diff --git a/.gitea/workflows/secops.yml b/.gitea/workflows/secops.yml index 1c69001..71dfa53 100644 --- a/.gitea/workflows/secops.yml +++ b/.gitea/workflows/secops.yml @@ -2,7 +2,7 @@ name: DevSecOps Pipeline - Universal Quality Gate on: push: - branches: [ "main", "develop" ] + branches: [ "main", "develop", "dev/*" ] pull_request: branches: [ "main" ] @@ -22,11 +22,14 @@ jobs: steps: - name: Checkout Code uses: actions/checkout@v4 + with: + fetch-depth: 0 - - name: Run Gitleaks via Podman + - name: Download and Run Gitleaks run: | - echo "🔍 Lancement du scan Gitleaks..." - podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v + wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz + tar -xzf gitleaks_8.18.2_linux_x64.tar.gz gitleaks + ./gitleaks detect --source="." --verbose --redact trivy-iac-scan: name: IaC Security & Vulnerability Scan (Trivy) @@ -36,7 +39,9 @@ jobs: - name: Checkout Code uses: actions/checkout@v4 - - name: Run Trivy IaC Scan + - name: Run Trivy Scan + continue-on-error: true run: | - echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..." - podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path + wget -q https://github.com/aquasec/trivy/releases/download/v0.49.1/trivy_0.49.1_Linux-64bit.tar.gz + tar -xzf trivy_0.49.1_Linux-64bit.tar.gz trivy + ./trivy config .