Merge pull request 'feat: Add security scanning pipeline (Phase 8.0)' (#67) from feature/security-scanning into main

.gitea/workflows/pr-checks.yaml

@@ -7,13 +7,20 @@ on:
 
 jobs:
   tofu-checks:
+    name: OpenTofu Validate & Policy
     runs-on: ubuntu-latest
-    container:
-      image: ghcr.io/opentofu/opentofu:1.11
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Install OpenTofu
+        run: |
+          wget -q https://github.com/opentofu/opentofu/releases/download/v1.11.0/tofu_1.11.0_linux_amd64.tar.gz
+          tar xzf tofu_1.11.0_linux_amd64.tar.gz tofu
+          mv tofu /usr/local/bin/
+          rm tofu_1.11.0_linux_amd64.tar.gz
+          tofu --version
+
       - name: Install conftest
         run: |
           wget -q https://github.com/open-policy-agent/conftest/releases/download/v0.66.0/conftest_0.66.0_Linux_x86_64.tar.gz
@@ -40,7 +47,6 @@ jobs:
       - name: Conftest Policy Test
         run: |
           cd environments/production
-          # Generate plan for policy testing (no backend, partial plan)
           tofu plan -out=tfplan.binary 2>/dev/null || true
           if [ -f tfplan.binary ]; then
             tofu show -json tfplan.binary > tfplan.json

.gitea/workflows/security-scan.yaml

@@ -0,0 +1,49 @@
+name: Security Scan
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  security-scan:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install gitleaks
+        run: |
+          wget -q https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz
+          tar xzf gitleaks_8.30.0_linux_x64.tar.gz gitleaks
+          mv gitleaks /usr/local/bin/
+          rm gitleaks_8.30.0_linux_x64.tar.gz
+
+      - name: Secret Detection (gitleaks)
+        run: |
+          echo "=== Secret Detection ==="
+          gitleaks detect --source . --verbose --no-git 2>&1 || {
+            echo "::error::Gitleaks found potential secrets in the codebase!"
+            exit 1
+          }
+
+      - name: Install Trivy
+        run: |
+          wget -q https://github.com/aquasecurity/trivy/releases/download/v0.69.1/trivy_0.69.1_Linux-64bit.tar.gz
+          tar xzf trivy_0.69.1_Linux-64bit.tar.gz trivy
+          mv trivy /usr/local/bin/
+          rm trivy_0.69.1_Linux-64bit.tar.gz
+
+      - name: Trivy IaC Scan
+        run: |
+          echo "=== Trivy IaC Security Scan ==="
+          trivy config . \
+            --severity HIGH,CRITICAL \
+            --exit-code 0 \
+            --format table 2>&1
+          echo "Trivy IaC scan complete (advisory mode)"
+          echo ""
+          echo "Note: Checkov IaC scanning runs during Atlantis plan (integrated in Atlantis Dockerfile)"

.gitleaks.toml

@@ -0,0 +1,10 @@
+# Gitleaks configuration for infrastructure repo
+# Allowlists for known patterns that are not actual leaked secrets
+
+[allowlist]
+  description = "Infrastructure repo allowlist"
+  # Terraform tenant VM passwords are managed by VM Bot and encrypted at rest via SOPS
+  # The .tf files contain passwords needed for Proxmox VM provisioning
+  paths = [
+    '''environments/production/tenant-vms\.tf''',
+  ]

atlantis.yaml

@@ -5,7 +5,7 @@ projects:
   - name: production
     dir: environments/production
     workspace: default
-    workflow: proxmox
+    workflow: proxmox-secure
     autoplan:
       when_modified:
         - "**/*.tf"
@@ -17,7 +17,7 @@ projects:
       - approved
 
 workflows:
-  proxmox:
+  proxmox-secure:
     plan:
       steps:
         - env:
@@ -25,6 +25,15 @@ workflows:
             command: "sops -d --extract '[\"proxmox_api_token\"]' proxmox.secrets.yaml"
         - init
         - plan
+        - run: |
+            echo "=== Checkov IaC Security Scan ==="
+            tofu show -json $PLANFILE > /tmp/plan.json 2>/dev/null || true
+            if [ -f /tmp/plan.json ]; then
+              checkov -f /tmp/plan.json --framework terraform_plan --soft-fail --compact --quiet 2>&1 || true
+              rm -f /tmp/plan.json
+            else
+              echo "No plan JSON available, skipping checkov scan"
+            fi
     apply:
       steps:
         - env: