40 lines
1.0 KiB
YAML
40 lines
1.0 KiB
YAML
name: DevSecOps Pipeline - V1 Infrastructure
|
|
|
|
on: [push]
|
|
|
|
jobs:
|
|
health-check:
|
|
name: System & Environment Check
|
|
runs-on: host
|
|
steps:
|
|
- name: System Check
|
|
run: |
|
|
echo "Pipeline CI/CD opérationnel sur le VPS RYM !"
|
|
uname -a
|
|
podman --version
|
|
|
|
gitleaks-scan:
|
|
name: Secret Detection (Gitleaks)
|
|
runs-on: host
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run Gitleaks via Podman
|
|
run: |
|
|
echo "🔍 Lancement du scan Gitleaks..."
|
|
podman run --rm -v "$PWD":/path:z docker.io/zricethezav/gitleaks:v8.18.2 detect --source="/path" -v
|
|
|
|
trivy-iac-scan:
|
|
name: IaC Security & Vulnerability Scan (Trivy)
|
|
runs-on: host
|
|
needs: gitleaks-scan
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run Trivy IaC Scan
|
|
run: |
|
|
echo "🛡️ Analyse des fichiers d'infrastructure et des vulnérabilités..."
|
|
podman run --rm -v "$PWD":/path:z aquasec/trivy:latest config /path
|