fix(ci): remove sudo from docker install — Gitea ubuntu runner is root without sudo

.github/workflows/admin-web-docker.yml

@@ -0,0 +1,150 @@
+name: Admin Web Docker
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - 'admin-web/**'
+      - '.github/workflows/admin-web-docker.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: admin-web-docker-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  NODE_VERSION: "22"
+
+jobs:
+  build-validation:
+    name: Docker Build Validation
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - name: Install Docker CLI
+        run: apt-get update -qq && apt-get install -y -qq docker.io
+
+      - name: Build admin-web image (no push)
+        env:
+          NEXT_PUBLIC_SUPABASE_URL: ${{ vars.NEXT_PUBLIC_SUPABASE_URL }}
+          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ vars.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
+        run: |
+          set -e
+          docker build \
+            --file admin-web/Dockerfile \
+            --build-arg "NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}" \
+            --build-arg "NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}" \
+            --tag "tabatago-admin-web:pr-validation" \
+            admin-web
+
+  semantic-release:
+    name: Semantic Release
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: |
+      github.event_name != 'pull_request' &&
+      (
+        github.event_name == 'workflow_dispatch' ||
+        (
+          !contains(github.event.head_commit.message, '[skip ci]') &&
+          !contains(github.event.head_commit.message, '[ci skip]')
+        )
+      )
+    outputs:
+      released: ${{ steps.release.outputs.released }}
+      version: ${{ steps.release.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: npm
+          cache-dependency-path: package-lock.json
+
+      - name: Install release tooling
+        run: npm ci
+
+      - name: Record version before release
+        id: before
+        run: echo "version=$(node -p "require('./version.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Run semantic-release
+        env:
+          GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          GITEA_URL: https://gitea.1000co.fr
+        run: npx semantic-release
+
+      - name: Check if released
+        id: release
+        run: |
+          VERSION="$(node -p "require('./version.json').version")"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          if [ "${{ steps.before.outputs.version }}" != "$VERSION" ]; then
+            echo "released=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "released=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  build-and-push:
+    name: Build & Push Docker Image
+    needs: semantic-release
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (
+        !contains(github.event.head_commit.message, '[skip ci]') &&
+        !contains(github.event.head_commit.message, '[ci skip]') &&
+        needs.semantic-release.outputs.released == 'true'
+      )
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - name: Install Docker CLI
+        run: apt-get update -qq && apt-get install -y -qq docker.io
+
+      - name: Login to Gitea registry
+        # Secret referenced via env (never inline in the run command) so it
+        # cannot leak into logs. It is then piped to --password-stdin.
+        env:
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_USER: ${{ secrets.DOCKER_LOGIN }}
+        run: echo "$DOCKER_PASSWORD" | docker login gitea.1000co.fr -u "$DOCKER_USER" --password-stdin
+
+      - name: Build and push admin-web image
+        env:
+          VERSION: ${{ needs.semantic-release.outputs.version }}
+          NEXT_PUBLIC_SUPABASE_URL: ${{ vars.NEXT_PUBLIC_SUPABASE_URL }}
+          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ vars.NEXT_PUBLIC_SUPABASE_ANON_KEY }}
+        run: |
+          set -e
+          if [ -z "${VERSION}" ]; then
+            echo "::error::VERSION is empty — semantic-release produced no version."
+            exit 1
+          fi
+          docker build \
+            --file admin-web/Dockerfile \
+            --build-arg "NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}" \
+            --build-arg "NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}" \
+            --tag "gitea.1000co.fr/millianlmx/admin-web:${VERSION}" \
+            --tag "gitea.1000co.fr/millianlmx/admin-web:latest" \
+            admin-web
+          docker push "gitea.1000co.fr/millianlmx/admin-web:${VERSION}"
+          docker push "gitea.1000co.fr/millianlmx/admin-web:latest"

.github/workflows/ci.yml

@@ -48,7 +48,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '20'
           cache: 'npm'
           cache-dependency-path: admin-web/package-lock.json
 

.github/workflows/docker-admin-web.yml

@@ -1,183 +0,0 @@
-name: Docker Admin Web
-
-on:
-  push:
-    branches: [main]
-    paths:
-      - 'admin-web/**'
-      - '.github/workflows/docker-admin-web.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: docker-admin-web-${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  admin-web-test:
-    name: Admin Web Tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    defaults:
-      run:
-        working-directory: admin-web
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: admin-web/package-lock.json
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Type check
-        run: npx tsc --noEmit
-
-      - name: Run unit tests
-        run: npx vitest run
-
-      - name: Install Playwright browsers
-        run: npx playwright install --with-deps chromium
-
-      - name: Run E2E tests
-        run: npx playwright test
-
-  semantic-release:
-    name: Semantic Release
-    needs: admin-web-test
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    defaults:
-      run:
-        working-directory: admin-web
-    outputs:
-      released: ${{ steps.check-release.outputs.released }}
-      version: ${{ steps.check-release.outputs.version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-          cache: 'npm'
-          cache-dependency-path: admin-web/package-lock.json
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Record version before release
-        id: before
-        run: echo "version=$(node -p "require('./version.json').version")" >> $GITHUB_OUTPUT
-
-      - name: Run semantic-release
-        env:
-          GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
-          GITEA_URL: https://gitea.1000co.fr
-        run: npx semantic-release
-
-      - name: Check if released
-        id: check-release
-        run: |
-          VERSION=$(node -p "require('./version.json').version")
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          if [ "${{ steps.before.outputs.version }}" != "$VERSION" ]; then
-            echo "released=true" >> $GITHUB_OUTPUT
-          else
-            echo "released=false" >> $GITHUB_OUTPUT
-          fi
-
-  build-and-push:
-    name: Build & Push Docker Image
-    needs: semantic-release
-    if: needs.semantic-release.outputs.released == 'true' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Install Docker CLI
-        run: apt-get update -qq && apt-get install -y -qq docker.io
-
-      - name: Login to Gitea registry
-        run: |
-          echo "${{ secrets.DOCKER_PASSWORD }}" | \
-            docker login gitea.1000co.fr \
-              -u "${{ secrets.DOCKER_USERNAME }}" \
-              --password-stdin
-
-      - name: Build and push
-        run: |
-          U="${{ secrets.DOCKER_USERNAME }}"
-          V="${{ needs.semantic-release.outputs.version }}"
-          docker build \
-            --file ./admin-web/Dockerfile \
-            --tag "gitea.1000co.fr/$U/tabatago-admin-web:$V" \
-            --tag "gitea.1000co.fr/$U/tabatago-admin-web:latest" \
-            ./admin-web
-          docker push "gitea.1000co.fr/$U/tabatago-admin-web:$V"
-          docker push "gitea.1000co.fr/$U/tabatago-admin-web:latest"
-
-  deploy:
-    name: Deploy to Portainer
-    needs: [semantic-release, build-and-push]
-    if: needs.semantic-release.outputs.released == 'true' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install deps
-        run: apt-get update -qq && apt-get install -y -qq gettext-base jq curl
-
-      - name: Deploy stack to Portainer
-        env:
-          PORTAINER_TOKEN: ${{ secrets.PORTAINER_ACCESS_TOKEN }}
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-          VERSION: ${{ needs.semantic-release.outputs.version }}
-        run: |
-          set -e
-
-          # Substitute env vars in compose file
-          export DOCKER_USERNAME VERSION
-          COMPOSE=$(envsubst '$DOCKER_USERNAME $VERSION' < admin-web/docker-compose.portainer.yml)
-
-          # Authenticate and discover Docker endpoint (first endpoint = local Docker)
-          ENDPOINT_ID=$(curl -sSf -H "X-API-Key: $PORTAINER_TOKEN" \
-            "https://portainer.1000co.fr/api/endpoints" | jq -r '.[0].Id')
-          echo "Endpoint ID: $ENDPOINT_ID"
-
-          # Check if "tabatago-admin-web" stack already exists
-          STACK_ID=$(curl -sSf -H "X-API-Key: $PORTAINER_TOKEN" \
-            "https://portainer.1000co.fr/api/stacks" | jq -r '.[] | select(.Name == "tabatago-admin-web") | .Id')
-
-          if [ -n "$STACK_ID" ] && [ "$STACK_ID" != "null" ]; then
-            echo "Stack tabatago-admin-web exists (ID: $STACK_ID), updating compose content..."
-            HTTP_RESPONSE=$(curl -s -w '\n%{http_code}' \
-              -X PUT \
-              -H "X-API-Key: $PORTAINER_TOKEN" \
-              -H "Content-Type: application/json" \
-              -d "$(jq -n --arg content "$COMPOSE" '{stackFileContent: $content, prune: false, pullImage: true}')" \
-              "https://portainer.1000co.fr/api/stacks/$STACK_ID?endpointId=$ENDPOINT_ID" || true)
-            HTTP_BODY=$(echo "$HTTP_RESPONSE" | sed '$d')
-            HTTP_CODE=$(echo "$HTTP_RESPONSE" | tail -1)
-
-            if [ -z "$HTTP_CODE" ] || [ "$HTTP_CODE" -ge 400 ]; then
-              echo "Portainer API error (HTTP ${HTTP_CODE:-connection failed}):"
-              echo "$HTTP_BODY"
-              exit 1
-            fi
-            echo "Stack updated. Portainer will redeploy with new images."
-          else
-            echo "⚠️  Stack tabatago-admin-web not found in Portainer."
-            echo "Create it manually in Portainer first: Stacks → Add stack → paste compose content from admin-web/docker-compose.portainer.yml"
-            exit 1
-          fi

