#!/bin/sh
echo "Running secret scan..."
git secrets --scan
if [ $? -ne 0 ]; then
  echo "Secret scan failed. Please remove sensitive information."
  exit 1
fi

name: Build and Scan Image
on:
  push:
    branches:
      - main
jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Build Docker image
        run: docker build -t my-app:${{ github.sha }} .
      - name: Scan image with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: my-app:${{ github.sha }}
          format: 'table'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: disallow-privileged-containers
spec:
  validationFailureAction: Enforce
  rules:
    - name: privileged-containers
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
        pattern:
          spec:
            containers:
              - securityContext:
                  privileged: "false"