ci: smoke-voice workflow (cron 6h + manual)

.github/workflows/smoke-voice.yml

@@ -0,0 +1,60 @@
+name: smoke-voice
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'   # toutes les 6 h
+  workflow_dispatch:        # manuel
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    continue-on-error: true   # ne pas casser le repo si voice-bridge down
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Tailscale connect
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TAILSCALE_OAUTH_SECRET }}
+          tags: tag:ci
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          python-version: '3.14'
+
+      - name: Probe voice-bridge reachability
+        id: probe
+        run: |
+          if curl -fsSL --max-time 5 http://100.116.92.12:8200/health; then
+            echo "reachable=true" >> $GITHUB_OUTPUT
+          else
+            echo "reachable=false" >> $GITHUB_OUTPUT
+            echo "::warning::voice-bridge unreachable, smoke will report exit 2"
+          fi
+
+      - name: Run smoke
+        if: steps.probe.outputs.reachable == 'true'
+        run: make smoke-voice
+
+      - name: Upload artefacts
+        if: always() && hashFiles('/tmp/zacus_smoke_report.json') != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: smoke-${{ github.run_id }}
+          path: |
+            /tmp/zacus_smoke_in.wav
+            /tmp/zacus_smoke_out_*.wav
+            /tmp/zacus_smoke_report.json
+            /tmp/zacus_smoke.jsonl
+          retention-days: 7
+
+      - name: Summarize
+        if: always()
+        run: |
+          if [ -f /tmp/zacus_smoke_report.json ]; then
+            echo "## Smoke voice loop" >> $GITHUB_STEP_SUMMARY
+            jq '.' /tmp/zacus_smoke_report.json >> $GITHUB_STEP_SUMMARY
+          fi

tools/macstudio/README.md

@@ -172,6 +172,37 @@ Modes (`--mode`):
 | `/tts` F5 cold | 4–8 s (steps=4) |
 | `/voice/ws` total (STT + intent + TTS) | 8–15 s sur phrase courte FR |
 
+### CI smoke (GitHub Actions)
+
+Le workflow `.github/workflows/smoke-voice.yml` exécute `make smoke-voice` contre
+le voice-bridge live (`100.116.92.12:8200`, joignable uniquement via Tailscale)
+toutes les 6 h, plus déclenchement manuel.
+
+```bash
+gh workflow run smoke-voice
+```
+
+Étapes : checkout → `tailscale/github-action@v2` (auth OAuth) → `astral-sh/setup-uv@v6`
+(Python 3.14) → probe `/health` (curl 5 s timeout) → `make smoke-voice` si
+reachable → upload artefacts (`/tmp/zacus_smoke_*.{wav,json,jsonl}`, 7 j de
+rétention) → `jq` summary dans `$GITHUB_STEP_SUMMARY`.
+
+**Secrets requis** (à provisionner dans `Settings → Secrets and variables → Actions`) :
+
+| Secret | Source |
+|--------|--------|
+| `TAILSCALE_OAUTH_CLIENT_ID` | Tailscale admin → OAuth clients (scope `devices`, tag `tag:ci`) |
+| `TAILSCALE_OAUTH_SECRET` | idem (révélé une seule fois à la création) |
+
+Le tag `tag:ci` doit être déclaré dans `tailnet policy` (ACLs) avec une règle
+permettant l'accès au port `8200` de `studio`.
+
+**Comportement no-op** — `continue-on-error: true` au niveau du job + probe
+préalable : si Tailscale fail ou voice-bridge injoignable, le workflow reste
+vert avec un `::warning::` (pas de faux-positif rouge sur le repo). Si le
+voice-bridge répond mais que `smoke_e2e.py` exit `1`, le job apparaît rouge dans
+les logs mais n'échoue pas le commit.
+
 ## Network
 
 Studio is multi-homed. The `192.168.0.150` IP previously hardcoded in some