.github/workflows/pr-iphone-deploy.yml

@@ -15,28 +15,8 @@ permissions:
 
 jobs:
 
-  # ── Path filter — only run if tabatago-swift changed ──
-  changes:
-    name: Detect Changes
-    runs-on: nas-runner
-    outputs:
-      tabatago-swift: ${{ steps.filter.outputs.tabatago-swift }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: dorny/paths-filter@v3
-        id: filter
-        with:
-          filters: |
-            tabatago-swift:
-              - 'tabatago-swift/**'
-
   build-deploy:
     name: Build & Deploy to iPhone (WiFi/USB)
-    needs: changes
-    if: needs.changes.outputs.tabatago-swift == 'true'
     runs-on: macos
     timeout-minutes: 20
 

.releaserc.json

@@ -0,0 +1,21 @@
+{
+  "branches": ["main"],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    [
+      "@semantic-release/exec",
+      {
+        "prepareCmd": "node scripts/prepare-release.cjs ${nextRelease.version}"
+      }
+    ],
+    [
+      "@semantic-release/git",
+      {
+        "assets": ["version.json", "admin-web/package.json"],
+        "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+      }
+    ],
+    "@markwylde/semantic-release-gitea"
+  ]
+}

admin-web/.dockerignore

@@ -1,12 +1,28 @@
+# Dépendances & caches
 node_modules
 .next
+out
+build
+
+# VCS & IDE
 .git
 .gitignore
-README.md
-.npm
-.pnp
-.DS_Store
-*.md
-coverage
-playwright-report
+.vscode
+
+# Env locaux
+.env
+.env.*
+!.env.test.example
+
+# Tests & couverture
+e2e
+test
 test-results
+playwright-report
+coverage
+*.tsbuildinfo
+
+# Divers
+.DS_Store
+npm-debug.log*
+README.md

admin-web/.releaserc.json

@@ -1,14 +0,0 @@
-{
-  "branches": ["main"],
-  "plugins": [
-    "@semantic-release/commit-analyzer",
-    "@semantic-release/release-notes-generator",
-    ["@semantic-release/exec", {
-      "prepareCmd": "echo '{\"version\": \"${nextRelease.version}\"}' > version.json"
-    }],
-    ["@semantic-release/git", {
-      "assets": ["version.json"],
-      "message": "chore(release): ${nextRelease.version}\n\n${nextRelease.notes}"
-    }]
-  ]
-}

admin-web/Dockerfile

@@ -1,29 +1,32 @@
-FROM node:22-bookworm-slim AS build
+# syntax=docker/dockerfile:1
+# TODO(security): pin node:22-alpine by digest in a follow-up.
 
+# ---- deps ----
+FROM node:22-alpine AS deps
 WORKDIR /app
-
 COPY package.json package-lock.json ./
-
 RUN npm ci
 
+# ---- builder ----
+FROM node:22-alpine AS builder
+WORKDIR /app
+COPY --from=deps /app/node_modules ./node_modules
 COPY . .
-
+ARG NEXT_PUBLIC_SUPABASE_URL
+ARG NEXT_PUBLIC_SUPABASE_ANON_KEY
+ENV NEXT_PUBLIC_SUPABASE_URL=$NEXT_PUBLIC_SUPABASE_URL
+ENV NEXT_PUBLIC_SUPABASE_ANON_KEY=$NEXT_PUBLIC_SUPABASE_ANON_KEY
 RUN npm run build
 
-FROM node:22-bookworm-slim AS production
-
+# ---- runner ----
+FROM node:22-alpine AS runner
 WORKDIR /app
-
 ENV NODE_ENV=production
-
-COPY --from=build /app/public ./public
-COPY --from=build /app/.next/standalone ./
-COPY --from=build /app/.next/static ./.next/static
-
-RUN groupadd -g 1001 appgroup && useradd -u 1001 -g appgroup -s /bin/sh -M nodeuser
-
-USER nodeuser
-
+COPY --from=builder --chown=node:node /app/.next/standalone ./
+COPY --from=builder --chown=node:node /app/.next/static ./.next/static
+COPY --from=builder --chown=node:node /app/public ./public
+USER node
 EXPOSE 3000
-
-ENTRYPOINT ["node", "server.js"]
+ENV PORT=3000
+ENV HOSTNAME="0.0.0.0"
+CMD ["node", "server.js"]

admin-web/docker-compose.portainer.yml

@@ -1,16 +0,0 @@
-services:
-  admin-web:
-    image: gitea.1000co.fr/${DOCKER_USERNAME}/tabatago-admin-web:${VERSION:-latest}
-    restart: unless-stopped
-    ports:
-      - "3000:3000"
-    environment:
-      - NODE_ENV=production
-      - NEXT_PUBLIC_SUPABASE_URL=${NEXT_PUBLIC_SUPABASE_URL}
-      - NEXT_PUBLIC_SUPABASE_ANON_KEY=${NEXT_PUBLIC_SUPABASE_ANON_KEY}
-    networks:
-      - supabase_supabase-network
-
-networks:
-  supabase_supabase-network:
-    external: true

admin-web/next.config.ts

@@ -1,7 +1,7 @@
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
-  output: 'standalone',
+  output: "standalone",
 };
 
 export default nextConfig;

admin-web/package.json

@@ -13,8 +13,7 @@
     "test:e2e": "playwright test",
     "test:e2e:ui": "playwright test --ui",
     "test:e2e:headed": "playwright test --headed",
-    "test:all": "npm run test && npm run test:e2e",
-    "semantic-release": "semantic-release"
+    "test:all": "npm run test && npm run test:e2e"
   },
   "dependencies": {
     "@google/genai": "^1.47.0",
@@ -31,10 +30,6 @@
   },
   "devDependencies": {
     "@playwright/test": "^1.58.2",
-    "@semantic-release/commit-analyzer": "^13.0.0",
-    "@semantic-release/exec": "^6.0.0",
-    "@semantic-release/git": "^10.0.0",
-    "@semantic-release/release-notes-generator": "^14.0.0",
     "@tailwindcss/postcss": "^4",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
@@ -47,7 +42,6 @@
     "eslint": "^9",
     "eslint-config-next": "16.1.6",
     "jsdom": "^28.1.0",
-    "semantic-release": "^24.0.0",
     "shadcn": "^3.8.5",
     "tailwindcss": "^4",
     "tw-animate-css": "^1.4.0",

admin-web/version.json

@@ -1 +0,0 @@
-{"version": "0.1.0"}

package.json

@@ -0,0 +1,17 @@
+{
+  "name": "tabatago-release-tooling",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Tooling de release monorepo (semantic-release). NE PAS confondre avec l'app iOS ni admin-web.",
+  "scripts": {
+    "semantic-release": "semantic-release"
+  },
+  "devDependencies": {
+    "@markwylde/semantic-release-gitea": "^2.2.0",
+    "@semantic-release/commit-analyzer": "^13.0.0",
+    "@semantic-release/exec": "^7.0.0",
+    "@semantic-release/git": "^10.0.0",
+    "@semantic-release/release-notes-generator": "^14.0.0",
+    "semantic-release": "^24.0.0"
+  }
+}

scripts/prepare-release.cjs

@@ -0,0 +1,46 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[\dA-Za-z.-]+)?(?:\+[\dA-Za-z.-]+)?$/;
+
+const nextVersion = process.argv[2];
+
+if (!nextVersion) {
+  throw new Error(
+    'Usage: node scripts/prepare-release.cjs <version> — version argument is required.',
+  );
+}
+
+if (!SEMVER_PATTERN.test(nextVersion)) {
+  throw new Error(
+    `Invalid semver "${nextVersion}". Expected e.g. 1.2.3 or 1.2.3-beta.1.`,
+  );
+}
+
+const workspaceRoot = path.resolve(__dirname, '..');
+
+const versionJsonPath = path.join(workspaceRoot, 'version.json');
+const adminWebPackagePath = path.join(workspaceRoot, 'admin-web', 'package.json');
+
+writeVersionJson(versionJsonPath, nextVersion);
+bumpPackageVersion(adminWebPackagePath, nextVersion);
+
+console.log(`[prepare-release] Updated version to ${nextVersion}`);
+console.log('[prepare-release]   - version.json');
+console.log('[prepare-release]   - admin-web/package.json');
+
+function writeVersionJson(filePath, version) {
+  const versionJson = { version };
+  fs.writeFileSync(filePath, `${JSON.stringify(versionJson, null, 2)}\n`, 'utf8');
+}
+
+function bumpPackageVersion(filePath, version) {
+  if (!fs.existsSync(filePath)) {
+    throw new Error(`Package manifest not found: ${filePath}`);
+  }
+  const manifest = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  manifest.version = version;
+  fs.writeFileSync(filePath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf8');
+}

scripts/prepare-release.test.cjs

@@ -0,0 +1,228 @@
+/*
+ * prepare-release.test.cjs — Test standalone (zero deps) pour scripts/prepare-release.cjs
+ *
+ * Contrat vérifié (issu du planner / critères d'acceptation) :
+ *   - `node scripts/prepare-release.cjs <semver>` met à jour `version.json` (racine)
+ *     ET `admin-web/package.json` (champ `version`) avec la valeur passée.
+ *   - Sans argument        -> exit code != 0.
+ *   - Version non-semver   -> exit code != 0.
+ *   - semver simple (1.2.3) ou avec prerelease (1.2.3-beta.1) -> succès.
+ *   - Les autres clés de `admin-web/package.json` (name, dependencies, scripts...)
+ *     sont préservées (pas écrasées).
+ *
+ * Ce test s'exécute AVANT l'implémentation (le script n'existe pas encore).
+ * Dans ce cas, chaque test échoue proprement avec "[FAIL] ... script not implemented yet",
+ * ce qui confirme l'état rouge attendu (TDD spec-first).
+ *
+ * Usage :  node scripts/prepare-release.test.cjs
+ * Exit  :  0 si tous les tests passent, 1 sinon.
+ */
+
+"use strict";
+
+const assert = require("node:assert");
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const ROOT = path.resolve(__dirname, "..");
+const SCRIPT = path.join(ROOT, "scripts", "prepare-release.cjs");
+const VERSION_JSON = path.join(ROOT, "version.json");
+const ADMIN_PKG = path.join(ROOT, "admin-web", "package.json");
+
+let passed = 0;
+let failed = 0;
+
+function ok(name) {
+  console.log(`[PASS] ${name}`);
+  passed++;
+}
+function ko(name, detail) {
+  console.log(`[FAIL] ${name}${detail ? " — " + detail : ""}`);
+  failed++;
+}
+
+/**
+ * Exécute prepare-release.cjs via node et renvoie { status, stdout, stderr }.
+ * Si le script n'existe pas, on simule un échec avec status null.
+ */
+function runScript(args) {
+  if (!fs.existsSync(SCRIPT)) {
+    return {
+      status: null,
+      stdout: "",
+      stderr: "scripts/prepare-release.cjs not implemented yet",
+      missing: true,
+    };
+  }
+  const res = spawnSync(process.execPath, [SCRIPT, ...args], {
+    cwd: ROOT,
+    encoding: "utf8",
+    timeout: 15000,
+  });
+  return {
+    status: res.status,
+    stdout: res.stdout ?? "",
+    stderr: res.stderr ?? "",
+    missing: false,
+  };
+}
+
+/* ------------------------------------------------------------------ *
+ * Backup / restore : on ne veut PAS polluer le working tree.
+ * On backup les fichiers AVANT les tests d'écriture et on restore à la fin,
+ * même si une assertion throw.
+ * ------------------------------------------------------------------ */
+
+const backup = {};
+
+function backupFile(file) {
+  if (fs.existsSync(file)) {
+    backup[file] = { existed: true, content: fs.readFileSync(file) };
+  } else {
+    backup[file] = { existed: false };
+  }
+}
+
+function restoreFile(file) {
+  const b = backup[file];
+  if (!b) return;
+  if (b.existed) {
+    fs.writeFileSync(file, b.content);
