La chaîne
qualitéThe quality
line

D'abord le .gitignore : le venv, les runs MLflow et surtout creditcard.csv (144 Mo, au-dessus de la limite GitHub) ne se commitent jamais. Puis le push — option A avec la CLI, option B via le site. The .gitignore first: the venv, the MLflow runs and above all creditcard.csv (144 MB, above GitHub's limit) never get committed. Then the push — option A with the CLI, option B via the website.

cd fraud-detection
cat >> .gitignore <<'EOF'
.venv/
mlruns/
__pycache__/
data/creditcard.csv
EOF
git add -A
git commit -m "chore: prepare repo for CI"

# option A: GitHub CLI
gh auth login
gh repo create fraud-detection --private --source . --push

# option B: create an empty private repo on github.com, then
git remote add origin https://github.com/YOUR_USER/fraud-detection.git
git push -u origin main

La recette complète : quatre jobs — lint + tests (ceux du bloc 3), validation des données, gate PR-AUC, et le build-push Docker qui n'a lieu que si les trois autres sont verts. Avant de pousser, vérifiez en local : pip install pytest ruff puis ruff check src et pytest. The full recipe: four jobs — lint + tests (block 3's), data validation, PR-AUC gate, and the Docker build-push that only happens if the other three are green. Before pushing, check locally: pip install pytest ruff then ruff check src and pytest.

name: ci

on:
  push:
    branches: [main]
  pull_request:

jobs:
  lint-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
      - run: pip install -r requirements.txt pytest ruff
      - run: ruff check src
      - run: pytest

  data-validation:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
      - run: pip install pandas
      - run: python scripts/validate_data.py data/sample.csv

  model-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
      - run: pip install pandas scikit-learn
      - run: python scripts/gate.py

  build-push:
    runs-on: ubuntu-latest
    needs: [lint-test, data-validation, model-gate]
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

Deux jobs vont rester rouges : les scripts qu'ils appellent n'existent pas encore. C'est voulu — les missions 2 et 3 les fournissent, et vous verrez la chaîne passer au vert morceau par morceau. Two jobs will stay red: the scripts they call don't exist yet. That's intended — missions 2 and 3 provide them, and you'll watch the line turn green piece by piece.

git add .github/workflows/ci.yml
git commit -m "ci: quality line - lint, data check, gate, build"
git push

La CI a besoin de données, mais on ne commite JAMAIS le dataset complet — seulement un échantillon stratifié de 5 000 lignes qui préserve le taux de fraude. Créez scripts/make_sample.py : The CI needs data, but you NEVER commit the full dataset — only a 5,000-row stratified sample that preserves the fraud rate. Create scripts/make_sample.py:

import pandas as pd
from sklearn.model_selection import train_test_split

df = pd.read_csv("data/creditcard.csv")
sample, _ = train_test_split(
    df, train_size=5000, stratify=df["Class"], random_state=42)
sample.to_csv("data/sample.csv", index=False)
print(sample["Class"].value_counts())

mkdir -p scripts
python scripts/make_sample.py
wc -l data/sample.csv

Les quatre familles de l'acte 3, en assertions exécutables : schéma (31 colonnes, types numériques), bornes (Amount ≥ 0, Class ∈ {0, 1}), manquants (zéro NaN), distribution (taux de fraude entre 0,05 % et 1 %). Une violation → exit 1 → commit rouge, avec un message clair. Act 3's four families, as executable assertions: schema (31 columns, numeric types), bounds (Amount ≥ 0, Class ∈ {0, 1}), missing values (zero NaN), distribution (fraud rate between 0.05% and 1%). One violation → exit 1 → red commit, with a clear message.

import sys

import pandas as pd

EXPECTED_COLUMNS = ["Time"] + [f"V{i}" for i in range(1, 29)] + ["Amount", "Class"]


def fail(message):
    print(f"DATA VALIDATION FAILED: {message}")
    sys.exit(1)


def main(path):
    df = pd.read_csv(path)

    if list(df.columns) != EXPECTED_COLUMNS:
        fail(f"schema mismatch, expected 31 known columns, got: {list(df.columns)}")
    for col in EXPECTED_COLUMNS:
        if not pd.api.types.is_numeric_dtype(df[col]):
            fail(f"column {col} is not numeric")
    if df.isna().any().any():
        fail("dataset contains NaN values")
    if (df["Amount"] < 0).any():
        fail("negative Amount found")
    if not df["Class"].isin([0, 1]).all():
        fail("Class must be 0 or 1")
    fraud_rate = df["Class"].mean()
    if not 0.0005 <= fraud_rate <= 0.01:
        fail(f"fraud rate {fraud_rate:.4%} outside [0.05%, 1%]")

    print(f"data OK: {len(df)} rows, fraud rate {fraud_rate:.4%}")


if __name__ == "__main__":
    main(sys.argv[1] if len(sys.argv) > 1 else "data/sample.csv")

python scripts/validate_data.py data/sample.csv

Poussez, vérifiez le vert — puis cassez volontairement : un Amount négatif dans l'échantillon doit faire crier la chaîne. Réparez en régénérant l'échantillon propre. Push, check the green — then break it on purpose: one negative Amount in the sample must make the line scream. Fix it by regenerating a clean sample.

