devsecops.yml

name: Automatisation des tests DevSecOps
on: push

jobs:
  Dependances:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout du code
        uses: actions/checkout@v4

      - name: Installation de Safety
        run: pip install safety

      - name: Contrôle des dépendances et génération du rapport
        run: |
          safety check -r requirements.txt --continue-on-error > safety-report.txt
          cat safety-report.txt

      - name: Sauvegarder le rapport Safety (Artefact)
        uses: actions/upload-artifact@v4
        with:
          name: rapport-safety
          path: safety-report.txt

  Dockerfile:
    runs-on: ubuntu-latest
    needs: Dependances
    steps:
      - name: Checkout du code
        uses: actions/checkout@v4

      - name: Scan du Dockerfile avec Trivy
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          hide-progress: false
          format: 'table'
          output: 'trivy-report.txt'  
          exit-code: '1'

      - name: Afficher le rapport dans les logs
        if: always() 
        run: cat trivy-report.txt

      - name: Sauvegarder le rapport Trivy (Artefact)
        if: always() 
        uses: actions/upload-artifact@v4
        with:
          name: rapport-trivy
          path: trivy-report.txt

  Deploy:
    runs-on: ubuntu-latest
    needs: Dockerfile
    steps:
      - name: Deploy
        run: echo "Rien à faire ici. Votre application est prête à être déployée"