ansible-playbook -i "localhost," -c local --ask-become-pass check_cve_2026_31431.yml -v

./run_revert.sh
# Выбрать 'l' для локального запуска

ansible-playbook -i "localhost," -c local --ask-become-pass revert_cve_2026_31431.yml -v

ansible-playbook -i "192.168.1.100," -u ubuntu --ask-become-pass check_cve_2026_31431.yml -v

[servers]
192.168.1.100
192.168.1.101

ansible-playbook -i hosts.ini --ask-become-pass check_cve_2026_31431.yml -v

./run_revert.sh
# Выбрать 'l' для локального запуска

docker run -it --privileged ubuntu:22.04 /bin/bash
# Внутри контейнера:
apt update && apt install -y ansible python3
# Скопировать playbook в контейнер или использовать curl/wget
ansible-playbook -i "localhost," -c local check_cve_2026_31431.yml -v

docker run -it --privileged -v $(pwd)/check_cve_2026_31431.yml:/check.yml ubuntu:22.04
# Внутри: ansible-playbook -i "localhost," -c local /check.yml -v

name: Check CVE-2026-31431

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  check-vulnerability:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build test image
        run: docker build -t test-image .

      - name: Check for CVE-2026-31431 in container
        run: |
          docker run --rm \
            -v ${{ github.workspace }}/check_cve_2026_31431.yml:/check.yml \
            test-image \
            /bin/bash -c "apt update && apt install -y ansible python3 && \
            echo 'no' | ansible-playbook -i 'localhost,' -c local /check.yml -v"

      - name: Fail if vulnerable
        run: |
          # Playbook должен возвращать != 0, если система уязвима
          # Или парсить вывод в поисках "VULNERABLE"

stages:
  - build
  - security

build_image:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .

check_cve:
  stage: security
  script:
    - docker run --rm -v $(pwd)/check_cve_2026_31431.yml:/check.yml $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
      /bin/bash -c "apt-get update && apt-get install -y ansible python3 && 
      ansible-playbook -i 'localhost,' -c local /check.yml -v | grep -q 'SAFE' || exit 1"
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'

FROM ubuntu:22.04

RUN apt-get update && apt-get install -y ansible python3 wget

# Скопировать и выполнить проверку во время сборки
COPY check_cve_2026_31431.yml /tmp/
RUN echo "no" | ansible-playbook -i "localhost," -c local /tmp/check_cve_2026_31431.yml -v | \
    grep -q "SAFE" || (echo "VULNERABLE - Fix before building" && exit 1)

# Остальная часть вашего образа...

Status: SAFE - System is protected