ci: fix anno apply/reject JSON parsing + hard gates

Reviewed-on: #159

.gitea/workflows/anno-apply-pr.yml

@@ -52,18 +52,15 @@ jobs:
           const cloneUrl =
             repoObj?.clone_url ||
             (repoObj?.html_url ? (repoObj.html_url.replace(/\/$/,"") + ".git") : "");
-
           if (!cloneUrl) throw new Error("No repository clone_url/html_url in event.json");
 
           let owner =
             repoObj?.owner?.login ||
             repoObj?.owner?.username ||
             (repoObj?.full_name ? repoObj.full_name.split("/")[0] : "");
-
           let repo =
             repoObj?.name ||
             (repoObj?.full_name ? repoObj.full_name.split("/")[1] : "");
-
           if (!owner || !repo) {
             const m = cloneUrl.match(/[:/](?<o>[^/]+)\/(?<r>[^/]+?)(?:\.git)?$/);
             if (m?.groups) { owner = owner || m.groups.o; repo = repo || m.groups.r; }
@@ -76,15 +73,15 @@ jobs:
             ev?.issue?.number ||
             ev?.issue?.index ||
             (process.env.INPUT_ISSUE ? Number(process.env.INPUT_ISSUE) : 0);
-
           if (!issueNumber || !Number.isFinite(Number(issueNumber))) {
             throw new Error("No issue number in event.json or workflow_dispatch input");
           }
 
+          // label triggered (best effort; may be missing depending on Gitea payload)
           const labelName =
             ev?.label?.name ||
-            ev?.label ||
-            "workflow_dispatch";
+            (typeof ev?.label === "string" ? ev.label : "") ||
+            "";
 
           const u = new URL(cloneUrl);
           const origin = u.origin;
@@ -93,7 +90,7 @@ jobs:
             ? String(process.env.FORGE_API).trim().replace(/\/+$/,"")
             : origin;
 
-          function sh(s){ return JSON.stringify(String(s)); }
+          function sh(s){ return JSON.stringify(String(s ?? "")); }
 
           process.stdout.write([
             `CLONE_URL=${sh(cloneUrl)}`,
@@ -102,26 +99,47 @@ jobs:
             `DEFAULT_BRANCH=${sh(defaultBranch)}`,
             `ISSUE_NUMBER=${sh(issueNumber)}`,
             `LABEL_NAME=${sh(labelName)}`,
-            `API_BASE=${sh(apiBase)}`
+            `API_BASE=${sh(apiBase)}`,
+
+            // init safe defaults (avoid "unbound variable" cascades)
+            `SKIP=0`,
+            `SKIP_REASON=${sh("")}`,
+            `ISSUE_TYPE=${sh("")}`,
+            `ISSUE_TITLE=${sh("")}`,
+            `APPLY_RC=${sh("")}`,
+            `NOOP=0`,
+            `BRANCH=${sh("")}`,
+            `END_SHA=${sh("")}`
           ].join("\n") + "\n");
           NODE
 
           echo "✅ context:"
-          sed -n '1,120p' /tmp/anno.env
+          sed -n '1,160p' /tmp/anno.env
 
-      - name: Gate on label state/approved
+      - name: Gate fast (only if label is state/approved or workflow_dispatch)
+        env:
+          INPUT_ISSUE: ${{ inputs.issue }}
         run: |
           set -euo pipefail
           source /tmp/anno.env
 
-          if [[ "$LABEL_NAME" != "state/approved" && "$LABEL_NAME" != "workflow_dispatch" ]]; then
-            echo "ℹ️ label=$LABEL_NAME => skip"
-            echo "SKIP=1" >> /tmp/anno.env
+          # workflow_dispatch => allow
+          if [[ -n "${INPUT_ISSUE:-}" ]]; then
+            echo "✅ workflow_dispatch => proceed"
             exit 0
           fi
-          echo "✅ proceed (issue=$ISSUE_NUMBER)"
 
