ci: add the check, security and codeql workflows and dependabot

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: maven
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -0,0 +1,21 @@
+name: ci
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: check
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: '21'
+          cache: maven
+      - name: Compile and run the tests
+        run: sh ./mvnw -B verify

.github/workflows/codeql.yml

@@ -0,0 +1,29 @@
+name: codeql
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: codeql (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [java-kotlin, actions]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        with:
+          category: /language:${{ matrix.language }}

.github/workflows/trivy.yml

@@ -0,0 +1,30 @@
+name: trivy
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: security
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          format: sarif
+          output: trivy-results.sarif
+          exit-code: '1'
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          limit-severities-for-sarif: true
+      - uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif

README.md

@@ -12,6 +12,7 @@ Bienvenue dans **SWAPI**, une API Spring Boot conçue pour consommer et servir d
 - [Endpoints](#endpoints)
 - [Exemples d'utilisation](#exemples-dutilisation)
 - [Tests](#tests)
+- [Qualité et CI](#qualité-et-ci)
 - [Swagger UI](#swagger-ui)
 - [Contributions](#contributions)
 
@@ -121,9 +122,23 @@ Réponse :
 Le projet inclut des tests unitaires et d'intégration utilisant **Spring Boot Starter Test** et **Reactor Test** pour les flux réactifs. Pour exécuter les tests :
 
 ```bash
-mvn test
+sh ./mvnw test
 ```
 
+## Qualité et CI
+
+La commande `sh ./mvnw verify` est la barrière unique, en local comme en CI. Elle enchaîne, dans cet ordre :
+
+1. **Spotless** (`google-java-format`) : vérifie le format. `sh ./mvnw spotless:apply` le corrige.
+2. **Checkstyle** (`google_checks.xml`) : lint. Les exceptions sont dans `config/checkstyle-suppressions.xml`.
+3. **PMD** et **SpotBugs** : analyse statique.
+4. **Tests** (Surefire, classes `*Test`).
+5. **JaCoCo** : rapport dans `target/site/jacoco`, échec sous **40 %** de lignes couvertes.
+
+Le workflow `.github/workflows/ci.yml` lance cette commande dans le job `check`. Trois autres contrôles tournent sur les pull requests : `security` (Trivy, dépendances), `codeql` (code Java et workflows GitHub Actions) et Dependabot (`github-actions` et `maven`, chaque semaine). La branche `main` exige `check` et `security`.
+
+Pour des tests d'intégration `*IT`, il faut déclarer `maven-failsafe-plugin` dans le `pom.xml` : sans lui, Maven ignore ces classes sans erreur.
+
 ## Swagger UI
 
 Pour visualiser et interagir avec la documentation de l'API, accédez à **Swagger UI** via l'URL suivante :

config/checkstyle-suppressions.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+<!DOCTYPE suppressions PUBLIC "-//Checkstyle//DTD SuppressionFilter Configuration 1.2//EN" "https://checkstyle.org/dtds/suppressions_1_2.dtd">
+<suppressions>
+  <!-- Javadoc is not required on every type and method. -->
+  <suppress checks="MissingJavadoc.*|SummaryJavadoc" files=".*"/>
+  <!-- DTO is the project suffix for transfer objects (searchResultDTO, filmDTO). -->
+  <suppress checks="AbbreviationAsWordInName" files=".*"/>
+  <!-- Test names follow should_<effect>_when_<condition>. -->
+  <suppress checks="GoogleMethodName" files=".*[\\/]src[\\/]test[\\/].*"/>
+  <!-- MGLT is the JSON field name of the SWAPI starship payload. -->
+  <suppress checks="GoogleNonConstantFieldName" files=".*StarshipDTO\.java"/>
+</suppressions>

