chore: mettre en place mise-en-place et fnox

.github/workflows/job-build.yml

@@ -187,6 +187,9 @@ jobs:
       matrix:
         images: ${{ fromJSON(needs.matrix.outputs.build-matrix) }}
     steps:
+      - name: Checks-out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Download artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -220,7 +223,8 @@ jobs:
       - name: Create manifest list and push
         working-directory: /tmp/digests/${{ matrix.images.name }}
         run: |
-          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+          "$GITHUB_WORKSPACE/ci/scripts/create-image-manifest.sh" \
+            docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
             $(printf '${{ inputs.REGISTRY }}/${{ inputs.NAMESPACE }}/${{ matrix.images.name }}@sha256:%s ' *)
 
       - name: Inspect image

.github/workflows/job-lint.yml

@@ -5,16 +5,7 @@ permissions:
 
 on:
   workflow_call:
-    inputs:
-      NODE_VERSION:
-        required: false
-        type: string
   workflow_dispatch:
-    inputs:
-      NODE_VERSION:
-        description: Nodejs version used to run tests
-        required: true
-        type: string
 
 jobs:
   lint:
@@ -24,16 +15,12 @@ jobs:
       - name: Checks-out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-        id: pnpm-install
+      - name: Set up mise tools
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
-          run_install: false
-
-      - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "${{ inputs.NODE_VERSION }}"
+          version: 2026.5.15
+          install: true
+          cache: true
 
       - name: Get pnpm store directory
         id: pnpm-store
@@ -53,8 +40,19 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Check lint error
+        run: mise -E ci run lint
+
+      - name: Check environment-file boundary
+        run: ./ci/scripts/check-environment-files.sh
+
+      - name: Test environment launchers and configuration
         run: |
-          ./ci/scripts/run-tests.sh -l
+          ./scripts/with-nestjs-env.spec.sh
+          ./scripts/bootstrap-secrets.spec.sh
+          ./ci/scripts/run-unit-tests.spec.sh
+          ./ci/scripts/check-workflow-environment.spec.sh
+          ./ci/scripts/init-env.sh
+          ./ci/scripts/check-compose-environment.spec.sh
 
       - name: Validate nginx-strangler config
         run: |

.github/workflows/job-npm.yml

@@ -6,9 +6,6 @@ permissions:
 on:
   workflow_call:
     inputs:
-      NODE_VERSION:
-        required: true
-        type: string
       PUBLISH_APPS:
         required: true
         type: boolean
@@ -23,10 +20,6 @@ on:
         type: boolean
   workflow_dispatch:
     inputs:
-      NODE_VERSION:
-        description: Nodejs version used
-        required: true
-        type: string
       PUBLISH_APPS:
         description: Publish apps modules
         required: true
@@ -100,11 +93,12 @@ jobs:
       - name: Checks-out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-        id: pnpm-install
+      - name: Set up mise tools
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
-          run_install: false
+          version: 2026.5.15
+          install: true
+          cache: true
 
       - name: Check changes
         id: check
@@ -177,11 +171,12 @@ jobs:
         with:
           ref: ${{ github.event.ref }}
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-        id: pnpm-install
+      - name: Set up mise tools
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
-          run_install: false
+          version: 2026.5.15
+          install: true
+          cache: true
 
       - name: Check for new package version
         id: check-version
@@ -199,13 +194,6 @@ jobs:
           fi
           echo "REMOTE=$REMOTE" >> $GITHUB_OUTPUT
 
-      - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        if: ${{ steps.check-version.outputs.REMOTE == 'false' }}
-        with:
-          node-version: "${{ inputs.NODE_VERSION }}"
-          registry-url: "https://registry.npmjs.org"
-
       - name: Get pnpm store directory
         if: ${{ steps.check-version.outputs.REMOTE == 'false' }}
         id: pnpm-store

.github/workflows/job-playwright.yml

@@ -6,18 +6,11 @@ permissions:
 on:
   workflow_call:
     inputs:
-      NODE_VERSION:
-        required: true
-        type: string
       TAG:
         required: true
         type: string
   workflow_dispatch:
     inputs:
-      NODE_VERSION:
-        description: Nodejs version used to run tests
-        required: true
-        type: string
       TAG:
         description: Container images version to use for console client and server/server-nestjs
         required: true
@@ -37,6 +30,13 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Set up mise tools
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.5.15
+          install: true
+          cache: true
+
       - name: Ensure Playwright browsers
         run: pnpm --dir playwright exec playwright install chromium firefox
 
