From caf1a19432e9cb8c4c96dfc7d1091159f3f29d7c Mon Sep 17 00:00:00 2001 From: Marc Lasserre Date: Fri, 7 Aug 2026 01:36:44 +0200 Subject: [PATCH 2/5] sec(ci): add Yamllint and Hadolint stages to pipeline Integrate linting for YAML and Dockerfiles alongside Gitleaks and Trivy to enforce full DevSecOps compliance. --- .gitea/workflows/test-ci.yml | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/test-ci.yml b/.gitea/workflows/test-ci.yml index 1fe8b62..7b8dfa4 100644 --- a/.gitea/workflows/test-ci.yml +++ b/.gitea/workflows/test-ci.yml @@ -1,21 +1,34 @@ name: DevSecOps Pipeline - V1 Infrastructure -on: [push] +on: [push, pull_request] jobs: - health-check: - name: System & Environment Check + lint-and-format: + name: Code & Config Linting (Yamllint & Hadolint) runs-on: host steps: - - name: System Check + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Run Yamllint run: | - echo "Pipeline CI/CD opérationnel sur le VPS RYM !" - uname -a - podman --version + echo "🧹 Verification de la syntaxe YAML..." + podman run --rm -v "$PWD":/data:z cytopia/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" . + + - name: Run Hadolint (Dockerfiles) + run: | + echo "🐳 Analyse des Dockerfiles..." + # Ne s'execute que si des Dockerfiles existent dans le repo + if [ -n "$(find . -maxdepth 3 -name 'Dockerfile*')" ]; then + podman run --rm -i docker.io/hadolint/hadolint < Dockerfile + else + echo "Aucun Dockerfile détecté, étape ignorée." + fi gitleaks-scan: name: Secret Detection (Gitleaks) runs-on: host + needs: lint-and-format steps: - name: Checkout Code uses: actions/checkout@v4 @@ -35,5 +48,5 @@ jobs: - name: Run Trivy IaC Scan run: | - echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..." + echo "🛡️ Analyse des configurations d'infrastructure..." podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path -- 2.39.5 From af70194f710320964b51e40000f8b57eac965d75 Mon Sep 17 00:00:00 2001 From: Marc Lasserre Date: Fri, 7 Aug 2026 01:38:57 +0200 Subject: [PATCH 3/5] fix(ci): add docker.io registry prefix for yamllint image Explicitly set docker.io domain prefix for yamllint container image to prevent Podman short-name resolution failure. --- .gitea/workflows/test-ci.yml | 36 ++---------------------------------- 1 file changed, 2 insertions(+), 34 deletions(-) diff --git a/.gitea/workflows/test-ci.yml b/.gitea/workflows/test-ci.yml index 7b8dfa4..93da4d9 100644 --- a/.gitea/workflows/test-ci.yml +++ b/.gitea/workflows/test-ci.yml @@ -1,9 +1,4 @@ -name: DevSecOps Pipeline - V1 Infrastructure - -on: [push, pull_request] - -jobs: - lint-and-format: +lint-and-format: name: Code & Config Linting (Yamllint & Hadolint) runs-on: host steps: @@ -13,40 +8,13 @@ jobs: - name: Run Yamllint run: | echo "🧹 Verification de la syntaxe YAML..." - podman run --rm -v "$PWD":/data:z cytopia/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" . + podman run --rm -v "$PWD":/data:z docker.io/cytopia/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" . - name: Run Hadolint (Dockerfiles) run: | echo "🐳 Analyse des Dockerfiles..." - # Ne s'execute que si des Dockerfiles existent dans le repo if [ -n "$(find . -maxdepth 3 -name 'Dockerfile*')" ]; then podman run --rm -i docker.io/hadolint/hadolint < Dockerfile else echo "Aucun Dockerfile détecté, étape ignorée." fi - - gitleaks-scan: - name: Secret Detection (Gitleaks) - runs-on: host - needs: lint-and-format - steps: - - name: Checkout Code - uses: actions/checkout@v4 - - - name: Run Gitleaks via Podman - run: | - echo "🔍 Lancement du scan Gitleaks..." - podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v - - trivy-iac-scan: - name: IaC Security & Vulnerability Scan (Trivy) - runs-on: host - needs: gitleaks-scan - steps: - - name: Checkout Code - uses: actions/checkout@v4 - - - name: Run Trivy IaC Scan - run: | - echo "🛡️ Analyse des configurations d'infrastructure..." - podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path -- 2.39.5 From e561523600f36640b3894f0d3600d5f2014819d4 Mon Sep 17 00:00:00 2001 From: Marc Lasserre Date: Fri, 7 Aug 2026 01:42:00 +0200 Subject: [PATCH 4/5] fix(ci): add docker.io registry prefix for yamllint image Explicitly set docker.io domain prefix for yamllint container image to prevent Podman short-name resolution failure. --- .gitea/workflows/test-ci.yml | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/test-ci.yml b/.gitea/workflows/test-ci.yml index 93da4d9..671052b 100644 --- a/.gitea/workflows/test-ci.yml +++ b/.gitea/workflows/test-ci.yml @@ -1,4 +1,9 @@ -lint-and-format: +name: DevSecOps Pipeline - V1 Infrastructure + +on: [push, pull_request] + +jobs: + lint-and-format: name: Code & Config Linting (Yamllint & Hadolint) runs-on: host steps: @@ -18,3 +23,29 @@ lint-and-format: else echo "Aucun Dockerfile détecté, étape ignorée." fi + + gitleaks-scan: + name: Secret Detection (Gitleaks) + runs-on: host + needs: lint-and-format + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Run Gitleaks via Podman + run: | + echo "🔍 Lancement du scan Gitleaks..." + podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v + + trivy-iac-scan: + name: IaC Security & Vulnerability Scan (Trivy) + runs-on: host + needs: gitleaks-scan + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Run Trivy IaC Scan + run: | + echo "🛡️ Analyse des configurations d'infrastructure..." + podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path -- 2.39.5 From d6459a157fe913fd9bfabd81353e5f4249b63e20 Mon Sep 17 00:00:00 2001 From: Marc Lasserre Date: Sat, 8 Aug 2026 21:58:25 +0200 Subject: [PATCH 5/5] chore(infra): ajout du fichier .gitignore infrastructure --- .gitignore | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/.gitignore b/.gitignore index 4c49bd7..1b5ed6f 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,19 @@ +# Fichiers d'environnement et secrets d'infrastructures .env +.env.local +*.env + +# Volumes de données locaux & Runtime Podman +data/ +volumes/ +*.log + +# Clés et certificats SSL/TLS +*.pem +*.crt +*.key + +# OS & IDE +.DS_Store +.vscode/ +.idea/ -- 2.39.5