pom.xml

@@ -59,6 +59,125 @@
 
 	<build>
 		<plugins>
+			<plugin>
+				<groupId>com.diffplug.spotless</groupId>
+				<artifactId>spotless-maven-plugin</artifactId>
+				<version>3.10.3</version>
+				<configuration>
+					<java>
+						<googleJavaFormat/>
+						<removeUnusedImports/>
+					</java>
+				</configuration>
+				<executions>
+					<execution>
+						<id>spotless</id>
+						<phase>validate</phase>
+						<goals>
+							<goal>check</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-checkstyle-plugin</artifactId>
+				<version>3.6.0</version>
+				<dependencies>
+					<dependency>
+						<groupId>com.puppycrawl.tools</groupId>
+						<artifactId>checkstyle</artifactId>
+						<version>14.3.0</version>
+					</dependency>
+				</dependencies>
+				<configuration>
+					<configLocation>google_checks.xml</configLocation>
+					<suppressionsLocation>config/checkstyle-suppressions.xml</suppressionsLocation>
+					<violationSeverity>warning</violationSeverity>
+					<includeTestSourceDirectory>true</includeTestSourceDirectory>
+				</configuration>
+				<executions>
+					<execution>
+						<id>checkstyle</id>
+						<phase>validate</phase>
+						<goals>
+							<goal>check</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-pmd-plugin</artifactId>
+				<version>3.28.0</version>
+				<configuration>
+					<printFailingErrors>true</printFailingErrors>
+				</configuration>
+				<executions>
+					<execution>
+						<id>pmd</id>
+						<phase>process-classes</phase>
+						<goals>
+							<goal>check</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>com.github.spotbugs</groupId>
+				<artifactId>spotbugs-maven-plugin</artifactId>
+				<version>4.10.4.1</version>
+				<executions>
+					<execution>
+						<id>spotbugs</id>
+						<phase>process-classes</phase>
+						<goals>
+							<goal>check</goal>
+						</goals>
+					</execution>
+				</executions>
+			</plugin>
+			<plugin>
+				<groupId>org.jacoco</groupId>
+				<artifactId>jacoco-maven-plugin</artifactId>
+				<version>0.8.15</version>
+				<executions>
+					<execution>
+						<id>jacoco-agent</id>
+						<goals>
+							<goal>prepare-agent</goal>
+						</goals>
+					</execution>
+					<execution>
+						<id>jacoco-report</id>
+						<phase>verify</phase>
+						<goals>
+							<goal>report</goal>
+						</goals>
+					</execution>
+					<execution>
+						<id>jacoco-check</id>
+						<phase>verify</phase>
+						<goals>
+							<goal>check</goal>
+						</goals>
+						<configuration>
+							<rules>
+								<rule>
+									<element>BUNDLE</element>
+									<limits>
+										<limit>
+											<counter>LINE</counter>
+											<value>COVEREDRATIO</value>
+											<minimum>0.40</minimum>
+										</limit>
+									</limits>
+								</rule>
+							</rules>
+						</configuration>
+					</execution>
+				</executions>
+			</plugin>
 			<plugin>
 				<groupId>org.springframework.boot</groupId>
 				<artifactId>spring-boot-maven-plugin</artifactId>

src/main/java/fr/kevpdev/swapi/SwaggerConfiguration.java

@@ -8,12 +8,13 @@
 @Configuration
 public class SwaggerConfiguration {
 
-    @Bean
-    public OpenAPI customOpenAPI() {
-        return new OpenAPI()
-                .info(new Info()
-                        .title("API Documentation")
-                        .version("1.0")
-                        .description("Documentation for Swapi API V1.0"));
-    }
+  @Bean
+  public OpenAPI customOpenApi() {
+    return new OpenAPI()
+        .info(
+            new Info()
+                .title("API Documentation")
+                .version("1.0")
+                .description("Documentation for Swapi API V1.0"));
+  }
 }

src/main/java/fr/kevpdev/swapi/SwapiApplication.java

@@ -6,8 +6,7 @@
 @SpringBootApplication
 public class SwapiApplication {
 
-	public static void main(String[] args) {
-		SpringApplication.run(SwapiApplication.class, args);
-	}
-
+  public static void main(String[] args) {
+    SpringApplication.run(SwapiApplication.class, args);
+  }
 }

src/main/java/fr/kevpdev/swapi/controllers/FilmController.java

@@ -4,35 +4,36 @@
 import fr.kevpdev.swapi.dtos.SearchResultDTO;
 import fr.kevpdev.swapi.services.FilmService;
 import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.*;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
 import reactor.core.publisher.Mono;
 
 @RestController
 @RequestMapping("/api/v1/films")
 public class FilmController {
 
-    private final FilmService filmService;
+  private final FilmService filmService;
 
-    public FilmController(FilmService filmService) {
-        this.filmService = filmService;
-    }
+  public FilmController(FilmService filmService) {
+    this.filmService = filmService;
+  }
 
-    @GetMapping("/{id}")
-    public Mono<ResponseEntity<FilmDTO>> getFilmById(@PathVariable int id) {
-        return filmService.getFilmById(id)
-                .map(ResponseEntity::ok);
-    }
+  @GetMapping("/{id}")
+  public Mono<ResponseEntity<FilmDTO>> getFilmById(@PathVariable int id) {
+    return filmService.getFilmById(id).map(ResponseEntity::ok);
+  }
 
-    @GetMapping
-    public Mono<ResponseEntity<SearchResultDTO<FilmDTO>>> getFilms(
-            @RequestParam(value = "page", required = false, defaultValue = "1") Integer pageId) {
-        return filmService.getFilms(pageId)
-                .map(ResponseEntity::ok);
-    }
+  @GetMapping
+  public Mono<ResponseEntity<SearchResultDTO<FilmDTO>>> getFilms(
+      @RequestParam(value = "page", required = false, defaultValue = "1") Integer pageId) {
+    return filmService.getFilms(pageId).map(ResponseEntity::ok);
+  }
 
-    @GetMapping("/search")
-    public Mono<ResponseEntity<SearchResultDTO<FilmDTO>>> getFilmByName(@RequestParam String title) {
-        return filmService.getFilmByTitle(title)
-                .map(ResponseEntity::ok);
-    }
+  @GetMapping("/search")
+  public Mono<ResponseEntity<SearchResultDTO<FilmDTO>>> getFilmByName(@RequestParam String title) {
+    return filmService.getFilmByTitle(title).map(ResponseEntity::ok);
+  }
 }