From f47b958662d6f9da14d48267d6e68e0f7cf0746f Mon Sep 17 00:00:00 2001
From: Marc Lasserre <marc.lasserre@gorym.fr>
Date: Sat, 8 Aug 2026 21:08:35 +0200
Subject: [PATCH] =?UTF-8?q?sec(governance):=20blindage=20du=20d=C3=A9p?=
 =?UTF-8?q?=C3=B4t=20avec=20pipeline=20secops?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/secops.yml      | 47 ++++++++++++++++++++++++++++++++
 CHANGELOG.md                     |  0
 iso27001/GESTION_INCIDENTS.md    |  0
 iso27001/MATRICE_RISQUES.md      |  0
 iso9001/REGLES_CODE_REVIEW.md    |  0
 techniques/HARDENING_SERVEURS.md |  0
 6 files changed, 47 insertions(+)
 create mode 100644 .gitea/workflows/secops.yml
 create mode 100644 CHANGELOG.md
 create mode 100644 iso27001/GESTION_INCIDENTS.md
 create mode 100644 iso27001/MATRICE_RISQUES.md
 create mode 100644 iso9001/REGLES_CODE_REVIEW.md
 create mode 100644 techniques/HARDENING_SERVEURS.md

diff --git a/.gitea/workflows/secops.yml b/.gitea/workflows/secops.yml
new file mode 100644
index 0000000..71dfa53
--- /dev/null
+++ b/.gitea/workflows/secops.yml
@@ -0,0 +1,47 @@
+name: DevSecOps Pipeline - Universal Quality Gate
+
+on:
+  push:
+    branches: [ "main", "develop", "dev/*" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  health-check:
+    name: System & Environment Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: System Check
+        run: |
+          echo "🚀 Pipeline CI/CD opérationnel !"
+          uname -a
+
+  gitleaks-scan:
+    name: Secret Detection (Gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download and Run Gitleaks
+        run: |
+          wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz
+          tar -xzf gitleaks_8.18.2_linux_x64.tar.gz gitleaks
+          ./gitleaks detect --source="." --verbose --redact
+
+  trivy-iac-scan:
+    name: IaC Security & Vulnerability Scan (Trivy)
+    runs-on: ubuntu-latest
+    needs: gitleaks-scan
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy Scan
+        continue-on-error: true
+        run: |
+          wget -q https://github.com/aquasec/trivy/releases/download/v0.49.1/trivy_0.49.1_Linux-64bit.tar.gz
+          tar -xzf trivy_0.49.1_Linux-64bit.tar.gz trivy
+          ./trivy config .
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..e69de29
diff --git a/iso27001/GESTION_INCIDENTS.md b/iso27001/GESTION_INCIDENTS.md
new file mode 100644
index 0000000..e69de29
diff --git a/iso27001/MATRICE_RISQUES.md b/iso27001/MATRICE_RISQUES.md
new file mode 100644
index 0000000..e69de29
diff --git a/iso9001/REGLES_CODE_REVIEW.md b/iso9001/REGLES_CODE_REVIEW.md
new file mode 100644
index 0000000..e69de29
diff --git a/techniques/HARDENING_SERVEURS.md b/techniques/HARDENING_SERVEURS.md
new file mode 100644
index 0000000..e69de29