feat: yarn berry + yarn fetch + docker opti

[devthejo]

No description provided.

[socket-security]

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
jest-environment-jsdom	29.6.1...29.6.2	None	+6/-6	216 kB	simenb
jest	29.6.1...29.6.2	None	+41/-40	7.42 MB	simenb
@babel/core	7.22.9...7.22.10	None	+2/-2	5.23 MB	nicolo-ribaudo

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[devthejo]

@matmut7 la config talisman pour ignorer le dossier .yarn n'a pas marché, j'ai tenté plusieurs syntaxes mais sans succès du coup j'ai bypass, si t'as une idée

[gitguardian]

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	Secret	Commit	Filename
3513932	Generic High Entropy Secret	c576a17	.github/workflows/e2e.yml	View secret
3513932	Generic High Entropy Secret	84bd3b1	.github/workflows/e2e.yml	View secret
3513932	Generic High Entropy Secret	50bded2	.github/workflows/e2e.yml	View secret
3513932	Generic High Entropy Secret	981809e	.github/workflows/e2e.yml	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secrets safely. Learn here the best practices.
3. Revoke and rotate these secrets.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

<sup>🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!</sup>

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[github-actions]

🎉 Deployment for commit 84de80c :

Ingresses

• 🚀 https://template-fix-optimize-dockerfile-3p5n79yk.ovh.fabrique.social.gouv.fr/

Docker images

• 📦 docker pull harbor.fabrique.social.gouv.fr/fabrique/template/app:sha-84de80cdba55110b7a151e70f4de5234250ccf5c

Debug

• 📕 Loki logs for namespace template-fix-optimize-dockerfile-3p5n79yk
• 📈 Pods monitoring for namespace template-fix-optimize-dockerfile-3p5n79yk
• 📈 Workloads monitoring for namespace template-fix-optimize-dockerfile-3p5n79yk
• 👮‍♂️ Namespace rancher template-fix-optimize-dockerfile-3p5n79yk
• 👮‍♂️ Deployment app

[maxgfr]

👌

[SocialGroovyBot]

🎉 This PR is included in version 1.16.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[revolunet]

Il faudrait svp mettre ce plugin sur l'orga socialgouv avant de deployer ailleurs : https://raw.githubusercontent.com/devthejo/yarn-plugin-fetch

[devthejo]

Il faudrait svp mettre ce plugin sur l'orga socialgouv avant de deployer ailleurs : https://raw.githubusercontent.com/devthejo/yarn-plugin-fetch

la façon de fonctionner des plugins yarn fait qu'il y a une copie locale de l'ensemble du code du plugin qui est commité, donc la reference au repo n'est qu'indicative, il ne va pas install depuis ce repo, et changer la ref dans le yarnrc n'aura aucun impact

je viens de le forker sur SocialGouv pour garder une copie, mais je vais continuer le maintenir personnellement
de plus il est déjà référencé ici https://github.com/yarnpkg/berry/blob/master/packages/gatsby/content/features/plugins.md

je suis également contributeur et co-maintainer de https://github.com/rohit-gohri/yarn-lock-to-package-json/ sur lequel il est basé

[matmut7]

@matmut7 la config talisman pour ignorer le dossier .yarn n'a pas marché, j'ai tenté plusieurs syntaxes mais sans succès du coup j'ai bypass, si t'as une idée

Je crois qu'on ne peut pas simplement ignorer un dossier du scan. On ne peut que whitelist un certain état des fichiers par leur hash. C'est un des défauts de ce système, si on a trop de frustration sur ça il faudra pas hésiter à chercher un autre système