feat(security+ai): goal-oriented agent + hardening de segurança (audit 2026-04-17)

.commitlintrc.json

@@ -0,0 +1,27 @@
+{
+  "extends": ["@commitlint/config-conventional"],
+  "rules": {
+    "type-enum": [
+      2,
+      "always",
+      [
+        "feat",
+        "fix",
+        "docs",
+        "style",
+        "refactor",
+        "perf",
+        "test",
+        "chore",
+        "ci",
+        "revert"
+      ]
+    ],
+    "type-case": [2, "always", "lowercase"],
+    "type-empty": [2, "never"],
+    "subject-empty": [2, "never"],
+    "subject-full-stop": [2, "never", "."],
+    "subject-case": [2, "never", ["start-case", "pascal-case", "upper-case"]],
+    "header-max-length": [2, "always", 100]
+  }
+}

.github/workflows/ci.yml

@@ -0,0 +1,141 @@
+# CI — NossoCRM
+#
+# Jobs:
+#   check  — lint + typecheck + tests (runs on every PR and push to main/feature branches)
+#   build  — Next.js production build (runs only on push to main)
+#
+# Cache strategy:
+#   - pnpm store: keyed on pnpm-lock.yaml hash via actions/setup-node cache: "pnpm"
+#   - .next/cache: keyed on source hash, restores on prefix match
+#
+# Security: no untrusted event inputs are interpolated into run: commands.
+
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - "feature/**"
+      - "fix/**"
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_VERSION: "20"
+  PNPM_VERSION: "9"
+
+jobs:
+  # ─── commitlint ────────────────────────────────────────────────────────────
+  # Validates commit messages follow conventional commits format
+  # Runs only on PRs to catch format issues before merge
+  commitlint:
+    name: Validate Conventional Commits
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - name: Install commitlint
+        run: npm install --save-dev @commitlint/cli @commitlint/config-conventional --legacy-peer-deps
+
+      - name: Validate commits
+        run: |
+          npx commitlint \
+            --from ${{ github.event.pull_request.base.sha }} \
+            --to ${{ github.event.pull_request.head.sha }}
+
+  # ─── check ────────────────────────────────────────────────────────────────
+  # Runs precheck:fast: ESLint (--max-warnings 0) + tsc --noEmit + vitest run
+  # Fast path — no Next.js build required. Runs on all triggering events.
+  check:
+    name: Lint / Typecheck / Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Setup Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Lint (ESLint — zero warnings)
+        run: pnpm lint
+
+      - name: Typecheck (tsc --noEmit)
+        run: pnpm typecheck
+
+      - name: Tests (Vitest)
+        run: pnpm test:run
+
+  # ─── build ────────────────────────────────────────────────────────────────
+  # Full Next.js production build. Runs only on pushes to main.
+  # Depends on check passing to avoid wasting build minutes on broken code.
+  build:
+    name: Build (Next.js)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    needs: check
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+
+      - name: Setup Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: "pnpm"
+
+      - name: Restore Next.js build cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ${{ github.workspace }}/.next/cache
+          key: ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-${{ hashFiles('**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx', '**/*.css') }}
+          restore-keys: |
+            ${{ runner.os }}-nextjs-${{ hashFiles('**/pnpm-lock.yaml') }}-
+            ${{ runner.os }}-nextjs-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build
+        run: pnpm build
+        env:
+          # Next.js build requires these to be present even if not used at runtime.
+          # Real values come from Vercel project settings — these are build-time only.
+          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
+          NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY }}

.github/workflows/preview.yml

@@ -0,0 +1,50 @@
+# Preview — NossoCRM
+#
+# Triggers a Vercel Preview deployment on every PR.
+# The deployment URL is posted as a PR comment via Vercel's GitHub integration.
+#
+# Prerequisites (set in repo Settings → Secrets and variables → Actions):
+#   VERCEL_TOKEN            — personal access token from vercel.com/account/tokens
+#   VERCEL_ORG_ID           — from .vercel/project.json or `vercel env pull`
+#   VERCEL_PROJECT_ID       — from .vercel/project.json or `vercel env pull`
+#
+# This job does NOT run the build itself — Vercel handles the build on its
+# infrastructure using the same Next.js config. The CI check job (ci.yml)
+# is the quality gate; preview deploy runs in parallel to save time.
+#
+# Security: no untrusted event inputs are interpolated into run: commands.
+
+name: Preview Deploy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: preview-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  deploy-preview:
+    name: Deploy Preview to Vercel
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Deploy to Vercel (Preview)
+        id: deploy
+        uses: amondnet/vercel-action@v25
+        with:
+          vercel-token: ${{ secrets.VERCEL_TOKEN }}
+          vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}
+          vercel-project-id: ${{ secrets.VERCEL_PROJECT_ID }}
+          # Do not promote to production on this workflow
+          vercel-args: "--no-wait"
+          github-comment: true
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -0,0 +1,96 @@
+# Release — NossoCRM
+#
+# Triggered when a semantic version tag (vX.Y.Z) is pushed to main branch.
+# Creates a GitHub Release with auto-generated release notes from merged PRs.
+#
+# Usage:
+#   npm run release:prepare    # Analyze commits and suggest version
+#   npm run release:draft      # Preview changelog
+#   npm run release:tag        # Create tag and push
+#   git push origin main
+#   git push origin vX.Y.Z      # This triggers this workflow
+
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*.*.*"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # ─── release ──────────────────────────────────────────────────────────────
+  # Create GitHub Release from pushed semantic version tag
+  release:
+    name: Create Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Fetch full history for changelog generation
+
+      - name: Extract version from tag
+        id: version
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          TAG="${REF_NAME}"
+          VERSION="${TAG#v}"
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+          echo "Release version: ${VERSION}"
+
+      - name: Get previous release
+        id: prev_release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          LATEST=$(gh release list --limit 1 --json tagName --jq -r '.[] | .tagName' 2>/dev/null || echo "")
+          if [ -z "$LATEST" ]; then
+            PREV_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          else
+            PREV_TAG="${LATEST}"
+          fi
+          echo "previous_tag=${PREV_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Extract changelog for version
+        id: changelog
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          if [ -f "CHANGELOG.md" ]; then
+            # Extract section from ## [VERSION] to next ## [
+            # Using a safe shell command to avoid injection
+            awk "/^## \[${VERSION}\]/,/^## \[/" CHANGELOG.md | head -n -1 > /tmp/changelog.txt
+            if [ -s /tmp/changelog.txt ]; then
+              # Convert to GitHub Actions multiline format
+              {
+                echo 'NOTES<<EOF'
+                cat /tmp/changelog.txt
+                echo 'EOF'
+              } >> $GITHUB_ENV
+            fi
+          fi
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ steps.version.outputs.tag }}
+          name: Release ${{ steps.version.outputs.version }}
+          body: |
+            ${{ env.NOTES }}
+
+            ---
+
+            **Full Diff**: https://github.com/${{ github.repository }}/compare/${{ steps.prev_release.outputs.previous_tag }}...${{ steps.version.outputs.tag }}
+          draft: false
+          prerelease: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}