sec(governance): blindage du dépôt avec pipeline secops

.gitea/workflows/secops.yml

@@ -0,0 +1,47 @@
+name: DevSecOps Pipeline - Universal Quality Gate
+
+on:
+  push:
+    branches: [ "main", "develop", "dev/*" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  health-check:
+    name: System & Environment Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: System Check
+        run: |
+          echo "🚀 Pipeline CI/CD opérationnel !"
+          uname -a
+
+  gitleaks-scan:
+    name: Secret Detection (Gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Download and Run Gitleaks
+        run: |
+          wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz
+          tar -xzf gitleaks_8.18.2_linux_x64.tar.gz gitleaks
+          ./gitleaks detect --source="." --verbose --redact
+
+  trivy-iac-scan:
+    name: IaC Security & Vulnerability Scan (Trivy)
+    runs-on: ubuntu-latest
+    needs: gitleaks-scan
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy Scan
+        continue-on-error: true
+        run: |
+          wget -q https://github.com/aquasec/trivy/releases/download/v0.49.1/trivy_0.49.1_Linux-64bit.tar.gz
+          tar -xzf trivy_0.49.1_Linux-64bit.tar.gz trivy
+          ./trivy config .