Complete DevSecOps workflow with Trivy security scanning

.github/workflows/devsecops.yml

@@ -4,16 +4,32 @@ jobs:
   Dependances:
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
       - name: Dependances
-        run: |
-          docker run --rm -v "$PWD":/project -v $HOME/.cache/trivy:/root/.cache/ aquasec/trivy:latest fs ./requirements.txt
+        uses: aquasecurity/trivy-action@0.33.1
+        with:
+          scan-type: 'fs'
+          scan-ref: 'requirements.txt'
+          severity: 'HIGH,CRITICAL'
+          format: 'table'
+          exit-code: '1'
   Dockerfile:
     runs-on: ubuntu-latest
     needs: Dependances
     steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Build Docker image
+        run: docker build -t imgvulne:1.1 .
       - name: Test Dockerfile
-        run: |
-          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v "$HOME/.cache/trivy":/root/.cache/ aquasec/trivy:latest image --format json --severity HIGH,CRITICAL imgvulne:1.1 | jq -r '["TARGET","PACKAGE","INSTALLED","VULN","SEVERITY"], (.Results[]? as $r | $r.Vulnerabilities[]? | [$r.Target, .PkgName, .InstalledVersion, .VulnerabilityID, .Severity]) | @tsv'| column -t -s $'\t'
+        uses: aquasecurity/trivy-action@0.33.1
+        with:
+          scan-type: 'image'
+          image-ref: 'imgvulne:1.1'
+          severity: 'HIGH,CRITICAL'
+          format: 'table'
+          exit-code: '1'
   Deploy:
     runs-on: ubuntu-latest
     needs: Dockerfile

Dockerfile

@@ -0,0 +1,21 @@
+FROM python:3.9-slim
+
+WORKDIR /app
+
+# Copier le fichier requirements.txt
+COPY requirements.txt .
+
+# Installer les dépendances
+RUN pip install --no-cache-dir -r requirements.txt
+
+# Copier le reste de l'application
+COPY . .
+
+# Exposer le port Flask
+EXPOSE 5000
+
+# Variable d'environnement pour Flask
+ENV FLASK_APP=app.py
+
+# Commande de démarrage
+CMD ["flask", "run", "--host=0.0.0.0"]