@@ -49,24 +49,25 @@ jobs:
             docker pull "${GHCR_CACHE}/cloud-pi-native/console/${img}:${{ inputs.TAG }}"
             docker tag  "${GHCR_CACHE}/cloud-pi-native/console/${img}:${{ inputs.TAG }}" "dso-console/${img}:ci"
           done
-          docker compose -f ./docker/docker-compose.ci.yml up --no-build -d --remove-orphans
+          mise -E ci exec -- fnox exec -- docker compose -f ./docker/docker-compose.ci.yml up --no-build -d --remove-orphans
 
       # See https://playwright.dev/docs/test-sharding for how Playwright handles test sharding
       - name: Run Playwright tests
-        run: pnpm --dir playwright exec playwright test --grep @e2e --shard=${{ matrix.shard }}/4 --reporter=blob
+        run: mise -E ci run playwright:test -- --shard=${{ matrix.shard }}/4 --reporter=blob
 
       - name: Dump docker compose state on failure
         if: ${{ failure() }}
         run: |
-          docker compose -f ./docker/docker-compose.ci.yml ps -a
+          mise -E ci exec -- fnox exec -- docker compose -f ./docker/docker-compose.ci.yml ps -a
           for service in keycloak postgres server server-nestjs client nginx-strangler opencds-mockoon; do
             echo -e "\nInspecting ${service}..."
-            docker compose -f ./docker/docker-compose.ci.yml logs --no-color ${service}
+            mise -E ci exec -- fnox exec -- docker compose -f ./docker/docker-compose.ci.yml logs --no-color ${service}
             docker inspect dso-console_${service} --format '{{json .State}}'
           done
 
       - name: Clean up docker resources (containers, volumes)
-        run: docker compose -f ./docker/docker-compose.ci.yml down -v --remove-orphans
+        if: ${{ always() }}
+        run: mise -E ci exec -- fnox exec -- docker compose -f ./docker/docker-compose.ci.yml down -v --remove-orphans
 
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: ${{ !cancelled() }}

.github/workflows/job-tests-unit.yml

@@ -5,10 +5,6 @@ permissions:
 
 on:
   workflow_call:
-    inputs:
-      NODE_VERSION:
-        required: true
-        type: string
     secrets:
       SONAR_HOST_URL:
         required: false
@@ -17,11 +13,6 @@ on:
       SONAR_PROJECT_KEY:
         required: false
   workflow_dispatch:
-    inputs:
-      NODE_VERSION:
-        description: Nodejs version used to run tests
-        required: true
-        type: string
 
 jobs:
   unit-tests:
@@ -31,16 +22,12 @@ jobs:
       - name: Checks-out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-        id: pnpm-install
+      - name: Set up mise tools
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
-          run_install: false
-
-      - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: "${{ inputs.NODE_VERSION }}"
+          version: 2026.5.15
+          install: true
+          cache: true
 
       - name: Get pnpm store directory
         id: pnpm-store
@@ -68,7 +55,7 @@ jobs:
       - name: Run unit tests
         run: |
           ./ci/scripts/init-env.sh
-          ./ci/scripts/run-tests.sh -u
+          mise -E ci run test:unit
 
       - name: Upload vitest coverage artifacts
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
@@ -115,16 +102,12 @@ jobs:
           name: unit-tests-coverage
           path: ./coverage
 
-      - name: Install pnpm
-        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
-        id: pnpm-install
-        with:
-          run_install: false
-
-      - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+      - name: Set up mise tools
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
-          node-version: "${{ inputs.NODE_VERSION }}"
+          version: 2026.5.15
+          install: true
+          cache: true
 
