stages: [pruefen, testen, bauen, scannen, ausrollen]

# ---------- schnelle Prüfungen ----------
geheimnisse:
  stage: pruefen
  image: zricethezav/gitleaks:latest
  script:
    - gitleaks detect --source . --redact --verbose

sast:
  stage: pruefen
  image: python:3.12-slim
  script:
    - pip install --quiet bandit
    - bandit -r src/ -f json -o bandit.json || true
    - bandit -r src/ -ll          # blockiert ab Schweregrad "medium"
  artifacts:
    paths: [bandit.json]
    when: always

iac-scan:
  stage: pruefen
  image: bridgecrew/checkov:latest
  script:
    - checkov -d ansible/ --compact --quiet
    - checkov -f Containerfile --framework dockerfile

# ---------- Abhängigkeiten ----------
sca:
  stage: testen
  image: python:3.12-slim
  script:
    - pip install --quiet pip-audit
    - pip-audit -r requirements.txt --strict

# ---------- Stückliste und Signatur ----------
sbom:
  stage: bauen
  image: anchore/syft:latest
  script:
    - syft "$IMAGE:$TAG" -o cyclonedx-json > sbom.json
  artifacts:
    paths: [sbom.json]
    expire_in: 1 year          # für die Nachweisführung aufbewahren

signieren:
  stage: bauen
  image: gcr.io/projectsigstore/cosign:latest
  script:
    - echo "$COSIGN_KEY" > /tmp/cosign.key
    - cosign sign --key /tmp/cosign.key "$IMAGE:$TAG"
  after_script:
    - shred -u /tmp/cosign.key

# ---------- Container prüfen ----------
container-scan:
  stage: scannen
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 0 --severity LOW,MEDIUM "$IMAGE:$TAG"
    - trivy image --exit-code 1 --severity HIGH,CRITICAL "$IMAGE:$TAG"