Preview whole env

.env.model

@@ -22,7 +22,7 @@ MAILER_FALLBACK_SMTP_USER=
 MAILER_FALLBACK_SMTP_PASSWORD=
 MAILER_FALLBACK_SMTP_SECURE=false
 MAILER_FALLBACK_SMTP_REQUIRE_TLS=true
-MAILER_DEFAULT_DOMAIN=numerique.gouv.fr
+MAILER_SENDER_ADDRESS=noreply@numerique.gouv.fr
 EMAIL_PRODUCT_URL=http://localhost:7201
 EMAIL_PALETTE_PATH=
 BRAND_FONT=

.env.test

@@ -1,5 +1,5 @@
 PORT=7200
-DATABASE_URL=postgresql://postgres:changeme@localhost:7205/postgres?schema=encryption
+DATABASE_URL=postgresql://postgres:changeme@localhost:7205/postgres
 VAULT_URL=http://data.encryption.localhost:7200
 UI_URL=http://encryption.localhost:7200
 ALLOWED_FRAME_ANCESTORS=http://localhost:7201,http://localhost:7202,http://a.product.localhost:7201,http://a.product.localhost:7202,http://b.product.localhost:7201,http://b.product.localhost:7202
@@ -13,7 +13,7 @@ OIDC_REDIRECT_URI=http://encryption.localhost:7200/auth/callback
 MAILER_SMTP_HOST=127.0.0.1
 MAILER_SMTP_PORT=7208
 MAILER_SMTP_REQUIRE_TLS=false
-MAILER_DEFAULT_DOMAIN=encryption.localhost
+MAILER_SENDER_ADDRESS=noreply@encryption.localhost
 EMAIL_PRODUCT_URL=http://localhost:7201
 SENTRY_DSN=http://11111111111111111111111111111111@localhost:7209/1
 SENTRY_ENVIRONMENT=development

.env.test.product

@@ -13,5 +13,5 @@ OIDC_ACCEPT_UNVERIFIED_EMAIL=true
 MAILER_SMTP_HOST=127.0.0.1
 MAILER_SMTP_PORT=7208
 MAILER_SMTP_REQUIRE_TLS=false
-MAILER_DEFAULT_DOMAIN=encryption.localhost
+MAILER_SENDER_ADDRESS=noreply@encryption.localhost
 EMAIL_PRODUCT_URL=http://localhost:3000

.github/actions/build-image/action.yml

@@ -0,0 +1,69 @@
+name: Build the image
+description: >-
+  Build the application image with its provenance and SBOM, load it in a containerd image
+  store, and scan it. Nothing is pushed: the caller logs in and pushes what passed, so a
+  release and a preview build the same way and differ only in where the image goes.
+
+inputs:
+  tags:
+    description: Comma-separated image references to build (registry/repository:tag)
+    required: true
+  primary-tag:
+    description: The reference among `tags` that is scanned and whose digest the caller reads
+    required: true
+  source-commit:
+    description: The commit the image is built from, recorded in the image
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Set up Docker
+      if: ${{ !github.event.act }} # reconfigures the daemon, which act reaches through a mounted socket
+      uses: docker/setup-docker-action@77e84dbf09b47d1e29270283c22f16145aa85ca1 # v5.4.0
+      with:
+        version: v29.7.2 # pinned like the rest, this job is the one holding a credential
+        # containerd store needed to let the build be scanned (provenance and SBOM) and then pushed
+        daemon-config: |
+          {
+            "features": {
+              "containerd-snapshotter": true
+            }
+          }
+
+    - name: Make sure the containerd image store is active # needed to ensure `load: true` because otherwise attestation and provenance are dropped silently
+      if: ${{ !github.event.act }} # asserts the runner daemon, not whatever a developer happens to run
+      shell: bash
+      run: |
+        docker info --format '{{json .DriverStatus}}' | grep -q 'io.containerd.snapshotter' \
+          || (echo "::error::The containerd image store is not active, attestations would be dropped." && exit 1)
+
+    - name: Set up Docker buildx
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+    - name: Build the image
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+      with:
+        context: .
+        load: true
+        push: false
+        tags: ${{ inputs.tags }}
+        build-args: |
+          SOURCE_COMMIT=${{ inputs.source-commit }}
+        provenance: mode=max # attach repository info to the image
+        sbom: true # store attestation manifest inside the image index (including info from application `.cdx.json` files)
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+
+    - name: Scan the image
+      # It will scan the Docker attached SBOM, but also the npm ones copied inside as `.cdx.json`
+      # "act" cannot support this since trivy action is doing `actions/checkout`, which needs a token act has none of
+      if: ${{ !github.event.act }}
+      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+      env:
+        TRIVY_VEX: security/vex.openvex.json # allow bypass some if documented (opt-in file for external scanners, so fine if manipulated)
+      with:
+        image-ref: ${{ inputs.primary-tag }}
+        severity: HIGH,CRITICAL
+        ignore-unfixed: true
+        exit-code: '1'
+        format: table

.github/actions/setup-helm/action.yml

@@ -0,0 +1,36 @@
+name: Setup Helm
+description: Helm and kubeconform for the chart tests and the chart release, helmfile for the test that renders deploy/helmfile/preview.
+
+runs:
+  using: composite
+  steps:
+    - name: Install Helm, kubeconform and helmfile
+      shell: bash
+      env:
+        HELM_VERSION: v3.19.0
+        HELM_SHA256: a7f81ce08007091b86d8bd696eb4d86b8d0f2e1b9f6c714be62f82f96a594496
+        KUBECONFORM_VERSION: v0.7.0
+        KUBECONFORM_SHA256: c31518ddd122663b3f3aa874cfe8178cb0988de944f29c74a0b9260920d115d3
+        HELMFILE_VERSION: 1.1.7
+        HELMFILE_SHA256: e9d870f4e502b9f0850d7e0546cab8b418ff7f44ff4df0ed54cd3df8dfda189c
+      run: | # zizmor: ignore[github-env] the path written is a constant, never derived from an input
+        set -euo pipefail
+        mkdir -p "${HOME}/.local/bin"
+
+        curl -sSfL "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz" -o /tmp/helm.tgz
+        echo "${HELM_SHA256}  /tmp/helm.tgz" | sha256sum -c -
+        tar -xzf /tmp/helm.tgz -C /tmp linux-amd64/helm
+        mv /tmp/linux-amd64/helm "${HOME}/.local/bin/helm"
+
+        curl -sSfL "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz" -o /tmp/kubeconform.tgz
+        echo "${KUBECONFORM_SHA256}  /tmp/kubeconform.tgz" | sha256sum -c -
+        tar -xzf /tmp/kubeconform.tgz -C "${HOME}/.local/bin" kubeconform
+
+        curl -sSfL "https://github.com/helmfile/helmfile/releases/download/v${HELMFILE_VERSION}/helmfile_${HELMFILE_VERSION}_linux_amd64.tar.gz" -o /tmp/helmfile.tgz
+        echo "${HELMFILE_SHA256}  /tmp/helmfile.tgz" | sha256sum -c -
+        tar -xzf /tmp/helmfile.tgz -C "${HOME}/.local/bin" helmfile
+
+        echo "${HOME}/.local/bin" >> "${GITHUB_PATH}"
+        "${HOME}/.local/bin/helm" version --short
+        "${HOME}/.local/bin/kubeconform" -v
+        "${HOME}/.local/bin/helmfile" --version