git switch -C staging
git push origin staging

steps:
  - name: Checkout code
    uses: actions/checkout@v6.0.1

  - name: Set up JDK 17
    uses: actions/setup-java@v5
    with:
      distribution: 'temurin'
      java-version: '17'

  - name: Cache Maven dependencies
    uses: actions/cache@
    with:
      path: ~/.m2/repository
      key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}

  - name: Check formatting (Spotless)
    run: ./mvnw spotless:check

  - name: Initialize CodeQL
    uses: github/codeql-action/init@v4.32.2
    with:
      languages: java

Les étapes:

On ajoute un Cache Maven dependencies:

On ajoute (CI de base)

- name: Wait for PostgreSQL
  run: |
    until pg_isready -h localhost -p 5432 -U postgres; do
      sleep 2
    done

On attends que Postgres soit prêt

- name: Run Unit Tests
  env:
    SPRING_PROFILES_ACTIVE: test
  run: ./mvnw -B clean test

- name: Run Integration Tests
  env:
    SPRING_PROFILES_ACTIVE: it
    SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/flashcardsdb
    SPRING_DATASOURCE_USERNAME: postgres
    SPRING_DATASOURCE_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
  run: ./mvnw -B verify -DskipUnitTests=true

- name: Verify Coverage 70%
  run: ./mvnw -B clean verify jacoco:report -Djacoco.minimum.coverage=0.70

- name: Upload JaCoCo artifacts
  uses: actions/upload-artifact@v6
  with:
    name: jacoco-report
    path: |
      target/site/jacoco/index.html
      target/site/jacoco/jacoco.xml

- name: Upload application JAR
  uses: actions/upload-artifact@v6
  with:
    name: app-jar
    path: target/*.jar
    if-no-files-found: error

- name: Perform CodeQL analysis
  uses: github/codeql-action/analyze@v4.32.2

- name: Scan filesystem with Trivy
  uses: aquasecurity/trivy-action@v0.28
  with:
    scan-type: fs
    scan-ref: .
    format: table
    severity: HIGH,CRITICAL

functional-tests:
  runs-on: ubuntu-24.04
  needs: build-test-static-analysis
  services:
    postgres:
      image: postgres:16
      ports:
        - 5432:5432
      env:
        POSTGRES_DB: flashcardsdb
        POSTGRES_USER: postgres
        POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}

steps:
  - name: Checkout code
    uses: actions/checkout@v6.0.1

  - name: Download application JAR
    uses: actions/download-artifact@v7
    with:
      name: app-jar
      path: app-jar

  - name: Set up JDK 17
    uses: actions/setup-java@v5
    with:
      distribution: 'temurin'
      java-version: '17'

  - name: Start Spring Boot
    run: |
      cd app-jar
      touch spring.log

      nohup java \
        -Dspring.datasource.url=jdbc:postgresql://localhost:5432/flashcardsdb \
        -Dspring.datasource.username=postgres \
        -Dspring.datasource.password=${{ secrets.POSTGRES_PASSWORD }} \
        -Dspring.profiles.active=staging \
        -Dserver.port=8081 \
        -jar flashcards-1.0.0.jar \
        >> spring.log 2>&1 &

      for i in {1..30}; do
        nc -z localhost 8081 && break
        sleep 2
      done
      nc -z localhost 8081 || exit 1

Les étapes:

On télécharge l'artefact du job précédent:

→ Il crée un fichier nommé spring.log
    et lance l'application via nohup

→ Le profil "staging" et le port 8081
    sont injectés via des propriétés système Java

→ Il consomme ensuite le JAR téléchargé plus tôt

→ Il tente de contacter le port toutes les 2 sec
→ Si le service ne répond pas après 30 tentatives
    (60 sec); le script (et le build) échoue

Le fichier log sera téléchargé en tant qu'artefact

- name: Set up Node.js (for Newman)
  uses: actions/setup-node@
  with:
    node-version: 20

- name: Install Newman
  run: npm install -g newman

- name: Run API Tests - Functional
  run: |
    newman run postman/flashcards.postman_collection.json \
    -e postman/local.postman_environment.json \
    --reporters cli,junit \
    --reporter-junit-export newman-functional.xml

- name: Run API Tests - Error cases
  run: |
    newman run postman/flashcards_error_cases.postman_collection.json \
    -e postman/local.postman_environment.json \
    --reporters cli,junit \
    --reporter-junit-export newman-error.xml

Installation de Node + Newman:

→ Lance les collections postman_collection.json

→ Utilise l'environement local
    qui pointe vers http://localhost:8081

→ Affiche les résultats dans la console et génère
    les rapports XML

- name: Upload Newman JUnit reports
  if: always()
  uses: actions/upload-artifact@v6
  with:
    name: newman-reports
    path: |
      newman-functional.xml
      newman-error.xml

- name: Upload Spring Boot logs
  if: always()
  uses: actions/upload-artifact@v6
  with:
    name: spring-boot-logs
    path: app-jar/spring.log
    if-no-files-found: warn

- name: Stop Spring Boot
  if: always()
  run: pkill -f 'java -jar' || true

load-test:
  runs-on: ubuntu-24.04
  needs: functional-tests
  if: github.event_name == 'push'
  services:
    postgres:
      image: postgres:16
      ports:
        - 5432:5432
      env:
        POSTGRES_DB: flashcardsdb
        POSTGRES_USER: postgres
        POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}

- name: Setup k6
  uses: grafana/setup-k6-action@v1.1.0

- name: Run k6 LOCAL (staging)
  env:
    BASE_URL: http://localhost:8081
  run: k6 run load-test/flashcards.js --vus 50 --duration 2m --out json=k6-report.json

import http from 'k6/http';
import { check, sleep } from 'k6';

export const options = {
    stages: [
        { duration: '30s', target: 10 },
        { duration: '1m', target: 30 },
        { duration: '30s', target: 0 },
    ],
    thresholds: {
        http_req_failed: ['rate< 0.01'],
        http_req_duration: ['p (95)< 500'],
    },
};

const BASE_URL = __ENV.BASE_URL || 'http://localhost:8081';

Le test de charge progressif

Le test échouera automatiquement si l'une de ces conditions n'est pas remplie:
1. Moins de 1% des requêtes HTTP doivent échouer.
2. 95% des requêtes doivent être traitées en moins de 500 millisecondes

Voir le script complet de l'application Flashcards dans le repository Github