       - name: Get pnpm store directory
         id: pnpm-store

.github/workflows/workflow-continuous-integration.yml

@@ -19,7 +19,6 @@ on:
   workflow_dispatch:
 
 env:
-  NODE_VERSION: 26.7.0
   REGISTRY: ghcr.io
   NAMESPACE: "${{ github.repository }}"
   BUILD_AMD64: true
@@ -56,7 +55,6 @@ jobs:
   expose-vars:
     runs-on: ubuntu-latest
     outputs:
-      NODE_VERSION: ${{ env.NODE_VERSION }}
       REGISTRY: ${{ env.REGISTRY }}
       NAMESPACE: ${{ env.NAMESPACE }}
       BUILD_AMD64: ${{ env.BUILD_AMD64 }}
@@ -70,17 +68,13 @@ jobs:
     uses: ./.github/workflows/job-lint.yml
     needs:
       - expose-vars
-    with:
-      NODE_VERSION: ${{ needs.expose-vars.outputs.NODE_VERSION }}
 
   unit-tests:
     uses: ./.github/workflows/job-tests-unit.yml
     if: ${{ needs.path-filter.outputs.apps == 'true' || needs.path-filter.outputs.packages == 'true' || needs.path-filter.outputs.ci == 'true' }}
     needs:
       - path-filter
       - expose-vars
-    with:
-      NODE_VERSION: ${{ needs.expose-vars.outputs.NODE_VERSION }}
     secrets:
       SONAR_HOST_URL: "${{ secrets.SONAR_HOST_URL }}"
       SONAR_TOKEN: "${{ secrets.SONAR_TOKEN }}"

.github/workflows/workflow-handle-hotfix.yml

@@ -19,7 +19,6 @@ env:
   BUILD_AMD64: true
   BUILD_ARM64: true
   USE_QEMU: false
-  NODE_VERSION: 26.7.0
 
 jobs:
   expose-vars:
@@ -30,7 +29,6 @@ jobs:
       BUILD_AMD64: ${{ env.BUILD_AMD64 }}
       BUILD_ARM64: ${{ env.BUILD_ARM64 }}
       USE_QEMU: ${{ env.USE_QEMU }}
-      NODE_VERSION: ${{ env.NODE_VERSION }}
     steps:
       - name: Exposing env vars
         run: echo "Exposing env vars"

.github/workflows/workflow-handle-main.yml

@@ -14,7 +14,6 @@ env:
   NAMESPACE: "${{ github.repository }}"
   BUILD_AMD64: true
   USE_QEMU: false
-  NODE_VERSION: 26.7.0
 
 jobs:
   expose-vars:
@@ -24,7 +23,6 @@ jobs:
       NAMESPACE: ${{ env.NAMESPACE }}
       BUILD_AMD64: ${{ env.BUILD_AMD64 }}
       USE_QEMU: ${{ env.USE_QEMU }}
-      NODE_VERSION: ${{ env.NODE_VERSION }}
     steps:
       - name: Exposing env vars
         run: echo "Exposing env vars"
@@ -37,10 +35,10 @@ jobs:
       REGISTRY: ${{ needs.expose-vars.outputs.REGISTRY }}
       NAMESPACE: ${{ needs.expose-vars.outputs.NAMESPACE }}
       RELEASE_CREATED: false
-      TAG: ''
-      MAJOR_TAG: ''
-      MINOR_TAG: ''
-      PATCH_TAG: ''
+      TAG: ""
+      MAJOR_TAG: ""
+      MINOR_TAG: ""
+      PATCH_TAG: ""
       BUILD_AMD64: ${{ needs.expose-vars.outputs.BUILD_AMD64 == 'true' }}
       BUILD_ARM64: false
       USE_QEMU: ${{ needs.expose-vars.outputs.USE_QEMU == 'true' }}

.github/workflows/workflow-handle-releases.yml

@@ -17,7 +17,6 @@ env:
   BUILD_AMD64: true
   BUILD_ARM64: true
   USE_QEMU: false
-  NODE_VERSION: 26.7.0
 
 jobs:
   expose-vars:
@@ -28,7 +27,6 @@ jobs:
       BUILD_AMD64: ${{ env.BUILD_AMD64 }}
       BUILD_ARM64: ${{ env.BUILD_ARM64 }}
       USE_QEMU: ${{ env.USE_QEMU }}
-      NODE_VERSION: ${{ env.NODE_VERSION }}
     steps:
       - name: Exposing env vars
         run: echo "Exposing env vars"