CI security gates

French version: ../ci-security-gates.md.

The same gates exist in .forgejo/workflows/ci.yml and .gitlab-ci.yml. High and critical findings fail the pipeline; the build job depends on every security job.

Job (Forgejo / GitLab)	Tool	Scope	Failure condition
security-sast / bandit	Bandit 1.8	services/control-plane/src, sdks/python/src	high severity, medium confidence or more
security-semgrep / semgrep	Semgrep, rules p/owasp-top-ten, p/python, p/typescript	whole repository except subcharts	ERROR severity
security-deps-python / pip-audit	pip-audit 2.7	backend and Python SDK	any known vulnerability
security-deps-node / npm-audit	npm audit --audit-level=high	portal, sdks/typescript	high or critical
security-secrets / gitleaks	Gitleaks 8.21	git history and working tree	any detected secret
security-fs / trivy-fs, trivy-config	Trivy 0.58 (fs and config deploy/)	dependencies, secrets, IaC	high or critical
build (step trivy image scan) / trivy-image	Trivy 0.58 (image, exceptions in .trivyignore, one per line with justification, owner and review date)	vulnerabilities of published images	high or critical
build (step cosign sign and attest) / sbom-sign	cosign with the COSIGN_PRIVATE_KEY key, no Rekor log; publishing fails without the key because Kyverno (eai-verify-image-signatures) only accepts that key for harbor.*/eai/*	signature and SPDX and CycloneDX attestations	missing key
security-manifests / manifests	kubeconform (strict, datree CRD catalog), Kyverno CLI, pytest	chart rendered with the three values files	invalid schema, admission refusal, security invariant
security-dast / zap-baseline	OWASP ZAP baseline 2.15	portal and API of the compose stack	FAIL rule of deploy/ci/zap-baseline.conf

Notes

• ZAP runs with -I: warnings are reported, only rules marked FAIL break the build (cookies without HttpOnly or SameSite, clickjacking, X-Content-Type-Options, X-Powered-By leak, CORS misconfiguration, error disclosure). HSTS and Secure cookies are ignored on the plain HTTP compose stack and checked at the TLS edge.
• A Bandit exception is justified in code (# nosec Bxxx with the reason), a Semgrep exception with # nosemgrep: <rule>; a dependency vulnerability without a fix is ignored with an explicit id (pip-audit --ignore-vuln, .trivyignore) and a review date.
• Offline reproduction: helm lint, helm template, kubeconform, kyverno test deploy/policies/kyverno/tests, opa test deploy/policies/opa -v, terraform fmt -check -recursive deploy/terraform, pytest services/control-plane/tests -k platform.