-      - name: Fetch issue + gate on Type (skip Proposer)
+          # if payload provides the triggering label, we can skip without API call
+          if [[ -n "${LABEL_NAME:-}" && "$LABEL_NAME" != "state/approved" ]]; then
+            echo "ℹ️ triggering label='$LABEL_NAME' (not state/approved) => skip"
+            echo "SKIP=1" >> /tmp/anno.env
+            echo "SKIP_REASON=\"trigger_label_not_approved\"" >> /tmp/anno.env
+            exit 0
+          fi
+
+          echo "ℹ️ label unknown or approved => continue to API gating"
+
+      - name: Fetch issue + gate on state/approved + gate on Type (skip Proposer)
         env:
           FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
         run: |
@@ -131,16 +149,24 @@ jobs:
 
           test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
 
-          ISSUE_JSON="$(curl -fsS \
+          curl -fsS \
             -H "Authorization: token $FORGE_TOKEN" \
             -H "Accept: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER")"
+            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER" \
+            > /tmp/issue.json
 
-          node --input-type=module - <<'NODE' "$ISSUE_JSON" >> /tmp/anno.env
-          const issue = JSON.parse(process.argv[1] || "{}");
+          node --input-type=module - <<'NODE' >> /tmp/anno.env
+          import fs from "node:fs";
+          const issue = JSON.parse(fs.readFileSync("/tmp/issue.json","utf8"));
           const title = String(issue.title || "");
           const body = String(issue.body || "").replace(/\r\n/g, "\n");
 
+          const labels = Array.isArray(issue.labels)
+            ? issue.labels.map(l => String(l?.name || "")).filter(Boolean)
+            : [];
+
+          const hasApproved = labels.includes("state/approved");
+
           function pickLine(key) {
             const re = new RegExp(`^\\s*${key}\\s*:\\s*([^\\n\\r]+)`, "mi");
             const m = body.match(re);
@@ -157,7 +183,11 @@ jobs:
           out.push(`ISSUE_TITLE=${JSON.stringify(title)}`);
           out.push(`ISSUE_TYPE=${JSON.stringify(type)}`);
 
-          if (!type) {
+          // main gate: only act if state/approved is actually present on the issue
+          if (!hasApproved) {
+            out.push(`SKIP=1`);
+            out.push(`SKIP_REASON=${JSON.stringify("no_state_approved")}`);
+          } else if (!type) {
             out.push(`SKIP=1`);
             out.push(`SKIP_REASON=${JSON.stringify("missing_type")}`);
           } else if (allowed.has(type)) {
@@ -173,10 +203,10 @@ jobs:
           process.stdout.write(out.join("\n") + "\n");
           NODE
 
-          echo "✅ issue type gating:"
+          echo "✅ issue gating:"
           grep -E '^(ISSUE_TYPE|SKIP|SKIP_REASON)=' /tmp/anno.env || true
 
-      - name: Comment issue if skipped (Proposer / unsupported / missing Type)
+      - name: Comment issue if skipped (only when state/approved was present)
         if: ${{ always() }}
         env:
           FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
@@ -185,19 +215,19 @@ jobs:
           source /tmp/anno.env || true
 
           [[ "${SKIP:-0}" == "1" ]] || exit 0
-          [[ "$LABEL_NAME" == "state/approved" || "$LABEL_NAME" == "workflow_dispatch" ]] || exit 0
+          [[ "${SKIP_REASON:-}" != "no_state_approved" ]] || exit 0  # do not comment on normal label churn
+
+          test -n "${FORGE_TOKEN:-}" || exit 0
 
-          # message différent si Proposer
           REASON="${SKIP_REASON:-}"
           TYPE="${ISSUE_TYPE:-}"
-          TITLE="${ISSUE_TITLE:-}"
 
           if [[ "$REASON" == proposer_type:* ]]; then
-            MSG="ℹ️ Ticket #${ISSUE_NUMBER} détecté comme **Proposer** (${TYPE}).\n\n- Ce type est **traité manuellement par les editors** (correction/fact-check + cat/*).\n- Le bot n'applique **jamais** Proposer et n'ajoute **jamais** state/approved automatiquement.\n\n✅ Action : traitement éditorial manuel."
+            MSG="ℹ️ Ticket #${ISSUE_NUMBER} détecté comme **Proposer** (${TYPE}).\n\n- Ce type est **traité manuellement par les editors** (correction/fact-check + cat/*).\n- Le bot n'applique **jamais** Proposer.\n\n✅ Action : traitement éditorial manuel."
           elif [[ "$REASON" == unsupported_type:* ]]; then
             MSG="ℹ️ Ticket #${ISSUE_NUMBER} ignoré : Type non supporté par le bot (${TYPE}).\n\nTypes supportés : type/media, type/reference, type/comment.\n✅ Action : traitement manuel si nécessaire."
           else
-            MSG="ℹ️ Ticket #${ISSUE_NUMBER} ignoré : champ 'Type:' manquant ou illisible.\n\n✅ Action : corriger le ticket (ajouter 'Type: type/media|type/reference|type/comment') ou traiter manuellement."
+            MSG="ℹ️ Ticket #${ISSUE_NUMBER} ignoré : champ 'Type:' manquant ou illisible.\n\n✅ Action : corriger le ticket (Type: type/media|type/reference|type/comment) ou traiter manuellement."
           fi
 
           PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
@@ -273,7 +303,7 @@ jobs:
           START_SHA="$(git rev-parse HEAD)"
           TS="$(date -u +%Y%m%d-%H%M%S)"
           BR="bot/anno-${ISSUE_NUMBER}-${TS}"
-          echo "BRANCH=$BR" >> /tmp/anno.env
+          echo "BRANCH=\"$BR\"" >> /tmp/anno.env
           git checkout -b "$BR"
 
           export FORGE_API="$API_BASE"
@@ -286,12 +316,13 @@ jobs:
           RC=$?
           set -e
 
-          echo "APPLY_RC=$RC" >> /tmp/anno.env
+          echo "APPLY_RC=\"$RC\"" >> /tmp/anno.env
 
           echo "== apply log (tail) =="
           tail -n 180 "$LOG" || true
 
           END_SHA="$(git rev-parse HEAD)"
+          echo "END_SHA=\"$END_SHA\"" >> /tmp/anno.env
 
           if [[ "$RC" -ne 0 ]]; then
             echo "NOOP=0" >> /tmp/anno.env
@@ -302,7 +333,6 @@ jobs:
             echo "NOOP=1" >> /tmp/anno.env
           else
             echo "NOOP=0" >> /tmp/anno.env
-            echo "END_SHA=$END_SHA" >> /tmp/anno.env
           fi
 
       - name: Comment issue on failure (strict/verify/etc)
@@ -314,11 +344,9 @@ jobs:
           source /tmp/anno.env || true
           [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
 
-          RC="${APPLY_RC:-0}"
-          if [[ "$RC" == "0" ]]; then
-            echo "ℹ️ no failure detected"
-            exit 0
-          fi
+          RC="${APPLY_RC:-}"
+          [[ -n "$RC" ]] || { echo "ℹ️ apply not executed"; exit 0; }
+          [[ "$RC" != "0" ]] || { echo "ℹ️ no failure detected"; exit 0; }
 
           if [[ -f /tmp/apply.log ]]; then
             BODY="$(tail -n 160 /tmp/apply.log | sed 's/\r$//')"
@@ -344,7 +372,8 @@ jobs:
           source /tmp/anno.env || true
           [[ "${SKIP:-0}" != "1" ]] || exit 0
 
-          [[ "${APPLY_RC:-0}" == "0" ]] || exit 0
+          RC="${APPLY_RC:-}"
+          [[ "$RC" == "0" ]] || exit 0
           [[ "${NOOP:-0}" == "1" ]] || exit 0
 
           MSG="ℹ️ Ticket #${ISSUE_NUMBER} : rien à appliquer (déjà présent / dédupliqué)."
@@ -365,8 +394,9 @@ jobs:
           source /tmp/anno.env || true
           [[ "${SKIP:-0}" != "1" ]] || exit 0
 
-          [[ "${APPLY_RC:-0}" == "0" ]] || { echo "ℹ️ apply failed -> skip push"; exit 0; }
+          [[ "${APPLY_RC:-}" == "0" ]] || { echo "ℹ️ apply not ok -> skip push"; exit 0; }
           [[ "${NOOP:-0}" == "0" ]] || { echo "ℹ️ no-op -> skip push"; exit 0; }
+          [[ -n "${BRANCH:-}" ]] || { echo "ℹ️ missing BRANCH -> skip push"; exit 0; }
 
           AUTH_URL="$(node --input-type=module -e '
             const [clone, tok] = process.argv.slice(1);
@@ -388,8 +418,10 @@ jobs:
           source /tmp/anno.env || true
           [[ "${SKIP:-0}" != "1" ]] || exit 0
 
