ci: enforce SonarQube quality gate

Jenkinsfile

@@ -174,19 +174,38 @@ pipeline {
             }
 
             post {
-                always {
+    always {
-                    junit(
+        junit(
-                        testResults: 'backend/test-results/*.xml',
+            testResults: 'backend/test-results/*.xml',
-                        allowEmptyResults: true
+            allowEmptyResults: true
-                    )
+        )
 
-                    archiveArtifacts(
+        recordCoverage(
-                        artifacts: 'backend/coverage/**',
+            tools: [[
-                        fingerprint: true,
+                parser: 'LCOV',
-                        allowEmptyArchive: true
+                pattern: 'backend/coverage/lcov.info'
-                    )
+            ]],
-                }
+            sourceCodeRetention: 'EVERY_BUILD',
-            }
+            id: 'backend-coverage',
+            name: 'Backend Coverage'
+        )
+
+        publishHTML([
+            allowMissing: true,
+            alwaysLinkToLastBuild: true,
+            keepAll: true,
+            reportDir: 'backend/coverage',
+            reportFiles: 'index.html',
+            reportName: 'Backend Coverage HTML'
+        ])
+
+        archiveArtifacts(
+            artifacts: 'backend/coverage/**',
+            fingerprint: true,
+            allowEmptyArchive: true
+        )
+    }
+}
         }
 
         stage('Frontend - Lint, Tests et Build') {
@@ -225,6 +244,25 @@ pipeline {
             allowEmptyResults: true
         )
 
+        recordCoverage(
+            tools: [[
+                parser: 'LCOV',
+                pattern: 'frontend/coverage/lcov.info'
+            ]],
+            sourceCodeRetention: 'EVERY_BUILD',
+            id: 'frontend-coverage',
+            name: 'Frontend Coverage'
+        )
+
+        publishHTML([
+            allowMissing: true,
+            alwaysLinkToLastBuild: true,
+            keepAll: true,
+            reportDir: 'frontend/coverage',
+            reportFiles: 'index.html',
+            reportName: 'Frontend Coverage HTML'
+        ])
+
         archiveArtifacts(
             artifacts: 'frontend/coverage/**',
             fingerprint: true,
@@ -234,6 +272,52 @@ pipeline {
 }
         }
 
+        stage('SonarQube Analysis') {
+    when {
+        branch 'develop'
+    }
+
+    tools {
+        nodejs 'node22'
+    }
+
+    steps {
+        script {
+            def scannerHome = tool 'sonar-scanner'
+
+            withEnv(["SCANNER_HOME=${scannerHome}"]) {
+                withSonarQubeEnv('sonarqube') {
+                    sh '''
+                        echo "Node utilisé par Sonar :"
+                        node -v
+
+                        "${SCANNER_HOME}/bin/sonar-scanner" \
+                          -Dsonar.projectKey=THE-TIP-TOP \
+                          -Dsonar.projectName=THE-TIP-TOP \
+                          -Dsonar.sources=backend/src,frontend/src \
+                          -Dsonar.tests=backend/tests,frontend/src/test \
+                          -Dsonar.exclusions=frontend/src/test/**,backend/tests/**,**/node_modules/**,**/coverage/**,**/dist/** \
+                          -Dsonar.test.inclusions=backend/tests/**,frontend/src/test/** \
+                          -Dsonar.javascript.lcov.reportPaths=backend/coverage/lcov.info,frontend/coverage/lcov.info \
+                          -Dsonar.sourceEncoding=UTF-8
+                    '''
+                }
+            }
+        }
+    }
+}
+
+stage('SonarQube Quality Gate') {
+    when {
+        branch 'develop'
+    }
+
+    steps {
+        timeout(time: 5, unit: 'MINUTES') {
+            waitForQualityGate abortPipeline: true
+        }
+    }
+}
         stage('Construction des images Docker') {
             when {
                 expression {

backend/src/scripts/createAdmin.js

@@ -1,9 +1,15 @@
+require('dotenv').config()
+
 const bcrypt = require('bcrypt')
 const prisma = require('../config/prisma')
 
 async function createAdmin() {
-  const email = 'admin@thetiptop.fr'
+  const email = process.env.ADMIN_EMAIL
-  const password = 'Admin@TipTop2026!'
+  const password = process.env.ADMIN_PASSWORD
+
+  if (!email || !password) {
+    throw new Error('ADMIN_EMAIL et ADMIN_PASSWORD doivent être définis')
+  }
 
   const existing = await prisma.user.findUnique({ where: { email } })