git add scripts/ data/sample.csv
git commit -m "ci: data validation + committed sample"
git push

# break it on purpose: one negative Amount
python -c "import pandas as pd; d = pd.read_csv('data/sample.csv'); d.loc[d.index[0], 'Amount'] = -50; d.to_csv('data/sample.csv', index=False)"
git commit -am "test: corrupt the sample on purpose"
git push

# repair
python scripts/make_sample.py
git commit -am "fix: restore a clean sample"
git push

D'abord le champion à battre — créez metrics/baseline.json (valeur plancher au départ) : First, the champion to beat — create metrics/baseline.json (a floor value to start):

{
  "pr_auc": 0.60,
  "updated": "2026-07-06",
  "reason": "floor value - replace with your first local gate run"
}

Puis le gate : il entraîne le challenger sur l'échantillon, mesure sa PR-AUC et refuse toute régression au-delà d'une tolérance ε = 0,02 — le bruit d'entraînement n'est pas une régression. Créez scripts/gate.py : Then the gate: it trains the challenger on the sample, measures its PR-AUC and refuses any regression beyond an ε = 0.02 tolerance — training noise is not a regression. Create scripts/gate.py:

import json
import sys

import pandas as pd
from sklearn.linear_model import LogisticRegression
from sklearn.metrics import average_precision_score
from sklearn.model_selection import train_test_split
from sklearn.pipeline import Pipeline
from sklearn.preprocessing import StandardScaler

EPSILON = 0.02
BASELINE_PATH = "metrics/baseline.json"


def main():
    df = pd.read_csv("data/sample.csv")
    X = df.drop(columns=["Class"])
    y = df["Class"]
    X_tr, X_te, y_tr, y_te = train_test_split(
        X, y, test_size=0.2, stratify=y, random_state=42)

    model = Pipeline([
        ("scaler", StandardScaler()),
        ("clf", LogisticRegression(class_weight="balanced", max_iter=1000)),
    ])
    model.fit(X_tr, y_tr)
    proba = model.predict_proba(X_te)[:, 1]
    pr_auc = average_precision_score(y_te, proba)

    with open(BASELINE_PATH) as f:
        baseline = json.load(f)["pr_auc"]

    print(f"challenger pr_auc={pr_auc:.4f}  baseline={baseline:.4f}  epsilon={EPSILON}")
    if pr_auc < baseline - EPSILON:
        print("GATE FAILED: model regresses beyond tolerance")
        sys.exit(1)
    print("GATE PASSED")


if __name__ == "__main__":
    main()

mkdir -p metrics
python scripts/gate.py

Poussez : les quatre jobs doivent passer, build-push compris. Puis sabotez le gate — un baseline gonflé simule un challenger qui régresse — et réparez d'un revert. Push: all four jobs must pass, build-push included. Then sabotage the gate — an inflated baseline simulates a regressing challenger — and repair with a revert.

git add scripts/gate.py metrics/baseline.json
git commit -m "ci: PR-AUC gate against committed baseline"
git push

# sabotage: inflate the baseline - the gate must refuse
python -c "import json; json.dump({'pr_auc': 0.99}, open('metrics/baseline.json', 'w'))"
git commit -am "test: inflated baseline on purpose"
git push

# repair: restore the honest baseline
git revert --no-edit HEAD
git push

La carte d'identité du modèle — une page, honnête. Les chiffres ci-dessous sont des exemples : remplacez-les par les valeurs de vos runs MLflow (bloc 5), y compris les segments. The model's identity card — one honest page. The numbers below are examples: replace them with the values from your MLflow runs (block 5), segments included.

# Model card - fraud-detector

## Model
- Type: scikit-learn pipeline (StandardScaler + LogisticRegression, class_weight=balanced)
- Version: MLflow registry "fraud-detector", alias @production (v2)
- Owner: your-name - date: 2026-07-06

## Training data
- Source: creditcard.csv (Kaggle ULB) - 284 807 transactions, 492 frauds (0.17%)
- Features: Time, V1-V28 (anonymized PCA components), Amount
- Split: 80/20 stratified, random_state=42 - scaler fitted on train only

## Metrics (test set)
- PR-AUC global: 0.79
- PR-AUC amounts over 1000 EUR: 0.71 - weakest segment, see limits
- PR-AUC night (00h-06h): 0.74
- Threshold 0.42, chosen to minimize business cost:
  a missed fraud costs its amount, a false alert costs 15 EUR

## Limits
- 2013 data, European cardholders: drift expected elsewhere (monitored in block 7)
- Anonymized features: individual decisions are hard to explain to a customer
- Weaker on amounts over 1000 EUR - exactly where an error costs most

## Intended use
- Real-time scoring of card transactions, alerts reviewed by a human analyst
- Out of scope: automatic blocking without human review, creditworthiness scoring

## Contact
- Team fraud-ml: fraud-ml@dotika.example - escalation: see the on-call runbook

mkdir -p docs
git add docs/model_card.md
git commit -m "docs: model card v1"
git push