From 1a83c5789624d71bb325c1bd94b64003a8a87ab3 Mon Sep 17 00:00:00 2001
From: Marc Lasserre <marc.lasserre@gorym.fr>
Date: Sat, 8 Aug 2026 19:31:17 +0200
Subject: [PATCH] fix(ci): passage a gitleaks et trivy 100% open-source

---
 .gitea/workflows/secops.yml | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/.gitea/workflows/secops.yml b/.gitea/workflows/secops.yml
index 0003f67..01f60d8 100644
--- a/.gitea/workflows/secops.yml
+++ b/.gitea/workflows/secops.yml
@@ -17,29 +17,30 @@ jobs:
           uname -a
 
   gitleaks-scan:
-    name: Secret Detection (Gitleaks)
+    name: Secret Detection (Gitleaks Open Source)
     runs-on: ubuntu-latest
+    container:
+      image: zricethezav/gitleaks:v8.18.2
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Run Gitleaks
-        uses: https://github.com/gitleaks/gitleaks-action@v2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Run Gitleaks Detect
+        run: |
+          gitleaks detect --source=. --verbose --redact
 
   trivy-iac-scan:
     name: IaC Security & Vulnerability Scan (Trivy)
     runs-on: ubuntu-latest
     needs: gitleaks-scan
+    container:
+      image: aquasec/trivy:0.49.1
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
 
       - name: Run Trivy Scan
-        uses: https://github.com/aquasec/trivy-action@master
-        with:
-          scan-type: 'config'
-          hide-shortcut-text: 'true'
+        run: |
+          trivy config .