+  } else if (fs.existsSync(file)) {
+    fs.unlinkSync(file);
+  }
+}
+
+function readJSON(file) {
+  return JSON.parse(fs.readFileSync(file, "utf8"));
+}
+
+/* ------------------------------------------------------------------ *
+ * TEST CASES
+ * ------------------------------------------------------------------ */
+
+// (a) succès semver simple
+function test_simple_semver_updates_both_files() {
+  const name = "simple semver (9.9.9) updates version.json + admin-web/package.json";
+  const r = runScript(["9.9.9"]);
+  if (r.missing) return ko(name, "script not implemented yet");
+  try {
+    assert.strictEqual(r.status, 0, `expected exit 0, got ${r.status} (stderr=${r.stderr.trim()})`);
+    const v = readJSON(VERSION_JSON);
+    assert.strictEqual(v.version, "9.9.9", `version.json.version=${v.version}`);
+    const p = readJSON(ADMIN_PKG);
+    assert.strictEqual(p.version, "9.9.9", `admin-web/package.json.version=${p.version}`);
+    ok(name);
+  } catch (e) {
+    ko(name, e.message);
+  }
+}
+
+// (b) succès prerelease
+function test_prerelease_semver_accepted() {
+  const name = "prerelease semver (1.2.3-beta.1) accepted";
+  const r = runScript(["1.2.3-beta.1"]);
+  if (r.missing) return ko(name, "script not implemented yet");
+  try {
+    assert.strictEqual(r.status, 0, `expected exit 0, got ${r.status} (stderr=${r.stderr.trim()})`);
+    const v = readJSON(VERSION_JSON);
+    assert.strictEqual(v.version, "1.2.3-beta.1", `version.json.version=${v.version}`);
+    const p = readJSON(ADMIN_PKG);
+    assert.strictEqual(p.version, "1.2.3-beta.1", `admin-web/package.json.version=${p.version}`);
+    ok(name);
+  } catch (e) {
+    ko(name, e.message);
+  }
+}
+
+// (c) échec sans arg
+function test_no_arg_fails() {
+  const name = "no argument -> exit != 0";
+  const r = runScript([]);
+  if (r.missing) return ko(name, "script not implemented yet");
+  try {
+    assert.notStrictEqual(r.status, 0, `expected non-zero exit, got ${r.status}`);
+    ok(name);
+  } catch (e) {
+    ko(name, e.message);
+  }
+}
+
+// (d) échec version invalide
+function test_invalid_version_fails() {
+  const name = "invalid version ('not-a-version') -> exit != 0";
+  const r = runScript(["not-a-version"]);
+  if (r.missing) return ko(name, "script not implemented yet");
+  try {
+    assert.notStrictEqual(r.status, 0, `expected non-zero exit, got ${r.status}`);
+    // fichiers ne doivent pas avoir été modifiés avec une version invalide
+    if (fs.existsSync(VERSION_JSON)) {
+      const v = readJSON(VERSION_JSON);
+      assert.notStrictEqual(v.version, "not-a-version", "version.json should not contain invalid version");
+    }
+    ok(name);
+  } catch (e) {
+    ko(name, e.message);
+  }
+}
+
+// (e) préservation des autres clés du package.json
+function test_preserves_other_keys() {
+  const name = "other keys of admin-web/package.json preserved (name, scripts, dependencies)";
+  const r = runScript(["7.7.7"]);
+  if (r.missing) return ko(name, "script not implemented yet");
+  try {
+    assert.strictEqual(r.status, 0, `expected exit 0, got ${r.status}`);
+    const p = readJSON(ADMIN_PKG);
+    // Le package.json actuel contient name, scripts, dependencies, devDependencies.
+    // On vérifie que ces clés sont toujours là et non vides.
+    assert.ok(typeof p.name === "string" && p.name.length > 0, `name missing/empty: ${p.name}`);
+    assert.ok(p.scripts && typeof p.scripts === "object", "scripts object missing");
+    assert.ok(Object.keys(p.scripts).length > 0, "scripts object empty");
+    assert.ok(p.dependencies && typeof p.dependencies === "object", "dependencies object missing");
+    assert.ok(Object.keys(p.dependencies).length > 0, "dependencies object empty");
+    // La version, elle, doit avoir été bumpée
+    assert.strictEqual(p.version, "7.7.7", `version should be 7.7.7, got ${p.version}`);
+    ok(name);
+  } catch (e) {
+    ko(name, e.message);
+  }
+}
+
+/* ------------------------------------------------------------------ *
+ * RUN
+ * ------------------------------------------------------------------ */
+
+function main() {
+  console.log("# prepare-release.cjs — test suite (standalone, zero deps)");
+  console.log(`# script: ${path.relative(ROOT, SCRIPT)}`);
+  console.log(`# exists: ${fs.existsSync(SCRIPT)}`);
+  console.log("");
+
+  // Backup AVANT les tests d'écriture
+  backupFile(VERSION_JSON);
+  backupFile(ADMIN_PKG);
+
+  let crashed = false;
+  try {
+    test_simple_semver_updates_both_files();
+    test_prerelease_semver_accepted();
+    test_no_arg_fails();
+    test_invalid_version_fails();
+    test_preserves_other_keys();
+  } catch (e) {
+    crashed = true;
+    console.error("[ERROR] unexpected exception in test runner:", e);
+  } finally {
+    // Restore TOUJOURS
+    restoreFile(VERSION_JSON);
+    restoreFile(ADMIN_PKG);
+  }
+
+  console.log("");
+  console.log(`# Summary: ${passed} passed, ${failed} failed${crashed ? " (+runner crash)" : ""}`);
+  process.exit(failed === 0 && !crashed ? 0 : 1);
+}
+
+main();

