR, data governance, FinOps
/audit-performance-frontend  # Rendering, JSC, DOM, memory

# .gitlab-ci.yml - Stages du pipeline
stages:
  - check
  - security
  - build
  - deploy

check:
  stage: check
  parallel:
    matrix:
      - JOB: [cargo-test, clippy, typecheck, lint]
  script:
    - case $JOB in
        cargo-test) cargo test --workspace ;;
        clippy) cargo clippy -- -D warnings ;;
        typecheck) cd frontend && npm run typecheck ;;
        lint) cd frontend && npm run lint ;;
      esac

security:
  stage: security
  script:
    - cargo audit
    - cargo deny check advisories
    - cd frontend && npm audit --audit-level=high
    - gitleaks detect --source . --verbose
    - trivy image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

build:
  stage: build
  script:
    - cargo build --release
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .

deploy:
  stage: deploy
  script:
    - docker compose up -d
    - ./scripts/smoke-test.sh
    - curl -f https://app.example.com/health