RYM
/
Rym_Horizon
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: re-trigger pipeline devsecops #2

Merged
M7s merged 9 commits from dev/m7s into main 2026-08-08 18:45:57 +00:00
Conversation 1 Commits 9 Files Changed 1 +12 -7
1 changed files with 12 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
.gitea/workflows/secops.yml
View File

@ -2,7 +2,7 @@ name: DevSecOps Pipeline - Universal Quality Gate
on: on:
push: push:
branches: [ "main", "develop" ] branches: [ "main", "develop", "dev/*" ]
pull_request: pull_request:
branches: [ "main" ] branches: [ "main" ]
@ -22,11 +22,14 @@ jobs:
steps: steps:
- name: Checkout Code - name: Checkout Code
uses: actions/checkout@v4 uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Run Gitleaks via Podman - name: Download and Run Gitleaks
run: | run: |
echo "🔍 Lancement du scan Gitleaks..." wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz
podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v tar -xzf gitleaks_8.18.2_linux_x64.tar.gz gitleaks
./gitleaks detect --source="." --verbose --redact
trivy-iac-scan: trivy-iac-scan:
name: IaC Security & Vulnerability Scan (Trivy) name: IaC Security & Vulnerability Scan (Trivy)
@ -36,7 +39,9 @@ jobs:
- name: Checkout Code - name: Checkout Code
uses: actions/checkout@v4 uses: actions/checkout@v4
- name: Run Trivy IaC Scan - name: Run Trivy Scan
continue-on-error: true
run: | run: |
echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..." wget -q https://github.com/aquasec/trivy/releases/download/v0.49.1/trivy_0.49.1_Linux-64bit.tar.gz
podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path tar -xzf trivy_0.49.1_Linux-64bit.tar.gz trivy
./trivy config .