scripts/verify-admin-web-docker.sh

@@ -0,0 +1,685 @@
+#!/usr/bin/env bash
+# verify-admin-web-docker.sh — Validation structurelle de la feature
+# "Pipeline CI/CD Docker pour admin-web (build + push registry)".
+#
+# Encode TOUS les critères d'acceptation structurels issus du planner :
+#   - existence + contenu des fichiers créés par la feature
+#   - validité YAML / JSON
+#   - patterns de sécurité (secrets, login password-stdin, pas de GITEA_TOKEN…)
+#   - actions pinnées par SHA
+#   - garde anti-[skip ci] sur chaque job
+#   - contextes git (branche feat/admin-web-docker + commit feat:)
+#
+# Usage :
+#   ./scripts/verify-admin-web-docker.sh            # run complet
+#   ./scripts/verify-admin-web-docker.sh --summary  # run + total final uniquement
+#
+# Exit : 0 si 0 échec, 1 si ≥1 échec.
+# Idempotent / ré-entrant : lancé avant implé (tout rouge) ET après (tout vert).
+
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+SUMMARY_ONLY=0
+[[ "${1:-}" == "--summary" ]] && SUMMARY_ONLY=1
+
+PASS_COUNT=0
+FAIL_COUNT=0
+declare -a FAIL_NAMES=()
+
+# --- helpers -------------------------------------------------------- #
+
+pass() { # name
+  PASS_COUNT=$((PASS_COUNT + 1))
+  if [[ "$SUMMARY_ONLY" -eq 0 ]]; then
+    printf '[PASS] %s\n' "$1"
+  fi
+}
+
+fail() { # name [detail...]
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+  FAIL_NAMES+=("$1 :: ${2:-}")
+  if [[ "$SUMMARY_ONLY" -eq 0 ]]; then
+    printf '[FAIL] %s' "$1"
+    [[ $# -ge 2 ]] && printf ' — %s' "${@:2}"
+    printf '\n'
+  fi
+}
+
+# file_contains <file> <label> <pattern>  (uses grep -E)
+file_contains() {
+  local file="$1" label="$2" pattern="$3"
+  if [[ ! -f "$file" ]]; then
+    fail "$label" "file missing: $file"
+    return
+  fi
+  if grep -Eq "$pattern" "$file"; then
+    pass "$label"
+  else
+    fail "$label" "pattern not found: $pattern"
+  fi
+}
+
+# file_not_contains <file> <label> <pattern>
+file_not_contains() {
+  local file="$1" label="$2" pattern="$3"
+  if [[ ! -f "$file" ]]; then
+    fail "$label" "file missing: $file"
+    return
+  fi
+  if grep -Eq "$pattern" "$file"; then
+    fail "$label" "forbidden pattern found: $pattern"
+  else
+    pass "$label"
+  fi
+}
+
+# json_valid <file> <label>
+json_valid() {
+  local file="$1" label="$2"
+  if [[ ! -f "$file" ]]; then
+    fail "$label" "file missing: $file"
+    return
+  fi
+  if python3 -c "import json,sys; json.load(open(sys.argv[1]))" "$file" 2>/dev/null; then
+    pass "$label"
+  else
+    fail "$label" "invalid JSON"
+  fi
+}
+
+# yaml_valid <file> <label>
+yaml_valid() {
+  local file="$1" label="$2"
+  if [[ ! -f "$file" ]]; then
+    fail "$label" "file missing: $file"
+    return
+  fi
+  if ! python3 -c "import yaml" 2>/dev/null; then
+    fail "$label" "pyyaml not installed (cannot validate)"
+    return
+  fi
+  if python3 -c "import yaml,sys; yaml.safe_load(open(sys.argv[1]))" "$file" 2>/dev/null; then
+    pass "$label"
+  else
+    fail "$label" "invalid YAML"
+  fi
+}
+
+# =================================================================== #
+# CHECKS
+# =================================================================== #
+
+# --- version.json --------------------------------------------------- #
+check_version_json() {
+  local label="version.json exists with {\"version\":\"1.0.0\"}"
+  if [[ ! -f version.json ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local v
+  v="$(node -p "require('./version.json').version" 2>/dev/null || true)"
+  if [[ "$v" == "1.0.0" ]]; then
+    pass "$label"
+  else
+    fail "$label" "version.json.version='$v' (expected 1.0.0)"
+  fi
+}
+
+# --- root package.json ---------------------------------------------- #
+check_root_package_json() {
+  local label="root package.json: private + semantic-release deps + script"
+  if [[ ! -f package.json ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local missing=()
+  node -e '
+    const p = require("./package.json");
+    const want = [
+      ["private === true", p.private === true],
+      ["scripts.semantic-release", typeof p.scripts?.["semantic-release"] === "string"],
+      ["devDependencies.semantic-release", !!(p.devDependencies?.["semantic-release"] || p.dependencies?.["semantic-release"])],
+      ["@semantic-release/exec", !!(p.devDependencies?.["@semantic-release/exec"] || p.dependencies?.["@semantic-release/exec"])],
+      ["@semantic-release/git", !!(p.devDependencies?.["@semantic-release/git"] || p.dependencies?.["@semantic-release/git"])],
+      ["@semantic-release/commit-analyzer", !!(p.devDependencies?.["@semantic-release/commit-analyzer"] || p.dependencies?.["@semantic-release/commit-analyzer"])],
+      ["@semantic-release/release-notes-generator", !!(p.devDependencies?.["@semantic-release/release-notes-generator"] || p.dependencies?.["@semantic-release/release-notes-generator"])],
+      ["@markwylde/semantic-release-gitea", !!(p.devDependencies?.["@markwylde/semantic-release-gitea"] || p.dependencies?.["@markwylde/semantic-release-gitea"])],
+    ];
+    for (const [name, ok] of want) if (!ok) console.log(name);
+  ' > /tmp/_pkgcheck 2>/dev/null || { fail "$label" "node parse failed"; return; }
+  while IFS= read -r line; do
+    [[ -n "$line" ]] && missing+=("$line")
+  done < /tmp/_pkgcheck
+  rm -f /tmp/_pkgcheck
+  if [[ ${#missing[@]} -eq 0 ]]; then
+    pass "$label"
+  else
+    fail "$label" "missing: ${missing[*]}"
+  fi
+}
+
+# --- root package-lock.json ----------------------------------------- #
+check_root_pkg_lock() {
+  if [[ -f package-lock.json ]]; then
+    pass "root package-lock.json exists"
+  else
+    fail "root package-lock.json exists" "file missing"
+  fi
+}
+
+# --- .releaserc.json ------------------------------------------------ #
+check_releaserc() {
+  local label1=".releaserc.json valid JSON"
+  if [[ ! -f .releaserc.json ]]; then
+    fail "$label1" "file missing"
+    fail ".releaserc.json assets include version.json + admin-web/package.json" "file missing"
+    fail ".releaserc.json git plugin message contains [skip ci]" "file missing"
+    return
+  fi
+  if python3 -c "import json,sys; json.load(open(sys.argv[1]))" .releaserc.json 2>/dev/null; then
+    pass "$label1"
+  else
+    fail "$label1" "invalid JSON"
+  fi
+
+  # assets contain version.json + admin-web/package.json
+  local label2=".releaserc.json assets include version.json + admin-web/package.json"
+  if grep -Eq '"version\.json"' .releaserc.json && grep -Eq '"admin-web/package\.json"' .releaserc.json; then
+    pass "$label2"
+  else
+    fail "$label2" "assets should reference both version.json and admin-web/package.json"
+  fi
+
+  # git plugin message contains literal [skip ci]
+  local label3=".releaserc.json git plugin message contains [skip ci]"
+  if grep -Fq "[skip ci]" .releaserc.json; then
+    pass "$label3"
+  else
+    fail "$label3" "literal [skip ci] not found"
+  fi
+}
+
+# --- Dockerfile ----------------------------------------------------- #
+check_dockerfile() {
+  local f="admin-web/Dockerfile"
+  if [[ ! -f "$f" ]]; then
+    fail "Dockerfile exists" "file missing: $f"
+    return
+  fi
+  pass "Dockerfile exists"
+
+  # 3 stages FROM node:22-alpine
+  local count
+  count=$(grep -Ec '^FROM node:22-alpine' "$f" || true)
+  if [[ "$count" -eq 3 ]]; then
+    pass "Dockerfile has exactly 3 'FROM node:22-alpine' stages"
+  else
+    fail "Dockerfile has exactly 3 'FROM node:22-alpine' stages" "found $count"
+  fi
+
+  file_contains "$f" "Dockerfile uses USER node"          '^USER node\b'
+  file_contains "$f" "Dockerfile EXPOSE 3000"             '^EXPOSE 3000\b'
+  file_contains "$f" 'Dockerfile CMD ["node","server.js"]' 'CMD \[ ?"node" ?, ?"server\.js" ?\]'
+
+  # build-args NEXT_PUBLIC_SUPABASE_URL + NEXT_PUBLIC_SUPABASE_ANON_KEY
