From 2ceda3bf2caccee0ecae62086b464c3c188d1504 Mon Sep 17 00:00:00 2001
From: Marc Lasserre <marc.lasserre@gorym.fr>
Date: Fri, 7 Aug 2026 01:13:59 +0200
Subject: [PATCH] sec(ci): add Trivy IaC scanner to pipeline

Integrate Aqua Security Trivy scanner to automatically check podman-compose configurations for security misconfigurations and CVEs.
---
 .gitea/workflows/test-ci.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.gitea/workflows/test-ci.yml b/.gitea/workflows/test-ci.yml
index 83fa338..289e1bb 100644
--- a/.gitea/workflows/test-ci.yml
+++ b/.gitea/workflows/test-ci.yml
@@ -24,3 +24,16 @@ jobs:
         run: |
           echo "🔍 Lancement du scan Gitleaks..."
           podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v
+
+  trivy-iac-scan:
+    name: IaC Security & Vulnerability Scan (Trivy)
+    runs-on: host
+    needs: gitleaks-scan
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Trivy IaC Scan
+        run: |
+          echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..."
+          podman run --rm -v "$PWD":/path:z aquasec/trivy:latest config /path