Ajout du mvn wrapper dans le workflow ; ajout d'un gate keeper coté workflow git afin d'éviter de build le .msi si des tests échoues

.github/workflows/desktop-release.yml

@@ -35,7 +35,56 @@ permissions:
   contents: write   # requis pour creer la Release et y attacher le .msi
 
 jobs:
+  # GATE : les 3 suites unitaires (Java / Python / Angular) doivent passer avant
+  # de construire le .msi. Tourne sur ubuntu-latest (moins cher/plus rapide que
+  # windows) ; le build natif lui-meme reste sur windows-latest via `needs`.
+  # Auto-suffisant : ne depend PAS du resultat de Gitea (CI separee), il rejoue
+  # les memes tests ici. Un test rouge => pas d'installeur publie.
+  tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('v{0}', inputs.version) || github.ref }}
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+      - name: Core — mvn test (+ JaCoCo check)
+        working-directory: core
+        run: |
+          chmod +x ./mvnw
+          ./mvnw -B test
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+          cache-dependency-path: brain/requirements-dev.txt
+      - name: Brain — pytest (+ couverture)
+        working-directory: brain
+        run: |
+          pip install -r requirements-dev.txt
+          pytest --cov=app --cov-report=term-missing --cov-fail-under=50
+
+      - name: Set up Node 20
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - name: Web — vitest (+ couverture)
+        working-directory: web
+        run: |
+          npm ci --no-audit --no-fund
+          npm run test:unit:coverage
+
   windows:
+    needs: tests
     runs-on: windows-latest
     steps:
       # En declenchement manuel, on checkout le TAG correspondant a la version