Arquitetura de Segurança e DevSecOps

# GitHub Actions security workflow
name: Security Scan
on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # Secrets detection
      - name: Detect secrets
        uses: trufflesecurity/trufflehog@main
      
      # Dependency scanning
      - name: Dependency check
        run: npm audit --audit-level=high
      
      # Container scanning
      - name: Scan container image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:latest'
          severity: 'CRITICAL,HIGH'
      
      # SAST
      - name: Static analysis
        uses: github/codeql-action/analyze@v2