diff --git a/.gitea/workflows/test-ci.yml b/.gitea/workflows/test-ci.yml index 1fe8b62..671052b 100644 --- a/.gitea/workflows/test-ci.yml +++ b/.gitea/workflows/test-ci.yml @@ -1,21 +1,33 @@ name: DevSecOps Pipeline - V1 Infrastructure -on: [push] +on: [push, pull_request] jobs: - health-check: - name: System & Environment Check + lint-and-format: + name: Code & Config Linting (Yamllint & Hadolint) runs-on: host steps: - - name: System Check + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Run Yamllint run: | - echo "Pipeline CI/CD opérationnel sur le VPS RYM !" - uname -a - podman --version + echo "🧹 Verification de la syntaxe YAML..." + podman run --rm -v "$PWD":/data:z docker.io/cytopia/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" . + + - name: Run Hadolint (Dockerfiles) + run: | + echo "🐳 Analyse des Dockerfiles..." + if [ -n "$(find . -maxdepth 3 -name 'Dockerfile*')" ]; then + podman run --rm -i docker.io/hadolint/hadolint < Dockerfile + else + echo "Aucun Dockerfile détecté, étape ignorée." + fi gitleaks-scan: name: Secret Detection (Gitleaks) runs-on: host + needs: lint-and-format steps: - name: Checkout Code uses: actions/checkout@v4 @@ -35,5 +47,5 @@ jobs: - name: Run Trivy IaC Scan run: | - echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..." + echo "🛡️ Analyse des configurations d'infrastructure..." podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path diff --git a/.gitignore b/.gitignore index 4c49bd7..1b5ed6f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,19 @@ +# Fichiers d'environnement et secrets d'infrastructures .env +.env.local +*.env + +# Volumes de données locaux & Runtime Podman +data/ +volumes/ +*.log + +# Clés et certificats SSL/TLS +*.pem +*.crt +*.key + +# OS & IDE +.DS_Store +.vscode/ +.idea/