# GitLab CI 安全扫描
security_scan:
  stage: security
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:latest
  allow_failure: true
  only:
    - main

dependency_scanning:
  stage: security
  image: aquasec/trivy:latest
  script:
    - trivy fs --exit-code 1 --severity HIGH,CRITICAL .
  allow_failure: true

secret_detection:
  stage: security
  script:
    - truffleHog --json --repo_url https://github.com/org/repo .
  allow_failure: true

# Kubernetes Secret 外部化
apiVersion: kubernetes-client.io/v1
kind: ExternalSecret
metadata:
  name: app-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: app-secrets
  data:
    - secretKey: DATABASE_PASSWORD
      remoteRef:
        key: production/myapp/database
        property: password