.gitea/workflows/secops.yml

@@ -2,7 +2,7 @@ name: DevSecOps Pipeline - Universal Quality Gate
 
 on:
   push:
-    branches: [ "main", "develop" ]
+    branches: [ "main", "develop", "dev/*" ]
   pull_request:
     branches: [ "main" ]
 
@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: System Check
         run: |
-          echo "🚀 Pipeline CI/CD opérationnel !"
+          echo "🚀 Pipeline CI/CD opérationnel sur le VPS !"
           uname -a
 
   gitleaks-scan:
@@ -22,11 +22,13 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-      - name: Run Gitleaks via Podman
-        run: |
-          echo "🔍 Lancement du scan Gitleaks..."
-          podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v
+      - name: Run Gitleaks
+        uses: https://github.com/gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   trivy-iac-scan:
     name: IaC Security & Vulnerability Scan (Trivy)
@@ -36,7 +38,8 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@v4
 
-      - name: Run Trivy IaC Scan
-        run: |
-          echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..."
-          podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path
+      - name: Run Trivy Scan
+        uses: https://github.com/aquasec/trivy-action@master
+        with:
+          scan-type: 'config'
+          hide-shortcut-text: 'true'