pm/website-test
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ci: versao final e segura do projeto para producao

Browse Source
This commit is contained in:
pedro
2026-05-08 11:17:15 +01:00
parent e6d45ceb68
commit 19cd6ed956
4 changed files with 60 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy.yaml
+56 -12
View File
@@ -1,19 +1,63 @@
name: Deploy do Site name: "DevSecOps Enterprise Pipeline"
on: [push] on:
push:
branches: [ main ]
jobs: jobs:
deploy: security-gate:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: Checkout do código - name: Checkout Code
uses: actions/checkout@v3
with:
fetch-depth: 0
<<<<<<< HEAD
# 1. SCA - Verifica vulnerabilidades no Nginx
=======
# 1. SECRET SCANNING (Desativado temporariamente)
- name: Gitleaks Scan
run: |
curl -sL https://github.com/gitleaks/gitleaks/releases/download/v8.18.2/gitleaks_8.18.2_linux_x64.tar.gz | tar -xz -C /tmp
/tmp/gitleaks detect --source . --verbose --redact --exit-code 1
# 2. SCA - Verifica vulnerabilidades no Nginx
>>>>>>> 8c9be4c (ativar gitleaks)
- name: Scan Docker Image Vulnerabilities (Trivy)
run: |
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
trivy image --severity HIGH,CRITICAL nginx:alpine
# 2. SAST - Análise de Código com SonarQube
- name: SonarQube Analysis
run: |
curl -sL https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-5.0.1.3006-linux.zip -o sonar-scanner.zip
unzip -q sonar-scanner.zip
./sonar-scanner-5.0.1.3006-linux/bin/sonar-scanner \
-Dsonar.projectKey=website-test \
-Dsonar.sources=. \
-Dsonar.host.url=http://51.89.40.2:9000 \
-Dsonar.token=${{ secrets.SONAR_TOKEN }}
deploy:
needs: security-gate
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v3 uses: actions/checkout@v3
- name: Copiar e Corrigir Permissões # 3. DEPLOY ATÓMICO E HARDENING
- name: Hardened Deploy
run: | run: |
# 1. Limpa os ficheiros antigos docker exec website-test-backend tar -czf /tmp/index_backup.tar.gz -C /usr/share/nginx/html index.html || true
docker exec website-test-backend rm -rf /usr/share/nginx/html/* docker exec website-test-backend sh -c "rm -rf /usr/share/nginx/html/*"
docker cp index.html website-test-backend:/usr/share/nginx/html/index.html
docker exec website-test-backend chown root:root /usr/share/nginx/html/index.html
docker exec website-test-backend chmod 444 /usr/share/nginx/html/index.html
curl --silent --show-error --fail http://localhost:80 || exit 1
# 2. Copia os novos ficheiros # 4. AUDITORIA DE DEPLOY
docker cp . website-test-backend:/usr/share/nginx/html/ - name: Slack/Discord Notification
if: always()
# 3. FIX: Garante permissões de leitura para o Nginx (o "porteiro") run: |
docker exec website-test-backend chmod -R 755 /usr/share/nginx/html/ echo "Deploy finalizado com status: ${{ job.status }}"
forcar_trigger.txt
+1
View File
@@ -0,0 +1 @@
"atualizacao-pipelines"
index.html
+1
View File
@@ -7,6 +7,7 @@
<script src="https://cdn.tailwindcss.com"></script> <script src="https://cdn.tailwindcss.com"></script>
</head> </head>
<body class="bg-gray-50 text-gray-900 font-sans"> <body class="bg-gray-50 text-gray-900 font-sans">
<!-- TODO: Remover esta chave de teste antes de ir para produção -->
<nav class="sticky top-0 bg-white/90 backdrop-blur-sm z-50 border-b border-gray-100 py-4 px-6 flex justify-between items-center"> <nav class="sticky top-0 bg-white/90 backdrop-blur-sm z-50 border-b border-gray-100 py-4 px-6 flex justify-between items-center">
<div class="text-2xl font-black text-blue-700 tracking-tighter">NEXUS<span class="text-gray-400">.</span></div> <div class="text-2xl font-black text-blue-700 tracking-tighter">NEXUS<span class="text-gray-400">.</span></div>
trigger.txt
+1
View File
@@ -0,0 +1 @@
"teste"