+  file_contains "$f" "Dockerfile ARG NEXT_PUBLIC_SUPABASE_URL"         'ARG[[:space:]]+NEXT_PUBLIC_SUPABASE_URL'
+  file_contains "$f" "Dockerfile ARG NEXT_PUBLIC_SUPABASE_ANON_KEY"    'ARG[[:space:]]+NEXT_PUBLIC_SUPABASE_ANON_KEY'
+}
+
+# --- next.config.ts standalone -------------------------------------- #
+check_next_config() {
+  local f="admin-web/next.config.ts"
+  if [[ ! -f "$f" ]]; then
+    fail "next.config.ts contains output: \"standalone\"" "file missing"
+    return
+  fi
+  if grep -Eq "output:[[:space:]]*[\"']standalone[\"']" "$f"; then
+    pass 'next.config.ts contains output: "standalone"'
+  else
+    fail 'next.config.ts contains output: "standalone"' "pattern not found"
+  fi
+}
+
+# --- .dockerignore -------------------------------------------------- #
+check_dockerignore() {
+  local f="admin-web/.dockerignore"
+  if [[ ! -f "$f" ]]; then
+    fail ".dockerignore exists" "file missing"
+    return
+  fi
+  pass ".dockerignore exists"
+  file_contains "$f" ".dockerignore excludes node_modules" '^node_modules$'
+  file_contains "$f" ".dockerignore excludes .next"        '^\.next(/.*)?$'
+  file_contains "$f" ".dockerignore excludes .git"         '^\.git(/.*)?$'
+  file_contains "$f" ".dockerignore excludes .env"         '^\.env(\..*)?$'
+  file_not_contains "$f" ".dockerignore does NOT exclude package-lock.json" '^package-lock\.json$'
+}
+
+# --- workflow YAML validity ----------------------------------------- #
+check_workflow_valid() {
+  yaml_valid ".github/workflows/admin-web-docker.yml" "admin-web-docker.yml is valid YAML"
+}
+
+# --- workflow: exactly 3 jobs --------------------------------------- #
+check_workflow_jobs() {
+  local label="workflow has exactly 3 jobs: build-validation + semantic-release + build-and-push"
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local out
+  if ! out=$(python3 -c "
+import yaml,sys
+d=yaml.safe_load(open(sys.argv[1]))
+jobs=list((d.get('jobs') or {}).keys())
+print(','.join(sorted(jobs)))
+" "$f" 2>/dev/null); then
+    fail "$label" "could not parse jobs"
+    return
+  fi
+  if [[ "$out" == "build-and-push,build-validation,semantic-release" ]]; then
+    pass "$label"
+  else
+    fail "$label" "jobs=[$out]"
+  fi
+}
+
+# --- workflow: build-and-push needs semantic-release --------------- #
+check_workflow_needs() {
+  local label="build-and-push needs: semantic-release"
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local out
+  out=$(python3 -c "
+import yaml,sys
+d=yaml.safe_load(open(sys.argv[1]))
+bp=d.get('jobs',{}).get('build-and-push',{})
+n=bp.get('needs')
+if isinstance(n,list): print(','.join(n))
+else: print(str(n))
+" "$f" 2>/dev/null || true)
+  if [[ "$out" == "semantic-release" ]]; then
+    pass "$label"
+  else
+    fail "$label" "needs='$out'"
+  fi
+}
+
+# --- workflow: skip-ci guard on both jobs -------------------------- #
+check_skip_ci_guard() {
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "both jobs guard against [skip ci] + [ci skip]" "file missing"
+    return
+  fi
+  # Need at least 2 occurrences of each literal pattern (one per job minimum).
+  # We accept "≥2" rather than "exactly 2" to stay robust to multi-line ifs.
+  local c_skip c_ciskip
+  c_skip=$(grep -Fc "[skip ci]" "$f" || true)
+  c_ciskip=$(grep -Fc "[ci skip]" "$f" || true)
+  if [[ "$c_skip" -ge 2 && "$c_ciskip" -ge 2 ]]; then
+    pass "both jobs guard against [skip ci] + [ci skip]"
+  else
+    fail "both jobs guard against [skip ci] + [ci skip]" "[skip ci] x$c_skip, [ci skip] x$c_ciskip (need >=2 each)"
+  fi
+}
+
+# --- workflow: build-and-push if condition ------------------------- #
+check_bp_if_condition() {
+  local label="build-and-push if = skip-ci guard AND (released || workflow_dispatch)"
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  # On extrait la condition `if:` du job build-and-push.
+  local cond
+  cond=$(python3 -c "
+import yaml,sys
+d=yaml.safe_load(open(sys.argv[1]))
+print(d.get('jobs',{}).get('build-and-push',{}).get('if','') or '')
+" "$f" 2>/dev/null || true)
+  if [[ -z "$cond" ]]; then
+    fail "$label" "no 'if' on build-and-push"
+    return
+  fi
+  # La condition doit mentionner : [skip ci], [ci skip], released, workflow_dispatch
+  local miss=()
+  grep -Fq "[skip ci]"      <<<"$cond" || miss+=("[skip ci]")
+  grep -Fq "[ci skip]"      <<<"$cond" || miss+=("[ci skip]")
+  grep -Eq "released"       <<<"$cond" || miss+=("released")
+  grep -Eq "workflow_dispatch" <<<"$cond" || miss+=("workflow_dispatch")
+  if [[ ${#miss[@]} -eq 0 ]]; then
+    pass "$label"
+  else
+    fail "$label" "condition missing: ${miss[*]} (cond=$cond)"
+  fi
+}
+
+# --- workflow: docker login uses --password-stdin + env, no inline --#
+check_docker_login() {
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "docker login uses --password-stdin + env (no inline secret)" "file missing"
+    return
+  fi
+  # doit contenir --password-stdin et echo "$DOCKER_PASSWORD"
+  if grep -Eq -- '--password-stdin' "$f" && grep -Fq 'echo "$DOCKER_PASSWORD"' "$f"; then
+    # On n'interdit ${{ secrets.DOCKER_PASSWORD }} que DANS les blocs run:
+    # (secret inline = fuite potentielle dans les logs). Une référence dans un
+    # bloc env: est au contraire la bonne pratique et ne doit PAS échouer.
+    # On extrait donc le contenu des run: via awk, puis on grep ce contenu.
+    # Cas couverts : run: <cmd> (mono-ligne) et run: | ou run: > (multi-lignes).
+    local runs
+    runs=$(awk '
+      /^[[:space:]]*run:[[:space:]]*[|>][-+]?[[:space:]]*$/ { in_run=1; next }
+      /^[[:space:]]*run:[[:space:]].+/                        { in_run=0; print; next }
+      in_run && /^[[:space:]]+/                               { print; next }
+      in_run                                                 { in_run=0 }
+    ' "$f")
+    # Regex tolérante au whitespace : ${{ secrets.DOCKER_PASSWORD }}, ${{secrets.DOCKER_PASSWORD}}, etc.
+    if echo "$runs" | grep -Eq '\$\{\{\s*secrets\.DOCKER_PASSWORD\s*\}\}'; then
+      fail "docker login uses --password-stdin + env (no inline secret)" \
+           "secrets.DOCKER_PASSWORD must not be used inline in a run: block — pass via env + --password-stdin"
+    else
+      pass "docker login uses --password-stdin + env (no inline secret)"
+    fi
+  else
+    fail "docker login uses --password-stdin + env (no inline secret)" "missing --password-stdin or echo \"\$DOCKER_PASSWORD\""
+  fi
+}
+
+# --- workflow: login uses DOCKER_LOGIN (not DOCKER_USERNAME) ------- #
+check_docker_login_secret_name() {
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "docker login uses secrets.DOCKER_LOGIN" "file missing"
+    return
+  fi
+  if grep -Fq 'secrets.DOCKER_LOGIN' "$f"; then
+    pass "docker login uses secrets.DOCKER_LOGIN"
+  else
+    fail "docker login uses secrets.DOCKER_LOGIN" "secrets.DOCKER_LOGIN not referenced"
+  fi
+  file_not_contains "$f" "workflow does not use secrets.DOCKER_USERNAME" 'secrets\.DOCKER_USERNAME'
+}
+
+# --- workflow: push :VERSION + :latest + set -e ------------------- #
+check_push_tags() {
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "workflow pushes :VERSION and :latest with set -e" "file missing"
+    return
+  fi
+  local has_version=0 has_latest=0 has_set_e=0
+  grep -Eq '\$\{?VERSION\}?|:\$\{VERSION\}' "$f" && has_version=1 || true
+  grep -Eq ':latest' "$f" && has_latest=1 || true
+  grep -Eq 'set -e' "$f" && has_set_e=1 || true
+  if [[ $has_version -eq 1 && $has_latest -eq 1 && $has_set_e -eq 1 ]]; then
+    pass "workflow pushes :VERSION and :latest with set -e"
+  else
+    fail "workflow pushes :VERSION and :latest with set -e" "VERSION=$has_version latest=$has_latest set-e=$has_set_e"
+  fi
+}
+
