52 lines
1.6 KiB
YAML
52 lines
1.6 KiB
YAML
name: DevSecOps Pipeline - V1 Infrastructure
|
|
|
|
on: [push, pull_request]
|
|
|
|
jobs:
|
|
lint-and-format:
|
|
name: Code & Config Linting (Yamllint & Hadolint)
|
|
runs-on: host
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run Yamllint
|
|
run: |
|
|
echo "🧹 Verification de la syntaxe YAML..."
|
|
podman run --rm -v "$PWD":/data:z docker.io/cytopia/yamllint -d "{extends: relaxed, rules: {line-length: disable}}" .
|
|
|
|
- name: Run Hadolint (Dockerfiles)
|
|
run: |
|
|
echo "🐳 Analyse des Dockerfiles..."
|
|
if [ -n "$(find . -maxdepth 3 -name 'Dockerfile*')" ]; then
|
|
podman run --rm -i docker.io/hadolint/hadolint < Dockerfile
|
|
else
|
|
echo "Aucun Dockerfile détecté, étape ignorée."
|
|
fi
|
|
|
|
gitleaks-scan:
|
|
name: Secret Detection (Gitleaks)
|
|
runs-on: host
|
|
needs: lint-and-format
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run Gitleaks via Podman
|
|
run: |
|
|
echo "🔍 Lancement du scan Gitleaks..."
|
|
podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v
|
|
|
|
trivy-iac-scan:
|
|
name: IaC Security & Vulnerability Scan (Trivy)
|
|
runs-on: host
|
|
needs: gitleaks-scan
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run Trivy IaC Scan
|
|
run: |
|
|
echo "🛡️ Analyse des configurations d'infrastructure..."
|
|
podman run --rm -v "$PWD":/path:z docker.io/aquasec/trivy:0.49.1 config /path
|