name: DevSecOps Pipeline - V1 Infrastructure

on: [push, pull_request]

jobs:
  lint-and-format:
    name: Code & Config Linting (Yamllint & Hadolint)
    runs-on: host
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Run Yamllint
        run: |
          echo "🧹 Verification de la syntaxe YAML..."
          podman run --rm -v "$PWD":/data:z cytopia/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" .

      - name: Run Hadolint (Dockerfiles)
        run: |
          echo "🐳 Analyse des Dockerfiles..."
          # Ne s'execute que si des Dockerfiles existent dans le repo
          if [ -n "$(find . -maxdepth 3 -name 'Dockerfile*')" ]; then
            podman run --rm -i docker.io/hadolint/hadolint < Dockerfile
          else
            echo "Aucun Dockerfile détecté, étape ignorée."
          fi

  gitleaks-scan:
    name: Secret Detection (Gitleaks)
    runs-on: host
    needs: lint-and-format
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Run Gitleaks via Podman
        run: |
          echo "🔍 Lancement du scan Gitleaks..."
          podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v

  trivy-iac-scan:
    name: IaC Security & Vulnerability Scan (Trivy)
    runs-on: host
    needs: gitleaks-scan
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Run Trivy IaC Scan
        run: |
          echo "🛡️ Analyse des configurations d'infrastructure..."
          podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path