+# --- workflow: forbidden secrets ----------------------------------- #
+check_forbidden_secrets() {
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "workflow forbids secrets.(GITEA_TOKEN|GITHUB_TOKEN) (use CI_GITEA_TOKEN)" "file missing"
+    fail "workflow forbids GEMINI_API_KEY + SUPABASE_SERVICE_ROLE_KEY" "file missing"
+    return
+  fi
+  file_not_contains "$f" "workflow forbids secrets.(GITEA_TOKEN|GITHUB_TOKEN) (use CI_GITEA_TOKEN)" 'secrets\.(GITEA_TOKEN|GITHUB_TOKEN)'
+  file_not_contains "$f" "workflow forbids GEMINI_API_KEY + SUPABASE_SERVICE_ROLE_KEY" '(GEMINI_API_KEY|SUPABASE_SERVICE_ROLE_KEY)'
+}
+
+# --- workflow: build-args from vars.NEXT_PUBLIC_* ------------------ #
+check_buildargs_source() {
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "build-args fed by vars.NEXT_PUBLIC_* (not secrets.*)" "file missing"
+    return
+  fi
+  if grep -Eq 'vars\.NEXT_PUBLIC_(SUPABASE_URL|SUPABASE_ANON_KEY)' "$f"; then
+    pass "build-args fed by vars.NEXT_PUBLIC_*"
+  else
+    fail "build-args fed by vars.NEXT_PUBLIC_*" "no vars.NEXT_PUBLIC_* reference"
+  fi
+}
+
+# --- workflow: actions pinned by SHA (no @vN) --------------------- #
+check_actions_pinned() {
+  local f=".github/workflows/admin-web-docker.yml"
+  if [[ ! -f "$f" ]]; then
+    fail "actions pinned by SHA (no @vN)" "file missing"
+    return
+  fi
+  # Pour checkout / setup-node / setup-buildx-action : aucun @v<digit>
+  local bad
+  bad=$(grep -E 'uses:[[:space:]]+(actions/checkout|actions/setup-node|docker/setup-buildx-action)@v[0-9]' "$f" || true)
+  if [[ -z "$bad" ]]; then
+    pass "actions pinned by SHA (no @vN)"
+  else
+    fail "actions pinned by SHA (no @vN)" "non-pinned: $(echo "$bad" | tr '\n' '|')"
+  fi
+}
+
+# --- workflow: no sudo (runner Gitea ubuntu-latest = root, pas de binaire sudo) -- #
+check_no_sudo() {
+  local f=".github/workflows/admin-web-docker.yml"
+  local label="workflow contains no 'sudo' (runner Gitea ubuntu-latest is root without sudo)"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local count
+  count=$(grep -Ec '\bsudo\b' "$f" || true)
+  if [[ "$count" -eq 0 ]]; then
+    pass "$label"
+  else
+    fail "$label" "found $count occurrence(s) of 'sudo'"
+  fi
+}
+
+# --- git context --------------------------------------------------- #
+check_git_branch() {
+  local label="current branch = feat/admin-web-docker"
+  local b
+  b="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
+  if [[ "$b" == "feat/admin-web-docker" ]]; then
+    pass "$label"
+  else
+    fail "$label" "branch='$b'"
+  fi
+}
+
+check_git_commit_prefix() {
+  local label="HEAD commit message starts with 'feat:'"
+  local subj
+  subj="$(git log -1 --format=%s 2>/dev/null || true)"
+  if [[ "$subj" == feat:* ]]; then
+    pass "$label"
+  else
+    fail "$label" "subject='$subj'"
+  fi
+}
+
+# =================================================================== #
+# PR BUILD-VALIDATION FEATURE CHECKS
+# (trigger pull_request + job build-validation build-only/no-secret)
+# =================================================================== #
+
+# --- workflow: pull_request trigger with admin-web/** path filter --- #
+check_pr_trigger() {
+  local f=".github/workflows/admin-web-docker.yml"
+  local label="workflow triggers on pull_request with admin-web/** path filter"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local out
+  out=$(python3 -c "
+import yaml,sys
+d=yaml.safe_load(open(sys.argv[1]))
+on=d.get(True) or d.get('on') or {}
+if not isinstance(on,dict): print('NO-PR: on not a dict'); sys.exit()
+pr=on.get('pull_request')
+if pr is None: print('NO-PR: no pull_request key'); sys.exit()
+paths=(pr.get('paths') if isinstance(pr,dict) else None) or []
+print('|'.join(str(p) for p in paths))
+" "$f" 2>/dev/null || echo "ERR")
+  if echo "$out" | grep -Eq 'admin-web/\*\*'; then
+    pass "$label"
+  else
+    fail "$label" "pull_request.paths=[$out]"
+  fi
+}
+
+# --- build-validation job: exists + if: pull_request ---------------- #
+check_build_validation_if() {
+  local f=".github/workflows/admin-web-docker.yml"
+  local label="build-validation job if: github.event_name == 'pull_request'"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local cond
+  cond=$(python3 -c "
+import yaml,sys
+d=yaml.safe_load(open(sys.argv[1]))
+bv=d.get('jobs',{}).get('build-validation',{})
+print(bv.get('if','') or '')
+" "$f" 2>/dev/null || true)
+  if echo "$cond" | grep -Eq "github\.event_name\s*==\s*'pull_request'"; then
+    pass "$label"
+  else
+    fail "$label" "if='$cond'"
+  fi
+}
+
+# --- build-validation job: NO docker push (build-only) -------------- #
+check_build_validation_no_push() {
+  local f=".github/workflows/admin-web-docker.yml"
+  local label="build-validation does NOT docker push (build-only)"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local out
+  out=$(python3 -c "
+import yaml,sys,json
+d=yaml.safe_load(open(sys.argv[1]))
+bv=d.get('jobs',{}).get('build-validation',{})
+blob=json.dumps(bv)
+print('PUSH' if 'docker push' in blob else 'NO-PUSH')
+" "$f" 2>/dev/null || echo "ERR")
+  if [[ "$out" == "NO-PUSH" ]]; then
+    pass "$label"
+  else
+    fail "$label" "docker push found in build-validation job"
+  fi
+}
+
+# --- build-validation job: NO secrets (public vars only) ------------ #
+check_build_validation_no_secrets() {
+  local f=".github/workflows/admin-web-docker.yml"
+  local label="build-validation references no secrets (build-only, public vars only)"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local out
+  out=$(python3 -c "
+import yaml,sys,json
+d=yaml.safe_load(open(sys.argv[1]))
+bv=d.get('jobs',{}).get('build-validation',{})
+blob=json.dumps(bv)
+print('SECRET' if 'secrets.' in blob else 'NO-SECRET')
+" "$f" 2>/dev/null || echo "ERR")
+  if [[ "$out" == "NO-SECRET" ]]; then
+    pass "$label"
+  else
+    fail "$label" "secrets.* referenced in build-validation job"
+  fi
+}
+
+# --- semantic-release if excludes pull_request ---------------------- #
+check_sr_excludes_pr() {
+  local f=".github/workflows/admin-web-docker.yml"
+  local label="semantic-release if excludes pull_request"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local cond
+  cond=$(python3 -c "
+import yaml,sys
+d=yaml.safe_load(open(sys.argv[1]))
+print(d.get('jobs',{}).get('semantic-release',{}).get('if','') or '')
+" "$f" 2>/dev/null || true)
+  if echo "$cond" | grep -Eq "github\.event_name\s*!=\s*'pull_request'"; then
+    pass "$label"
+  else
+    fail "$label" "if missing pull_request exclusion (if='$cond')"
+  fi
+}
+
+# =================================================================== #
+# RUN ALL
+# =================================================================== #
+
+if [[ "$SUMMARY_ONLY" -eq 0 ]]; then
+  echo "# verify-admin-web-docker.sh — structural validation"
+  echo "# repo: $ROOT"
+  echo ""
+fi
+
+check_version_json
+check_root_package_json
+check_root_pkg_lock
+check_releaserc
+check_dockerfile
+check_next_config
+check_dockerignore
+check_workflow_valid
+check_workflow_jobs
+check_workflow_needs
+check_skip_ci_guard
+check_bp_if_condition
+check_docker_login
+check_docker_login_secret_name
+check_push_tags
+check_forbidden_secrets
+check_buildargs_source
+check_actions_pinned
+check_no_sudo
+check_git_branch
+check_git_commit_prefix
+# PR build-validation feature checks
+check_pr_trigger
+check_build_validation_if
+check_build_validation_no_push
+check_build_validation_no_secrets
+check_sr_excludes_pr
+
+echo ""
+echo "# Summary: $PASS_COUNT passed, $FAIL_COUNT failed"
+if [[ "$FAIL_COUNT" -gt 0 ]]; then
+  echo "# Failures:"
+  for f in "${FAIL_NAMES[@]}"; do
+    echo "#   - $f"
+  done
+fi
+
+if [[ "$FAIL_COUNT" -gt 0 ]]; then
+  exit 1
+fi
+exit 0

