diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 44b8e71..44a512c 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -17,18 +17,11 @@ jobs: - name: 1. Build Application Image run: docker build -f backend/Dockerfile -t apex-solutions:latest . - - name: 1.5. Execute Unit Tests (Business Logic) + - name: 1.5. Execute Unit Tests run: | - echo ">>> Syncing dependencies and executing test suite..." - # O 'npm install' vai atualizar automaticamente o package-lock.json - # caso exista alguma divergĂȘncia com o package.json npm install npm test - # ========================================== - # STATIC SECURITY ANALYSIS STAGES - # ========================================== - - name: 2. Secret Scanning (Gitleaks) run: | curl -sL https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz | tar -xz -C /tmp @@ -52,24 +45,15 @@ jobs: -Dsonar.qualitygate.wait=true \ -Dsonar.javascript.lcov.reportPaths=coverage/lcov.info - # ========================================== - # DYNAMIC SECURITY ANALYSIS & DEPLOYMENT - # ========================================== - - name: 5. Dynamic Security Scan (OWASP ZAP) if: github.event_name == 'push' run: | - echo ">>> Creating isolated network for DAST..." + docker network rm zap-net || true docker network create zap-net - - echo ">>> Provisioning ephemeral sandbox environment..." + docker rm -f apex-sandbox || true docker run -d --name apex-sandbox --network zap-net apex-solutions:latest sleep 10 - - echo ">>> Initiating OWASP ZAP Baseline Scan..." mkdir -p qatests - - # O truque aqui Ă© mapear a pasta atual (.) para /zap/wrk/ docker run --user root --name zap-scanner \ --network zap-net \ -v ${{ github.workspace }}:/zap/wrk/:rw \ @@ -77,33 +61,19 @@ jobs: -t http://apex-sandbox:3000 \ -r report.html \ -I -c zap-baseline.conf - docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true - - echo ">>> Decommissioning ephemeral sandbox and network..." docker rm -f zap-scanner apex-sandbox || true docker network rm zap-net || true - - name: 6. Production Deployment & Local Reports + - name: 6. Production Deployment if: github.event_name == 'push' run: | - echo ">>> Deploying application to production environment..." docker rm -f portal-corporativo || true docker run -d -p 3000:3000 --name portal-corporativo apex-solutions:latest - - echo ">>> Awaiting Node.js service initialization..." sleep 5 - - echo ">>> Container logs (for diagnostic purposes):" - docker logs portal-corporativo - - echo ">>> Performing internal health check (via wget)..." - docker exec portal-corporativo wget --spider -S http://localhost:3000 - - echo ">>> Publishing OWASP ZAP security report to web server..." docker cp qatests/report.html portal-corporativo:/usr/src/app/frontend/zap-report.html || true - - name: 7. Archive ZAP Report (Gitea Artifacts) + - name: 7. Archive ZAP Report if: always() && github.event_name == 'push' uses: actions/upload-artifact@v3 with: