v0.4.0 — hardening pré-prod : 8 fixes critiques identifiés par audit #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: | |
| - "v*" | |
| workflow_dispatch: | |
| jobs: | |
| build-and-release: | |
| runs-on: windows-latest | |
| permissions: | |
| contents: write # nécessaire pour créer une release et y attacher des assets | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Python 3.13 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.13" | |
| cache: pip | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install pyinstaller pytest | |
| - name: Tests (pré-build) — suite pytest complète | |
| # Avant v0.3.6, on ne lançait QUE test_roundtrip + test_security en | |
| # standalone. Les tests pytest-only (test_resilience_*, test_safety_belt_*, | |
| # etc.) n'étaient PAS exécutés avant un release → risque de release | |
| # cassée. On lance désormais toute la suite ; échec → release bloquée. | |
| run: pytest tests/ -v --tb=short | |
| - name: Build .exe with PyInstaller | |
| run: | | |
| python -m PyInstaller --noconfirm --clean --onefile --windowed ` | |
| --name PZSaveSync ` | |
| --paths src ` | |
| --collect-all customtkinter ` | |
| --collect-all tkinterdnd2 ` | |
| src/pzsavesync/__main__.py | |
| - name: Vérifier que l'exe existe | |
| run: | | |
| if (-not (Test-Path "dist/PZSaveSync.exe")) { | |
| Write-Error "dist/PZSaveSync.exe introuvable" | |
| exit 1 | |
| } | |
| $size = (Get-Item "dist/PZSaveSync.exe").Length | |
| Write-Host "Build OK — PZSaveSync.exe = $($size / 1MB) MB" | |
| - name: Extract release notes (depuis docs/release_notes_<tag>.md si présent) | |
| id: notes | |
| shell: pwsh | |
| run: | | |
| $tag = "${{ github.ref_name }}" | |
| $notesFile = "docs/release_notes_$tag.md" | |
| if (Test-Path $notesFile) { | |
| Write-Host "Notes trouvées : $notesFile" | |
| echo "notes_file=$notesFile" >> $env:GITHUB_OUTPUT | |
| } else { | |
| Write-Host "Pas de notes pour $tag, fallback générique" | |
| "## $tag`n`nVoir [CHANGELOG.md](CHANGELOG.md) pour les détails." | Out-File -FilePath "release_notes_fallback.md" -Encoding utf8 | |
| echo "notes_file=release_notes_fallback.md" >> $env:GITHUB_OUTPUT | |
| } | |
| - name: Create or update GitHub release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| name: ${{ github.ref_name }} | |
| body_path: ${{ steps.notes.outputs.notes_file }} | |
| files: dist/PZSaveSync.exe | |
| fail_on_unmatched_files: true | |
| generate_release_notes: false |