version.json

@@ -0,0 +1,3 @@
+{
+  "version": "1.0.0"
+}

youtube-worker/package-lock.json

@@ -8,7 +8,6 @@
       "name": "youtube-worker",
       "version": "1.0.0",
       "dependencies": {
-        "@google/genai": "^1.46.0",
         "@supabase/supabase-js": "^2.49.1",
         "youtubei.js": "^17.0.1"
       }
@@ -19,87 +18,6 @@
       "integrity": "sha512-sBXGT13cpmPR5BMgHE6UEEfEaShh5Ror6rfN3yEK5si7QVrtZg8LEPQb0VVhiLRUslD2yLnXtnRzG035J/mZXQ==",
       "license": "(Apache-2.0 AND BSD-3-Clause)"
     },
-    "node_modules/@google/genai": {
-      "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/@google/genai/-/genai-1.52.0.tgz",
-      "integrity": "sha512-gwSvbpiN/17O9TbsqSsE/OzZcpv5Fo4RQjdngGgogtuB9RsyJ8ZHhX5KjHj1bp5N9snN2eK8LDGXSaWW2hof8Q==",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "google-auth-library": "^10.3.0",
-        "p-retry": "^4.6.2",
-        "protobufjs": "^7.5.4",
-        "ws": "^8.18.0"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      },
-      "peerDependencies": {
-        "@modelcontextprotocol/sdk": "^1.25.2"
-      },
-      "peerDependenciesMeta": {
-        "@modelcontextprotocol/sdk": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@protobufjs/aspromise": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/base64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/codegen": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
-      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/eventemitter": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.1.tgz",
-      "integrity": "sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/fetch": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
-      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.1"
-      }
-    },
-    "node_modules/@protobufjs/float": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
-      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/path": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
-      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/pool": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
-      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/utf8": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.2.tgz",
-      "integrity": "sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==",
-      "license": "BSD-3-Clause"
-    },
     "node_modules/@supabase/auth-js": {
       "version": "2.100.0",
       "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.100.0.tgz",
@@ -195,12 +113,6 @@
         "undici-types": "~7.18.0"
       }
     },
-    "node_modules/@types/retry": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.0.tgz",
-      "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==",
-      "license": "MIT"
-    },
     "node_modules/@types/ws": {
       "version": "8.18.1",
       "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
@@ -210,193 +122,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/base64-js": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/bignumber.js": {
-      "version": "9.3.1",
-      "resolved": "https://registry.npmjs.org/bignumber.js/-/bignumber.js-9.3.1.tgz",
-      "integrity": "sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==",
-      "license": "MIT",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/buffer-equal-constant-time": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
-      "integrity": "sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/data-uri-to-buffer": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-4.0.1.tgz",
-      "integrity": "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12"
-      }
-    },
-    "node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
-      "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/ecdsa-sig-formatter": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/ecdsa-sig-formatter/-/ecdsa-sig-formatter-1.0.11.tgz",
-      "integrity": "sha512-nagl3RYrbNv6kQkeJIpt6NJZy8twLB/2vtz6yN9Z4vRKHN4/QZJIEbqohALSgwKdnksuY3k5Addp5lg8sVoVcQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "safe-buffer": "^5.0.1"
-      }
-    },
-    "node_modules/extend": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
-      "license": "MIT"
-    },
-    "node_modules/fetch-blob": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz",
-      "integrity": "sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/jimmywarting"
-        },
-        {
-          "type": "paypal",
-          "url": "https://paypal.me/jimmywarting"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "node-domexception": "^1.0.0",
-        "web-streams-polyfill": "^3.0.3"
-      },
-      "engines": {
-        "node": "^12.20 || >= 14.13"
-      }
-    },
-    "node_modules/formdata-polyfill": {
-      "version": "4.0.10",
-      "resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz",
-      "integrity": "sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==",
-      "license": "MIT",
-      "dependencies": {
-        "fetch-blob": "^3.1.2"
-      },
-      "engines": {
-        "node": ">=12.20.0"
-      }
-    },
-    "node_modules/gaxios": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/gaxios/-/gaxios-7.2.0.tgz",
-      "integrity": "sha512-CUVb4wcYe+771XevyH6HtGmXFAGGKkIC3kswAP8Z1JCe0j80JMaTPZH930DWFrvo0atjh18Arc0pEyUCWa5bfg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "extend": "^3.0.2",
-        "https-proxy-agent": "^7.0.1",
-        "node-fetch": "^3.3.2"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/gcp-metadata": {
-      "version": "8.1.2",
-      "resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-8.1.2.tgz",
-      "integrity": "sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "gaxios": "^7.0.0",
-        "google-logging-utils": "^1.0.0",
-        "json-bigint": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/google-auth-library": {
-      "version": "10.9.0",
-      "resolved": "https://registry.npmjs.org/google-auth-library/-/google-auth-library-10.9.0.tgz",
-      "integrity": "sha512-xtvUqvINPhTaBm7nXqlYPcrMHJPm1lCNdSovxnKKhTm+4JsvQ+KGVYJViLoH9Yxu8w+T0Qv5HubzYT9BLrppJg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "base64-js": "^1.3.0",
-        "ecdsa-sig-formatter": "^1.0.11",
-        "gaxios": "^7.1.4",
-        "gcp-metadata": "8.1.2",
-        "google-logging-utils": "1.1.3",
-        "jws": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/google-logging-utils": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/google-logging-utils/-/google-logging-utils-1.1.3.tgz",
-      "integrity": "sha512-eAmLkjDjAFCVXg7A1unxHsLf961m6y17QFqXqAXGj/gVkKFrEICfStRfwUlGNfeCEjNRa32JEWOUTlYXPyyKvA==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=14"
-      }
-    },
-    "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
-      "license": "MIT",
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
     "node_modules/iceberg-js": {
       "version": "0.8.1",
       "resolved": "https://registry.npmjs.org/iceberg-js/-/iceberg-js-0.8.1.tgz",
@@ -406,42 +131,6 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/json-bigint": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-bigint/-/json-bigint-1.0.0.tgz",
-      "integrity": "sha512-SiPv/8VpZuWbvLSMtTDU8hEfrZWg/mH/nV/b4o0CYbSxu1UIQPLdwKOCIyLQX+VIPO5vrLX3i8qtqFyhdPSUSQ==",
-      "license": "MIT",
-      "dependencies": {
-        "bignumber.js": "^9.0.0"
-      }
-    },
-    "node_modules/jwa": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/jwa/-/jwa-2.0.1.tgz",
-      "integrity": "sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==",
-      "license": "MIT",
-      "dependencies": {
-        "buffer-equal-constant-time": "^1.0.1",
-        "ecdsa-sig-formatter": "1.0.11",
-        "safe-buffer": "^5.0.1"
-      }
-    },
-    "node_modules/jws": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/jws/-/jws-4.0.1.tgz",
-      "integrity": "sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==",
-      "license": "MIT",
-      "dependencies": {
-        "jwa": "^2.0.1",
-        "safe-buffer": "^5.0.1"
-      }
-    },
-    "node_modules/long": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
-      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0"
-    },
     "node_modules/meriyah": {
       "version": "6.1.4",
       "resolved": "https://registry.npmjs.org/meriyah/-/meriyah-6.1.4.tgz",
@@ -451,115 +140,6 @@
         "node": ">=18.0.0"
       }
     },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
-    "node_modules/node-domexception": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
-      "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==",
-      "deprecated": "Use your platform's native DOMException instead",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/jimmywarting"
-        },
-        {
-          "type": "github",
-          "url": "https://paypal.me/jimmywarting"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=10.5.0"
-      }
-    },
-    "node_modules/node-fetch": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz",
-      "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==",
-      "license": "MIT",
-      "dependencies": {
-        "data-uri-to-buffer": "^4.0.0",
-        "fetch-blob": "^3.1.4",
-        "formdata-polyfill": "^4.0.10"
-      },
-      "engines": {
-        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/node-fetch"
-      }
-    },
-    "node_modules/p-retry": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-4.6.2.tgz",
-      "integrity": "sha512-312Id396EbJdvRONlngUx0NydfrIQ5lsYu0znKVUzVvArzEIt08V1qhtyESbGVd1FGX7UKtiFp5uwKZdM8wIuQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@types/retry": "0.12.0",
-        "retry": "^0.13.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/protobufjs": {
-      "version": "7.6.5",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.5.tgz",
-      "integrity": "sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==",
-      "hasInstallScript": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.2",
-        "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.5",
-        "@protobufjs/eventemitter": "^1.1.1",
-        "@protobufjs/fetch": "^1.1.1",
-        "@protobufjs/float": "^1.0.2",
-        "@protobufjs/path": "^1.1.2",
-        "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.1",
-        "@types/node": ">=13.7.0",
-        "long": "^5.3.2"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/retry": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
-      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
-      }
-    },
-    "node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/tslib": {
       "version": "2.8.1",
       "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
@@ -572,15 +152,6 @@
       "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "license": "MIT"
     },
-    "node_modules/web-streams-polyfill": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz",
-      "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 8"
-      }
-    },
     "node_modules/ws": {
       "version": "8.20.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.20.0.tgz",