.gitea/workflows/secops.yml

@@ -0,0 +1,42 @@
+name: DevSecOps Pipeline - Universal Quality Gate
+
+on:
+  push:
+    branches: [ "main", "develop" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+  health-check:
+    name: System & Environment Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: System Check
+        run: |
+          echo "🚀 Pipeline CI/CD opérationnel !"
+          uname -a
+
+  gitleaks-scan:
+    name: Secret Detection (Gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Gitleaks via Podman
+        run: |
+          echo "🔍 Lancement du scan Gitleaks..."
+          podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v
+
+  trivy-iac-scan:
+    name: IaC Security & Vulnerability Scan (Trivy)
+    runs-on: ubuntu-latest
+    needs: gitleaks-scan
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy IaC Scan
+        run: |
+          echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..."
+          podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path