From f2b50a9361453faf6259bddac2338fc37ee40b77 Mon Sep 17 00:00:00 2001 From: pm Date: Wed, 10 Jun 2026 19:09:06 +0000 Subject: [PATCH] Update .gitea/workflows/deploy.yml --- .gitea/workflows/deploy.yml | 123 +++++++++++++++++++++++++----------- 1 file changed, 86 insertions(+), 37 deletions(-) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index e999ef3..db2de58 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -1,91 +1,140 @@ -name: "DevSecOps Pipeline" +name: "DevSecOps Enterprise Pipeline" + +# ========================================== +# PONTO 4: TRIGGERS (Push vs PR) +# ========================================== on: push: branches: [ main ] + pull_request: + branches: [ main ] jobs: security-gate-and-deploy: runs-on: ubuntu-latest steps: - - name: 0. Checkout Code + - name: Checkout Code uses: actions/checkout@v3 with: fetch-depth: 0 - - name: 1. Build Application Image - run: docker build -f backend/Dockerfile -t apex-solutions:latest . - # ========================================== - # ETAPAS ESTÁTICAS DE SEGURANÇA SEPARADAS + # STAGE 1: STATIC SECURITY TESTING (SAST, SCA) # ========================================== - - name: 2. Secret Scanning (Gitleaks) + - name: Gitleaks Scan run: | curl -sL https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz | tar -xz -C /tmp - /tmp/gitleaks detect --source . --verbose --redact --exit-code 1 || echo "[ALERTA] Credenciais detetadas! Ignorado temporariamente." + /tmp/gitleaks detect --source . --verbose --redact --log-opts="-1" --exit-code 1 - - name: 3. Software Composition Analysis (Trivy) + # PONTO 3: Artefactos do Trivy adicionados + - name: Scan Docker Image Vulnerabilities (Trivy) run: | curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin - trivy image --severity HIGH,CRITICAL apex-solutions:latest || echo "[ALERTA] Vulnerabilidades de infraestrutura encontradas!" + # 1. Guarda o output para um ficheiro de texto para o Artefato + trivy image --severity HIGH,CRITICAL --format table --output trivy-report.txt nginx:alpine + # 2. Corre novamente no terminal para forçar a quebra da pipeline se encontrar falhas (Exit-Code 1) + trivy image --severity HIGH,CRITICAL --exit-code 1 nginx:alpine - - name: 4. Static Application Security Testing (SonarQube) + - name: Archive Trivy Report + if: always() + uses: actions/upload-artifact@v3 + with: + name: trivy-sca-report + path: trivy-report.txt + + - name: SonarQube Analysis run: | curl -sL https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-5.0.1.3006-linux.zip -o sonar-scanner.zip unzip -q sonar-scanner.zip ./sonar-scanner-5.0.1.3006-linux/bin/sonar-scanner \ - -Dsonar.projectKey=apex-solutions \ + -Dsonar.projectKey=website-test \ -Dsonar.sources=. \ -Dsonar.host.url=https://sonar.each-cs.com \ -Dsonar.token=${{ secrets.SONAR_TOKEN }} \ - -Dsonar.qualitygate.wait=true || echo "[ALERTA] SonarQube falhou no Quality Gate." + -Dsonar.qualitygate.wait=true # ========================================== - # ETAPAS DINÂMICAS E DEPLOY + # STAGE 2 & 3: DYNAMIC TESTING (ZAP) # ========================================== - - name: 5. Dynamic Security Scan (OWASP ZAP) + - name: Provision Ephemeral Sandbox run: | - echo ">>> Lançando Sandbox Efêmero..." - docker rm -f apex-sandbox || true - docker run -d --name apex-sandbox apex-solutions:latest + docker rm -f website-test-sandbox || true + docker run -d --name website-test-sandbox nginx:alpine + docker cp index.html website-test-sandbox:/usr/share/nginx/html/index.html sleep 5 - - echo ">>> Executando OWASP ZAP Baseline Scan..." + + - name: OWASP ZAP Baseline Scan + run: | mkdir -p qatests docker rm -f zap-scanner || true docker volume rm zap-reports || true docker volume create zap-reports docker run --user root --name zap-scanner \ - --link apex-sandbox:apex-sandbox \ + --link website-test-sandbox:website-test-sandbox \ -v zap-reports:/zap/wrk/:rw \ -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \ - -t http://apex-sandbox:3000 \ + -t http://website-test-sandbox \ -r report.html \ -I - docker cp zap-scanner:/zap/wrk/report.html qatests/report.html || true - - echo ">>> Destruindo Sandbox..." + docker cp zap-scanner:/zap/wrk/report.html qatests/report.html docker rm -f zap-scanner || true docker volume rm zap-reports || true - docker rm -f apex-sandbox || true - - name: 6. Production Deployment & Local Reports + - name: Teardown Ephemeral Sandbox + if: always() run: | - echo ">>> Atualizando Produção..." - docker rm -f portal-corporativo || true - docker run -d -p 3000:3000 --name portal-corporativo apex-solutions:latest - sleep 3 - curl --silent --show-error --fail http://localhost:3000 || exit 1 - - echo ">>> Publicando Relatório ZAP no servidor Web..." - docker cp qatests/report.html portal-corporativo:/usr/src/app/frontend/zap-report.html || true + docker rm -f website-test-sandbox || true - - name: 7. Archive ZAP Report (Gitea Artifacts) + # ========================================== + # STAGE 4: PRODUCTION DEPLOYMENT (SSH) + # ========================================== + + # PONTO 6: Deploy Seguro Condicional + # Só executa se for um Push (não PR) e se for na branch main + - name: Hardened Production Deployment via SSH + if: github.ref == 'refs/heads/main' && github.event_name == 'push' + uses: appleboy/ssh-action@v1.0.0 + with: + host: ${{ secrets.SSH_HOST }} + username: ${{ secrets.SSH_USER }} + key: ${{ secrets.SSH_PRIVATE_KEY }} + script: | + echo ">>> A iniciar Deploy Seguro no Servidor de Produção..." + + # 1. Navegar para a pasta do projeto (Ajusta o caminho para o teu servidor real) + cd /opt/website-test + + # 2. Puxar as últimas alterações do repositório + git pull origin main + + # 3. Tratamento do ficheiro .ENV dinâmico (Frente 2) + # Isto injeta os Secrets do Gitea num ficheiro .env temporário no servidor + echo "PORT=80" > .env + echo "API_SECRET=${{ secrets.API_SECRET_PROD }}" >> .env + + # 4. Construir e iniciar o contentor de Produção + docker build -t website-test-backend:latest . + docker rm -f website-test-backend || true + docker run -d -p 80:80 --env-file .env --name website-test-backend website-test-backend:latest + + echo ">>> Deploy em Produção concluído com sucesso!" + + # ========================================== + # STAGE 5: ARTIFACT MANAGEMENT & REPORTING + # ========================================== + + - name: Archive ZAP Report (Raw HTML) if: always() uses: actions/upload-artifact@v3 with: name: owasp-zap-report - path: qatests/report.html \ No newline at end of file + path: qatests/report.html + + - name: Pipeline Status Notification + if: always() + run: | + echo "Pipeline finished with status: ${{ job.status }}" \ No newline at end of file