Add IAC job

.github/workflows/main.yml

@@ -23,7 +23,7 @@ env:
   # Parámetros de despliegue local
   IMAGE_NAME: demo-app
   IMAGE_TAG: local
-  KIND_CLUSTER: kind-devsecops
+  KIND_CLUSTER: kind
   SERVICE_RELEASE_NAME: demo
 
 jobs:
@@ -32,7 +32,7 @@ jobs:
   # ──────────────────────────────────────────────────────────────────────────────
   secrets:
     name: Secrets scanning (Gitleaks)
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
     steps:
       - name: Clean gitleaks
         run: rm -f /tmp/gitleaks.tmp   
@@ -47,11 +47,11 @@ jobs:
 
   sast:
     name: SAST (Semgrep)
-    runs-on: self-hosted
+    runs-on: ubuntu-latest
     needs: [secrets]
     steps:
       - uses: actions/checkout@v4
-      - name: Semgrep (no bloqueante)
+      - name: self-hosted (no bloqueante)
         run: |
           docker run --rm -v "$PWD:/src" returntocorp/semgrep:latest \
             semgrep scan --config p/ci --config .semgrep
@@ -61,3 +61,39 @@ jobs:
             semgrep scan --config p/ci --config .semgrep --sarif -o semgrep.sarif || true
       - uses: github/codeql-action/upload-sarif@v3
         with: { sarif_file: semgrep.sarif }
+
+  # ──────────────────────────────────────────────────────────────────────────────
+  # IaC + Build + SBOM
+  # ──────────────────────────────────────────────────────────────────────────────
+  # iac:
+  #   name: IaC scan (Checkov)
+  #   runs-on: ubuntu-latest
+  #   needs: [sast]
+  #   steps:
+  #     - uses: actions/checkout@v4
+  #     - name: Checkov (K8s/Terraform)
+  #       uses: bridgecrewio/checkov-action@master
+  #       with:
+  #         directory: .
+  #         quiet: true
+  #         soft_fail: false     # pon true si no quieres bloquear (no recomendado)
+
+
+  build:
+    name: Build + SBOM
+    runs-on: ubuntu-latest
+    needs: [sast]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build imagen de la app objetivo
+        run: |
+          cd "${APP_DIR}"
+          docker build -t ${IMAGE_NAME}:${IMAGE_TAG} .
+          echo ${IMAGE_NAME}
+          echo ${IMAGE_TAG}
+      - name: SBOM (Syft)
+        uses: anchore/sbom-action@v0
+        with:
+          image: demo-app:local
+          artifact-name: sbom.spdx.json   # queda como artefacto del job
+