From 4c5973f8e8633011244654e7e50c61a8c10e7882 Mon Sep 17 00:00:00 2001
From: pedro <pedro.maio@each-cs.com>
Date: Mon, 8 Jun 2026 17:19:34 +0100
Subject: [PATCH] adicionar pipeline devsecops

---
 .gitea/workflows/deploy.yml | 128 ++++++++++++++++++++++++++++++++++++
 1 file changed, 128 insertions(+)
 create mode 100644 .gitea/workflows/deploy.yml

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
new file mode 100644
index 0000000..07dedfe
--- /dev/null
+++ b/.gitea/workflows/deploy.yml
@@ -0,0 +1,128 @@
+name: "DevSecOps Enterprise Pipeline"
+on:
+  push:
+    branches: [ main ]
+
+jobs:
+  security-gate-and-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      # ==========================================
+      # STAGE 0: BUILD DA IMAGEM DOCKER
+      # ==========================================
+      - name: Build Docker Image
+        run: |
+          docker build -f backend/Dockerfile -t apex-solutions:latest .
+
+      # ==========================================
+      # STAGE 1: STATIC SECURITY TESTING (SAST, SCA, SECRETS)
+      # ==========================================
+
+      # 1.1. Secret Scanning: Deteta as credenciais de email no server.js
+      - name: Gitleaks Scan
+        # O true permite que a pipeline continue mesmo após detetar a vulnerabilidade (para poderes ver o ZAP a funcionar também)
+        continue-on-error: true 
+        run: |
+          curl -sL https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz | tar -xz -C /tmp
+          /tmp/gitleaks detect --source . --verbose --redact --log-opts="-1" --exit-code 1
+
+      # 1.2. Software Composition Analysis (SCA): Analisa a NOSSA imagem
+      - name: Scan Docker Image Vulnerabilities (Trivy)
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+          trivy image --severity HIGH,CRITICAL apex-solutions:latest
+
+      # 1.3. Static Application Security Testing (SAST)
+      - name: SonarQube Analysis
+        continue-on-error: true
+        run: |
+          curl -sL https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-5.0.1.3006-linux.zip -o sonar-scanner.zip
+          unzip -q sonar-scanner.zip
+          ./sonar-scanner-5.0.1.3006-linux/bin/sonar-scanner \
+            -Dsonar.projectKey=apex-solutions \
+            -Dsonar.sources=. \
+            -Dsonar.host.url=https://sonar.each-cs.com \
+            -Dsonar.token=${{ secrets.SONAR_TOKEN }} \
+            -Dsonar.qualitygate.wait=true
+
+      # ==========================================
+      # STAGE 2: DYNAMIC TEST ENVIRONMENT (SANDBOX)
+      # ==========================================
+
+      - name: Provision Ephemeral Sandbox
+        run: |
+          docker rm -f apex-sandbox || true
+          # Lança a imagem que acabámos de construir e testar
+          docker run -d --name apex-sandbox apex-solutions:latest
+          sleep 5
+
+      # ==========================================
+      # STAGE 3: DYNAMIC APPLICATION SECURITY TESTING (DAST)
+      # ==========================================
+
+      - name: OWASP ZAP Baseline Scan
+        run: |
+          mkdir -p qatests
+          docker rm -f zap-scanner || true
+          docker volume rm zap-reports || true
+          docker volume create zap-reports
+          
+          # Ataca a porta 3000 do nosso backend Node.js
+          docker run --user root --name zap-scanner \
+            --link apex-sandbox:apex-sandbox \
+            -v zap-reports:/zap/wrk/:rw \
+            -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
+            -t http://apex-sandbox:3000 \
+            -r report.html 
+          
+          docker cp zap-scanner:/zap/wrk/report.html qatests/report.html
+          docker rm -f zap-scanner || true
+          docker volume rm zap-reports || true
+
+      - name: Teardown Ephemeral Sandbox
+        if: always()
+        run: |
+          docker rm -f apex-sandbox || true
+
+      # ==========================================
+      # STAGE 4: PRODUCTION DEPLOYMENT
+      # ==========================================
+
+      - name: Hardened Production Deployment
+        run: |
+          # Remove o contentor de produção antigo
+          docker rm -f portal-corporativo || true
+          
+          # Lança o novo contentor expondo para a porta 3000 do teu servidor
+          docker run -d -p 3000:3000 --name portal-corporativo apex-solutions:latest
+          
+          # Healthcheck para garantir que o Node.js está a responder
+          sleep 3
+          curl --silent --show-error --fail http://localhost:3000 || exit 1
+
+      # ==========================================
+      # STAGE 5: ARTIFACT MANAGEMENT & REPORTING
+      # ==========================================
+      
+      - name: Publish ZAP Report to Production Web Server
+        if: always()
+        run: |
+          # Coloca o relatório ZAP na pasta pública frontend do Node.js
+          docker cp qatests/report.html portal-corporativo:/usr/src/app/frontend/zap-report.html || true
+
+      - name: Archive ZAP Report (Raw HTML)
+        if: always()
+        uses: actions/upload-artifact@v3
+        with:
+          name: owasp-zap-report
+          path: qatests/report.html
+
+      - name: Pipeline Status Notification
+        if: always()
+        run: |
+          echo "Pipeline finished with status: ${{ job.status }}"
\ No newline at end of file