-          [[ "${APPLY_RC:-0}" == "0" ]] || { echo "ℹ️ apply failed -> skip PR"; exit 0; }
+          [[ "${APPLY_RC:-}" == "0" ]] || { echo "ℹ️ apply not ok -> skip PR"; exit 0; }
           [[ "${NOOP:-0}" == "0" ]] || { echo "ℹ️ no-op -> skip PR"; exit 0; }
+          [[ -n "${BRANCH:-}" ]] || { echo "ℹ️ missing BRANCH -> skip PR"; exit 0; }
+          [[ -n "${END_SHA:-}" ]] || { echo "ℹ️ missing END_SHA -> skip PR"; exit 0; }
 
           PR_TITLE="anno: apply ticket #${ISSUE_NUMBER}"
           PR_BODY="PR auto depuis ticket #${ISSUE_NUMBER} (state/approved).\n\n- Branche: ${BRANCH}\n- Commit: ${END_SHA}\n\nMerge si CI OK."
@@ -431,7 +463,9 @@ jobs:
 
           [[ "${SKIP:-0}" != "1" ]] || { echo "ℹ️ skipped"; exit 0; }
 
-          RC="${APPLY_RC:-0}"
+          RC="${APPLY_RC:-}"
+          [[ -n "$RC" ]] || { echo "❌ apply did not run"; exit 2; }
+
           if [[ "$RC" != "0" ]]; then
             echo "❌ apply failed (rc=$RC)"
             exit "$RC"

.gitea/workflows/anno-reject.yml

@@ -77,8 +77,8 @@ jobs:
 
           const labelName =
             ev?.label?.name ||
-            ev?.label ||
-            "workflow_dispatch";
+            (typeof ev?.label === "string" ? ev.label : "") ||
+            "";
 
           let apiBase = "";
           if (process.env.FORGE_API && String(process.env.FORGE_API).trim()) {
@@ -89,33 +89,42 @@ jobs:
             apiBase = "";
           }
 
-          function sh(s){ return JSON.stringify(String(s)); }
+          function sh(s){ return JSON.stringify(String(s ?? "")); }
 
           process.stdout.write([
             `OWNER=${sh(owner)}`,
             `REPO=${sh(repo)}`,
             `ISSUE_NUMBER=${sh(issueNumber)}`,
             `LABEL_NAME=${sh(labelName)}`,
-            `API_BASE=${sh(apiBase)}`
+            `API_BASE=${sh(apiBase)}`,
+            `SKIP=0`
           ].join("\n") + "\n");
           NODE
 
           echo "✅ context:"
-          sed -n '1,120p' /tmp/reject.env
+          sed -n '1,160p' /tmp/reject.env
 
-      - name: Gate on label state/rejected only
+      - name: Gate fast (only if label is state/rejected or workflow_dispatch)
+        env:
+          INPUT_ISSUE: ${{ inputs.issue }}
         run: |
           set -euo pipefail
           source /tmp/reject.env
 
-          if [[ "$LABEL_NAME" != "state/rejected" && "$LABEL_NAME" != "workflow_dispatch" ]]; then
-            echo "ℹ️ label=$LABEL_NAME => skip"
+          if [[ -n "${INPUT_ISSUE:-}" ]]; then
+            echo "✅ workflow_dispatch => proceed"
+            exit 0
+          fi
+
+          if [[ -n "${LABEL_NAME:-}" && "$LABEL_NAME" != "state/rejected" ]]; then
+            echo "ℹ️ triggering label='$LABEL_NAME' (not state/rejected) => skip"
             echo "SKIP=1" >> /tmp/reject.env
             exit 0
           fi
-          echo "✅ proceed (issue=$ISSUE_NUMBER)"
 
-      - name: Comment + close (only if not conflicting with state/approved)
+          echo "ℹ️ label unknown or rejected => continue to API gating"
+
+      - name: Comment + close (only if issue has state/rejected; conflict-guard approved+rejected)
         env:
           FORGE_TOKEN: ${{ secrets.FORGE_TOKEN }}
         run: |
@@ -126,14 +135,15 @@ jobs:
           test -n "${FORGE_TOKEN:-}" || { echo "❌ Missing secret FORGE_TOKEN"; exit 1; }
           test -n "${API_BASE:-}" || { echo "❌ Missing API_BASE"; exit 1; }
 
