diff --git a/.github/workflows/devsecops.yml b/.github/workflows/devsecops.yml index cb619677..77cc48a9 100644 --- a/.github/workflows/devsecops.yml +++ b/.github/workflows/devsecops.yml @@ -4,16 +4,32 @@ jobs: Dependances: runs-on: ubuntu-latest steps: + - name: Checkout code + uses: actions/checkout@v4 - name: Dependances - run: | - docker run --rm -v "$PWD":/project -v $HOME/.cache/trivy:/root/.cache/ aquasec/trivy:latest fs ./requirements.txt + uses: aquasecurity/trivy-action@0.33.1 + with: + scan-type: 'fs' + scan-ref: 'requirements.txt' + severity: 'HIGH,CRITICAL' + format: 'table' + exit-code: '1' Dockerfile: runs-on: ubuntu-latest needs: Dependances steps: + - name: Checkout code + uses: actions/checkout@v4 + - name: Build Docker image + run: docker build -t imgvulne:1.1 . - name: Test Dockerfile - run: | - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$HOME/.cache/trivy":/root/.cache/ aquasec/trivy:latest image --format json --severity HIGH,CRITICAL imgvulne:1.1 | jq -r '["TARGET","PACKAGE","INSTALLED","VULN","SEVERITY"], (.Results[]? as $r | $r.Vulnerabilities[]? | [$r.Target, .PkgName, .InstalledVersion, .VulnerabilityID, .Severity]) | @tsv'| column -t -s $'\t' + uses: aquasecurity/trivy-action@0.33.1 + with: + scan-type: 'image' + image-ref: 'imgvulne:1.1' + severity: 'HIGH,CRITICAL' + format: 'table' + exit-code: '1' Deploy: runs-on: ubuntu-latest needs: Dockerfile diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 00000000..556d1529 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,21 @@ +FROM python:3.9-slim + +WORKDIR /app + +# Copier le fichier requirements.txt +COPY requirements.txt . + +# Installer les dépendances +RUN pip install --no-cache-dir -r requirements.txt + +# Copier le reste de l'application +COPY . . + +# Exposer le port Flask +EXPOSE 5000 + +# Variable d'environnement pour Flask +ENV FLASK_APP=app.py + +# Commande de démarrage +CMD ["flask", "run", "--host=0.0.0.0"]