ansible-playbook -i "localhost," -c local --ask-become-pass check_cve_2026_31431.yml -v

./run_revert.sh
# Sélectionner 'l' pour local

ansible-playbook -i "localhost," -c local --ask-become-pass revert_cve_2026_31431.yml -v

ansible-playbook -i "192.168.1.100," -u ubuntu --ask-become-pass check_cve_2026_31431.yml -v

[servers]
192.168.1.100
192.168.1.101

ansible-playbook -i hosts.ini --ask-become-pass check_cve_2026_31431.yml -v

./run_revert.sh
# Sélectionner 'l' pour local

docker run -it --privileged ubuntu:22.04 /bin/bash
# Dans le conteneur :
apt update && apt install -y ansible python3
# Copier le playbook dans le conteneur ou utiliser curl/wget
ansible-playbook -i "localhost," -c local check_cve_2026_31431.yml -v

docker run -it --privileged -v $(pwd)/check_cve_2026_31431.yml:/check.yml ubuntu:22.04
# Dans le conteneur : ansible-playbook -i "localhost," -c local /check.yml -v

name: Check CVE-2026-31431

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  check-vulnerability:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build test image
        run: docker build -t test-image .

      - name: Check for CVE-2026-31431 in container
        run: |
          docker run --rm \
            -v ${{ github.workspace }}/check_cve_2026_31431.yml:/check.yml \
            test-image \
            /bin/bash -c "apt update && apt install -y ansible python3 && \
            echo 'no' | ansible-playbook -i 'localhost,' -c local /check.yml -v"

      - name: Fail if vulnerable
        run: |
          # Le playbook doit retourner != 0 si vulnérable
          # Ou analyser la sortie en recherchant "VULNERABLE"

stages:
  - build
  - security

build_image:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .

check_cve:
  stage: security
  script:
    - docker run --rm -v $(pwd)/check_cve_2026_31431.yml:/check.yml $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
      /bin/bash -c "apt-get update && apt-get install -y ansible python3 && 
      ansible-playbook -i 'localhost,' -c local /check.yml -v | grep -q 'SAFE' || exit 1"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

FROM ubuntu:22.04

RUN apt-get update && apt-get install -y ansible python3 wget

# Copier et exécuter la vérification pendant le build
COPY check_cve_2026_31431.yml /tmp/
RUN echo "no" | ansible-playbook -i "localhost," -c local /tmp/check_cve_2026_31431.yml -v | \
    grep -q "SAFE" || (echo "VULNERABLE - Fix before building" && exit 1)

# Reste de votre image...

Status: SAFE - System is protected