fix(ci): npm ci verrouille + sans lifecycle scripts (Sonar S6505/S8543)

[Lemniscate-world]

Deverrouille le Quality Gate de #4 (C Security Rating) : --ignore-scripts (S6505) + npm ci sur package-lock.json versionne (S8543). Code smells JS restants (complexite, regex) : non bloquants, a traiter dans #4.

---

Summary by cubic

Switches CI from npm install to npm ci --ignore-scripts to unblock the Sonar Quality Gate on S6505 and S8543.

• npm ci does a clean install from the committed package-lock.json instead of resolving fresh.
• --ignore-scripts skips package lifecycle scripts, which can affect dependencies that build during install.

^{Written for commit e244fa6. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 94aac7a8-d889-4443-a4fe-fa67a58b4f28

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can group findings by type and pick your Finding display, from Minimal to Full

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

PR Summary by Qodo

Harden CI installs with locked, script-free npm ci

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Uses deterministic lockfile installs across every CI operating system and Node.js version.
• Disables dependency lifecycle scripts to satisfy Sonar security rules and reduce CI risk.

Diagram

graph TD
  A["CI test matrix"] -->|each target| B["Node setup"] -->|starts install| C["Locked install"] -->|then runs| D["Test suite"]
  E["Versioned lockfile"] -->|pins dependencies| C

Loading

High-Level Assessment

The selected approach is optimal for CI: npm ci enforces package-lock.json consistency and clean, reproducible installs, while --ignore-scripts prevents dependency lifecycle execution. Retaining npm install would provide weaker lockfile guarantees and would not address Sonar S8543.

Files changed (1) +1 / -1

Other (1) +1 / -1

test.ymlUse deterministic, script-free dependency installation +1/-1

Use deterministic, script-free dependency installation

• Replaces npm install with npm ci --ignore-scripts across the CI operating-system and Node.js matrix. This enforces the versioned lockfile and prevents dependency lifecycle scripts from executing.

.github/workflows/test.yml

[cubic-dev-ai]

No issues found across 1 file

<sub>Requires human review: The CI install behavior changes materially: it switches to lockfile-enforced clean installs and skips lifecycle scripts. A human should confirm this operational tradeoff is safe for all test dependencies.

Re-trigger cubic</sub>

[Lemniscate-world]

run=35121251506

Kuro PR-agent — SonarQube en echec sur fix/ci-npm-locked.

• Cause probable : le scan SonarQube échoue faute de SONAR_TOKEN valide/accessible (secret manquant, expiré, ou non exposé au job), ou sonar-project.properties/sonar.host.url mal configuré.
• Vérifier dans les logs l'erreur exacte : 401 Unauthorized, Project not found, ou Not authorized oriente vers le token ; Connection refused vers l'URL du serveur.
• Correctif immédiat : régénérer le token dans SonarQube, mettre à jour le secret SONAR_TOKEN du repo, et confirmer que le job y a bien accès (pas de environment restrictif).
• Contrôler sonar-project.properties : sonar.projectKey et sonar.organization doivent correspondre au projet SonarQube cible.
• Si SonarQube est self-hosted, vérifier que SONAR_HOST_URL est défini et que le runner peut l'atteindre (réseau/VPN).

Voir le run