-          ISSUE_JSON="$(curl -fsS \
+          curl -fsS \
             -H "Authorization: token $FORGE_TOKEN" \
             -H "Accept: application/json" \
-            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER")"
+            "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER" \
+            > /tmp/issue.json
 
-          # conflict guard: approved + rejected => do nothing, comment warning
-          node --input-type=module - <<'NODE' "$ISSUE_JSON" > /tmp/reject.flags
-          const issue = JSON.parse(process.argv[1] || "{}");
+          node --input-type=module - <<'NODE' > /tmp/reject.flags
+          import fs from "node:fs";
+          const issue = JSON.parse(fs.readFileSync("/tmp/issue.json","utf8"));
           const labels = Array.isArray(issue.labels) ? issue.labels.map(l => String(l.name || "")).filter(Boolean) : [];
           const hasApproved = labels.includes("state/approved");
           const hasRejected = labels.includes("state/rejected");
@@ -142,6 +152,12 @@ jobs:
 
           source /tmp/reject.flags
 
+          # If issue does not actually have state/rejected -> do nothing (normal label churn)
+          if [[ "${HAS_REJECTED:-0}" != "1" ]]; then
+            echo "ℹ️ issue has no state/rejected => skip"
+            exit 0
+          fi
+
           if [[ "${HAS_APPROVED:-0}" == "1" && "${HAS_REJECTED:-0}" == "1" ]]; then
             MSG="⚠️ Conflit d'état sur le ticket #${ISSUE_NUMBER} : labels **state/approved** et **state/rejected** présents.\n\n➡️ Action manuelle requise : retirer l'un des deux labels avant relance."
             PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
@@ -154,7 +170,6 @@ jobs:
             exit 0
           fi
 
-          # comment reject
           MSG="❌ Ticket #${ISSUE_NUMBER} refusé (label state/rejected)."
           PAYLOAD="$(node --input-type=module -e 'console.log(JSON.stringify({body: process.argv[1]||""}))' "$MSG")"
 
@@ -164,7 +179,6 @@ jobs:
             "$API_BASE/api/v1/repos/$OWNER/$REPO/issues/$ISSUE_NUMBER/comments" \
             --data-binary "$PAYLOAD"
 
-          # close issue
           curl -fsS -X PATCH \
             -H "Authorization: token $FORGE_TOKEN" \
             -H "Content-Type: application/json" \

.gitea/workflows/deploy-staging-live.yml

@@ -28,7 +28,7 @@ jobs:
   deploy:
     runs-on: nas-deploy
     container:
-      image: mcr.microsoft.com/devcontainers/javascript-node:22-bookworm
+      image: localhost:5000/archicratie/nas-deploy-node22@sha256:fefa8bb307005cebec07796661ab25528dc319c33a8f1e480e1d66f90cd5cff6
 
     steps:
       - name: Tools sanity
@@ -127,25 +127,17 @@ jobs:
             echo "ℹ️ no annotations/media change -> skip deploy"
           fi
 
-      - name: Install docker client + docker compose plugin (v2) + python yaml
+      - name: Toolchain sanity + resolve COMPOSE_PROJECT_NAME
         run: |
           set -euo pipefail
           source /tmp/deploy.env
           [[ "${GO:-0}" == "1" ]] || { echo "ℹ️ skipped"; exit 0; }
 
-          apt-get -o Acquire::Retries=5 -o Acquire::ForceIPv4=true update
-          apt-get install -y --no-install-recommends ca-certificates curl docker.io python3 python3-yaml
-          rm -rf /var/lib/apt/lists/*
-
-          mkdir -p /usr/local/lib/docker/cli-plugins
-          curl -fsSL \
-            "https://github.com/docker/compose/releases/download/v${COMPOSE_VERSION}/docker-compose-linux-x86_64" \
-            -o /usr/local/lib/docker/cli-plugins/docker-compose
-          chmod +x /usr/local/lib/docker/cli-plugins/docker-compose
-
+          # tools are prebaked in the image
+          git --version
           docker version
           docker compose version
-          python3 --version
+          python3 -c 'import yaml; print("PyYAML OK")'
 
           # Reuse existing compose project name if containers already exist
           PROJ="$(docker inspect archicratie-web-blue --format '{{ index .Config.Labels "com.docker.compose.project" }}' 2>/dev/null || true)"