GitHub Actions: Orquestrador DevOps Seguro Além de CI/CD

name: Secure DevOps Pipeline
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
jobs:
  generate-sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Generate SBOM with Syft
        uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          output-file: sbom.json
      - name: Upload SBOM
        uses: actions/upload-artifact@v3
        with:
          name: sbom
          path: sbom.json
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Scan for Secrets with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          format: 'table'
          exit-code: '1' # Fail on secrets detection
      - name: Notify Slack on Secrets Found
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          channel-id: 'devops-alerts'
          text: 'Leaked secrets detected in ${{ github.repository }}! Check Trivy scan results.'
  codeql-scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v3
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: javascript
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
      - name: Notify Slack on Vulnerabilities
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
          channel-id: 'devops-alerts'
          text: 'CodeQL vulnerabilities found in ${{ github.repository }}! Review SARIF report.'
  deploy:
    needs: [generate-sbom, secrets-scan, codeql-scan]
    runs-on: ubuntu-latest
    if: success()
    steps:
      - uses: actions/checkout@v3
      - name: Configure AWS Credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1
      - name: Deploy to EKS
        run: |
          kubectl apply -f k8s/deployment.yaml

name: Dependabot Auto-Update
on:
  schedule:
    - cron: '0 0 * * *'
jobs:
  dependabot:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Dependabot
        uses: github/dependabot-action@v3
        with:
          package-ecosystem: npm
          schedule-interval: daily