From caf1a19432e9cb8c4c96dfc7d1091159f3f29d7c Mon Sep 17 00:00:00 2001
From: Marc Lasserre <marc.lasserre@gorym.fr>
Date: Fri, 7 Aug 2026 01:36:44 +0200
Subject: [PATCH] sec(ci): add Yamllint and Hadolint stages to pipeline

Integrate linting for YAML and Dockerfiles alongside Gitleaks and Trivy to enforce full DevSecOps compliance.
---
 .gitea/workflows/test-ci.yml | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/test-ci.yml b/.gitea/workflows/test-ci.yml
index 1fe8b62..7b8dfa4 100644
--- a/.gitea/workflows/test-ci.yml
+++ b/.gitea/workflows/test-ci.yml
@@ -1,21 +1,34 @@
 name: DevSecOps Pipeline - V1 Infrastructure
 
-on: [push]
+on: [push, pull_request]
 
 jobs:
-  health-check:
-    name: System & Environment Check
+  lint-and-format:
+    name: Code & Config Linting (Yamllint & Hadolint)
     runs-on: host
     steps:
-      - name: System Check
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Run Yamllint
         run: |
-          echo "Pipeline CI/CD opérationnel sur le VPS RYM !"
-          uname -a
-          podman --version
+          echo "🧹 Verification de la syntaxe YAML..."
+          podman run --rm -v "$PWD":/data:z cytopia/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" .
+
+      - name: Run Hadolint (Dockerfiles)
+        run: |
+          echo "🐳 Analyse des Dockerfiles..."
+          # Ne s'execute que si des Dockerfiles existent dans le repo
+          if [ -n "$(find . -maxdepth 3 -name 'Dockerfile*')" ]; then
+            podman run --rm -i docker.io/hadolint/hadolint < Dockerfile
+          else
+            echo "Aucun Dockerfile détecté, étape ignorée."
+          fi
 
   gitleaks-scan:
     name: Secret Detection (Gitleaks)
     runs-on: host
+    needs: lint-and-format
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -35,5 +48,5 @@ jobs:
 
       - name: Run Trivy IaC Scan
         run: |
-          echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..."
+          echo "🛡️ Analyse des configurations d'infrastructure..."
           podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path