chore: add quality seo a11y security harness

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      npm-all:
+        patterns:
+          - "*"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,78 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: yarn
+      - run: corepack enable
+      - run: yarn install --immutable
+      - run: yarn lint:check
+      - run: yarn typecheck
+      - run: yarn test:coverage --run
+      - name: Upload coverage
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-summary
+          path: |
+            coverage/coverage-summary.json
+            coverage/lcov.info
+          if-no-files-found: warn
+
+  e2e-and-a11y:
+    runs-on: ubuntu-latest
+    needs: quality
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: yarn
+      - run: corepack enable
+      - run: yarn install --immutable
+      - run: yarn playwright install --with-deps chromium
+      - run: yarn test:e2e
+      - name: Upload quality summaries
+        uses: actions/upload-artifact@v4
+        with:
+          name: quality-e2e
+          path: quality-out/
+          if-no-files-found: warn
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report/
+          if-no-files-found: ignore
+
+  lighthouse:
+    runs-on: ubuntu-latest
+    needs: quality
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: yarn
+      - run: corepack enable
+      - run: yarn install --immutable
+      - run: yarn audit:lighthouse
+      - name: Upload Lighthouse CI output
+        uses: actions/upload-artifact@v4
+        with:
+          name: lighthouse-ci
+          path: .lighthouseci/
+          if-no-files-found: error

.github/workflows/dependency-review.yml

@@ -0,0 +1,18 @@
+name: Dependency review
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          license-check: true

.github/workflows/security.yml

@@ -0,0 +1,46 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  codeql:
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@v3
+        with:
+          upload: false
+
+  deps-and-secrets:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: yarn
+      - run: corepack enable
+      - run: yarn install --immutable
+      - run: yarn audit:deps
+      - name: Secret scan
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -5,13 +5,19 @@ dist
 .netlify
 .vinxi
 app.config.timestamp_*.js
+.lighthouseci
+playwright-report
+test-results
+quality-out
+coverage
 
 # Environment
 .env
 .env*.local
 
 # dependencies
 /node_modules
+/.yarn/install-state.gz
 
 # IDEs and editors
 /.idea

.yarnrc.yml

@@ -0,0 +1 @@
+nodeLinker: node-modules

app.config.ts

@@ -1,12 +1,49 @@
-import { defineConfig } from "@solidjs/start/config";
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import path from 'node:path'
+import { defineConfig } from '@solidjs/start/config'
 import tailwindcss from '@tailwindcss/vite'
-import path from "node:path";
+
+type NextFunction = () => void
+type DevServerWithMiddlewares = {
+  middlewares: {
+    use: (
+      handler: (request: IncomingMessage, response: ServerResponse, next: NextFunction) => void,
+    ) => void
+  }
+}
+
+const securityHeaders = {
+  'X-Content-Type-Options': 'nosniff',
+  'X-Frame-Options': 'DENY',
+  'Referrer-Policy': 'strict-origin-when-cross-origin',
+  'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
+}
+
+const securityHeadersPlugin = () => ({
+  name: 'liquid-security-headers',
+  configureServer(server: DevServerWithMiddlewares) {
+    server.middlewares.use((_request, response, next) => {
+      for (const [header, value] of Object.entries(securityHeaders)) {
+        response.setHeader(header, value)
+      }
+      next()
+    })
+  },
+  configurePreviewServer(server: DevServerWithMiddlewares) {
+    server.middlewares.use((_request, response, next) => {
+      for (const [header, value] of Object.entries(securityHeaders)) {
+        response.setHeader(header, value)
+      }
+      next()
+    })
+  },
+})
 
 export default defineConfig({
   ssr: true,
   vite: {
     // @ts-expect-error - Tailwind CSS Vite plugin is not typed
-    plugins: [tailwindcss()],
+    plugins: [tailwindcss(), securityHeadersPlugin()],
     build: {
       chunkSizeWarningLimit: 1000,
     },
@@ -18,4 +55,4 @@ export default defineConfig({
   alias: {
     '~': path.resolve(process.cwd(), 'src'),
   },
-});
+})

biome.json

@@ -0,0 +1,113 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.4/schema.json",
+  "vcs": {
+    "enabled": false,
+    "clientKind": "git",
+    "useIgnoreFile": true
+  },
+  "files": {
+    "ignoreUnknown": true,
+    "includes": [
+      "**",
+      "!node_modules",
+      "!dist",
+      "!build",
+      "!.output",
+      "!.vinxi",
+      "!.svelte-kit",
+      "!.next",
+      "!.nuxt",
+      "!coverage",
+      "!quality-out",
+      "!test-results",
+      "!playwright-report",
+      "!.lighthouseci",
+      "!*.min.js",
+      "!*.min.css",
+      "!package-lock.json",
+      "!yarn.lock",
+      "!pnpm-lock.yaml",
+      "!biome.base.json",
+      "!src/ui/logo.svg"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 100,
+    "lineEnding": "lf"
+  },
+  "javascript": {
+    "formatter": {
+      "quoteStyle": "single",
+      "jsxQuoteStyle": "double",
+      "semicolons": "asNeeded",
+      "trailingCommas": "all",
+      "arrowParentheses": "always",
+      "bracketSpacing": true
+    }
+  },
+  "json": {
+    "formatter": {
+      "enabled": true,
+      "indentWidth": 2,
+      "trailingCommas": "none"
+    }
+  },
+  "css": {
+    "parser": {
+      "tailwindDirectives": true
+    },
+    "formatter": {
+      "enabled": true,
+      "indentWidth": 2,
+      "quoteStyle": "double"
+    }
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "preset": "recommended",
+      "a11y": {
+        "noStaticElementInteractions": "off",
+        "useAriaPropsSupportedByRole": "off",
+        "useSemanticElements": "off"
+      },
+      "suspicious": {
+        "noExplicitAny": "warn",
+        "noUnknownAtRules": {
+          "level": "off",
+          "options": {
+            "ignore": [
+              "apply",
+              "config",
+              "container",
+              "custom-variant",
+              "layer",
+              "plugin",
+              "reference",
+              "screen",
+              "source",
+              "tailwind",
+              "theme",
+              "utility",
+              "variant",
+              "variants"
+            ]
+          }
+        }
+      },
+      "style": {
+        "useImportType": "warn",
+        "useConsistentArrayType": "warn"
+      },
+      "complexity": {
+        "noBannedTypes": "warn"
+      },
+      "correctness": {
+        "useExhaustiveDependencies": "off"
+      }
+    }
+  }
+}

global.d.ts

@@ -1 +1 @@
-// Stripe est chargé via @stripe/stripe-js, pas besoin de déclarations globales
+// Stripe est chargé via @stripe/stripe-js, pas besoin de déclarations globales