From 498d4a4d22df25b97808fe4bf5480a475b05d55e Mon Sep 17 00:00:00 2001
From: Marc Lasserre <marc.lasserre@gorym.fr>
Date: Sat, 8 Aug 2026 18:58:16 +0200
Subject: [PATCH] sec: injection du pipeline DevSecOps universel Gitleaks +
 Trivy

---
 .gitea/workflows/secops.yml | 42 +++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 .gitea/workflows/secops.yml

diff --git a/.gitea/workflows/secops.yml b/.gitea/workflows/secops.yml
new file mode 100644
index 0000000..1c69001
--- /dev/null
+++ b/.gitea/workflows/secops.yml
@@ -0,0 +1,42 @@
+name: DevSecOps Pipeline - Universal Quality Gate
+
+on:
+  push:
+    branches: [ "main", "develop" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  health-check:
+    name: System & Environment Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: System Check
+        run: |
+          echo "🚀 Pipeline CI/CD opérationnel !"
+          uname -a
+
+  gitleaks-scan:
+    name: Secret Detection (Gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Gitleaks via Podman
+        run: |
+          echo "🔍 Lancement du scan Gitleaks..."
+          podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v
+
+  trivy-iac-scan:
+    name: IaC Security & Vulnerability Scan (Trivy)
+    runs-on: ubuntu-latest
+    needs: gitleaks-scan
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy IaC Scan
+        run: |
+          echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..."
+          podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path