Pipelines CI/CD & Deploy

Tu es DevOps expert GitHub Actions + Cloudflare Pages.

Génère un workflow GitHub Actions complet pour mon projet.

Stack :
- Next.js 15 (App Router, output: 'export' pour Cloudflare Pages)
- TypeScript strict
- Tests : Vitest
- Linting : ESLint + next lint
- Node.js 20

Workflow souhaité :
1. Déclenché sur push main et PR vers main
2. Jobs en parallèle : lint + typecheck + tests
3. Job build (dépend des 3 précédents)
4. Job deploy sur Cloudflare Pages (seulement sur push main)

Secrets à utiliser :
- CLOUDFLARE_API_TOKEN
- CLOUDFLARE_ACCOUNT_ID

Optimisations :
- Cache node_modules entre les jobs
- Afficher le résumé des tests dans la PR
- Notifier en cas d'échec seulement

name: CI / Deploy

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  NODE_VERSION: '20'

jobs:
  lint:
    name: Lint & TypeCheck
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
      - run: npm run lint
      - run: npx tsc --noEmit

  test:
    name: Tests Vitest
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
      - run: npm run test -- --reporter=verbose
        continue-on-error: false

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [lint, test]
    defaults:
      run:
        working-directory: frontend
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: frontend/package-lock.json
      - run: npm ci
      - run: npm run build
        env:
          NEXT_PUBLIC_SITE_URL: ${{ vars.NEXT_PUBLIC_SITE_URL }}
      - uses: actions/upload-artifact@v4
        with:
          name: build-output
          path: frontend/out
          retention-days: 1

  deploy:
    name: Deploy → Cloudflare Pages
    runs-on: ubuntu-latest
    needs: [build]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: build-output
          path: out
      - uses: cloudflare/pages-action@v1
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          projectName: balise-ton-site
          directory: out
          gitHubToken: ${{ secrets.GITHUB_TOKEN }}

name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Tous les commits pour le changelog
      - name: Générer le CHANGELOG
        uses: conventional-changelog-action@v3
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          output-file: CHANGELOG.md
      - name: Créer la GitHub Release
        uses: softprops/action-gh-release@v1
        with:
          body_path: CHANGELOG.md
          generate_release_notes: true

Voici mon workflow GitHub Actions actuel :
[COLLE LE YAML]

Je veux y ajouter :
- [ex. vérification des variables d'env avant le build]
- [ex. Slack notification en cas d'échec]
- [ex. déploiement preview sur chaque PR avec une URL unique]
- [ex. audit Lighthouse automatique sur l'URL de preview]

Modifie uniquement les jobs concernés, garde le reste intact.