48 lines
1.3 KiB
YAML
48 lines
1.3 KiB
YAML
name: DevSecOps Pipeline - Universal Quality Gate
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main", "develop", "dev/*" ]
|
|
pull_request:
|
|
branches: [ "main" ]
|
|
|
|
jobs:
|
|
health-check:
|
|
name: System & Environment Check
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: System Check
|
|
run: |
|
|
echo "🚀 Pipeline CI/CD opérationnel !"
|
|
uname -a
|
|
|
|
gitleaks-scan:
|
|
name: Secret Detection (Gitleaks)
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Download and Run Gitleaks
|
|
run: |
|
|
wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz
|
|
tar -xzf gitleaks_8.18.2_linux_x64.tar.gz gitleaks
|
|
./gitleaks detect --source="." --verbose --redact
|
|
|
|
trivy-iac-scan:
|
|
name: IaC Security & Vulnerability Scan (Trivy)
|
|
runs-on: ubuntu-latest
|
|
needs: gitleaks-scan
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run Trivy Scan
|
|
continue-on-error: true
|
|
run: |
|
|
wget -q https://github.com/aquasec/trivy/releases/download/v0.49.1/trivy_0.49.1_Linux-64bit.tar.gz
|
|
tar -xzf trivy_0.49.1_Linux-64bit.tar.gz trivy
|
|
./trivy config .
|