feat(security): integrate Gitleaks, Helm rendering, and Trivy image s…

.github/workflows/security.yml

@@ -4,30 +4,62 @@ name: Platform Security
 on:
   pull_request:
     branches: [main]
-
   push:
     branches: [main]
 
 permissions:
   contents: read
 
 jobs:
-  security:
+  security-scan:
     name: Security Scan
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required for Gitleaks to scan history
+
+      - name: Setup Helm
+        uses: ./.github/actions/setup-helm
 
-      - name: Scan Platform Configuration
+      - name: Run Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Scan IaC Configurations (Trivy)
         uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: config
           scan-ref: platform
           severity: HIGH,CRITICAL
           exit-code: "1"
 
+      - name: Render Helm Chart
+        uses: ./.github/actions/helm-render
+
+      - name: Scan Container Images (Trivy)
+        shell: bash
+        run: |
+          # Extract unique images from the rendered YAML
+          grep -oP 'image:\s*["'\'']?\K[^\s"'\''@]+' rendered.yaml | sort -u > images.txt
+          echo "Images found for scanning:"
+          cat images.txt
+
+          # Install Trivy CLI locally for dynamic scanning
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
+          # Scan each image. We use exit-code 0 to avoid blocking on third-party vulnerabilities,
+          # but we will log them all to the job output.
+          while read -r image; do
+            echo "=================================================="
+            echo "Scanning image: $image"
+            echo "=================================================="
+            trivy image --severity HIGH,CRITICAL --format table --exit-code 0 "$image"
+          done < images.txt
+
       - name: Generate SBOM
         uses: anchore/sbom-action@v0
         with:

docs/adr/0003-security-scanning-strategy.md

@@ -0,0 +1,33 @@
+# 3. Security Scanning Strategy
+
+Date: 2026-07-16
+
+## Status
+
+Accepted
+
+## Context
+
+A secure platform requires continuous security feedback. Since this is an infrastructure repository (`shop-devops`), we do not compile application binaries. However, we do store infrastructure-as-code (IaC) configurations, deployment manifests, and scripts. We need a strategy to automatically detect:
+1.  Secrets or credentials accidentally committed to the git history.
+2.  Misconfigurations in our Kubernetes manifests and Helm values.
+3.  Vulnerabilities in the third-party container images we deploy.
+4.  Generate a Software Bill of Materials (SBOM) to document our software supply chain.
+
+## Decision
+
+We will implement a multi-layered security checking workflow (`security.yml`) triggered on every pull request and push to the main branch:
+
+1.  **Secret Detection:** We will use **Gitleaks** via its official GitHub Action. Gitleaks is chosen for its speed and accuracy in scanning git history and commits for secrets.
+2.  **Configuration Scan:** We will use **Trivy** to scan our `platform` directory. Trivy scans Kubernetes manifests, Helm values, and Dockerfiles for security risks (e.g., containers running as root, privileged mode, etc.).
+3.  **Vulnerability Scan:** We will parse the container images referenced in our deployment and run Trivy image scans on them. To avoid blocking our CI pipeline on third-party vulnerabilities we cannot fix, we will log findings for all images (setting exit-code to `0`) but keep visibility high.
+4.  **Software Bill of Materials (SBOM):** We will use the **Anchore SBOM Action** (powered by Syft) to generate an SBOM artifact for our repository, adhering to security compliance standards.
+
+## Consequences
+
+*   **Positive:** Prevents leaks of API keys, database credentials, and other secrets.
+*   **Positive:** Identifies risky Kubernetes configurations before they hit a cluster.
+*   **Positive:** Validates the security posture of third-party images we deploy and registers vulnerabilities for monitoring.
+*   **Negative:** Adds execution time to the CI workflow.
+*   **Negative:** Gitleaks scans can sometimes flag false positives (e.g., test keys), which will require maintaining a `.gitleaksignore` file.
+*   **Neutral:** Because we do not fail the build on third-party CVEs (exit-code 0), we must rely on manual reviews of the security logs to upgrade the Helm chart when critical patches are released.