AntoineVe/college-infos
1
0
Fork 0
Code Issues 13 Pull Requests 1 Actions Packages Projects Releases 2 Wiki Activity

2 Releases 8 Tags

RSS Feed
  • m14-deployment b474f02e90
    Compare

    M14 — Deploiement

    AntoineVe released this 2026-09-08 17:20:23 +02:00 | 11 commits to main since this release

    Jalon M14 complet : artefacts de deploiement, script de verification
    des secrets et documentation d'exploitation.

    Composants livres :

    • deploy/systemd/pronote-sync.service : unite oneshot, utilisateur
      non-root, durcissement systemd (NoNewPrivileges, ProtectSystem=strict,
      PrivateTmp, ProtectHome), ExecStartPre lance check_secrets.py
    • deploy/systemd/pronote-sync.timer : execution quotidienne a 18:00
    • deploy/logrotate/pronote_sync : rotation quotidienne, 7 archives,
      compress, delaycompress, droits 0640
    • scripts/check_secrets.py : scanner pre-deploiement (regex prefixees,
      mode --staged lisant les blobs index Git, fichiers sans extension)
    • docs/exploitation.md : guide d'installation, supervision, maintenance
    • tests/unit/test_check_secrets.py : 9 tests (clean, literal, unquoted,
      URL, staged, prefixed, short, index-vs-worktree, extensionless)

    Corrections FIXME_M14 (5 constats revue + audit securite) :

    • Regex \b[a-z0-9_]* pour detecter PRONOTE_PASSWORD, AI_API_KEY, etc.
    • --staged lit les blobs index via git show :
    • Fichiers sans extension (pronote_sync) scannes via _EXTRA_NAMES
    • Secret minimum 3 caracteres (au lieu de 8)
    • ContentProvider documente (Sphinx)

    Validation : 636 tests, coverage 95.67%, ruff/mypy/bandit/pre-commit verts.
    Revue independante APPROVED, audit securite APPROVED.

    Downloads