chore: update ci

.github/workflows/backend-build.yml

@@ -2,17 +2,17 @@ name: Backend - Build & Lint
 
 on:
     push:
-        branches: [main]
+        branches: [main, pre-prod]
         paths:
             - "backend/**/**"
     pull_request:
-        branches: [main]
+        branches: [main, pre-prod]
         paths:
             - "backend/**/**"
 
 jobs:
     lint:
-        name: Static Analysis (golangci-lint)
+        name: Static Analysis (golangci-lint + gosec)
         runs-on: ubuntu-latest
 
         steps:
@@ -24,6 +24,10 @@ jobs:
                   go-version: "1.24.4"
                   cache-dependency-path: backend/gestion/go.sum
 
+            - name: Download dependencies
+              working-directory: backend/gestion
+              run: go mod download
+
             - name: golangci-lint
               uses: golangci/golangci-lint-action@v6
               continue-on-error: true
@@ -32,6 +36,14 @@ jobs:
                   working-directory: backend/gestion
                   args: --timeout=5m
 
+            - name: Install gosec
+              run: go install github.com/securego/gosec/v2/cmd/gosec@latest
+
+            - name: Run Gosec Security Scanner
+              working-directory: backend/gestion
+              run: gosec ./...
+              continue-on-error: true
+
     build:
         name: Build
         needs: lint
@@ -65,7 +77,9 @@ jobs:
         name: Docker Build & Push
         needs: build
         runs-on: ubuntu-latest
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: >
+            github.event_name == 'push' &&
+            (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/pre-prod')
 
         steps:
             - uses: actions/checkout@v4
@@ -86,7 +100,7 @@ jobs:
                   file: docker/backend/Dockerfile
                   target: runtime
                   push: true
-                  tags: xor1234/backend-mln:latest
+                  tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'latest' || 'pre-prod' }}
 
             - name: Build & push WAF
               uses: docker/build-push-action@v6
@@ -95,7 +109,7 @@ jobs:
                   file: docker/backend/Dockerfile
                   target: waf
                   push: true
-                  tags: xor1234/backend-mln:waf
+                  tags: xor1234/backend-mln:${{ github.ref == 'refs/heads/main' && 'waf' || 'waf-pre-prod' }}
 
     deploy:
         name: SSH Deploy
@@ -106,9 +120,9 @@ jobs:
             - name: SSH deploy
               uses: appleboy/ssh-action@v1
               with:
-                  host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST }}
+                  host: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_HOST_PROD || secrets.SERVER_HOST_PRE_PROD }}
                   username: ${{ secrets.SERVER_USER }}
-                  key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY }}
+                  key: ${{ (github.ref == 'refs/heads/main' || github.base_ref == 'main') && secrets.SERVER_SSH_KEY_PROD || secrets.SERVER_SSH_KEY_PRE_PROD }}
                   script: |
                       docker compose -f ${{ secrets.COMPOSE_PATH }} pull backend waf
                       docker compose -f ${{ secrets.COMPOSE_PATH }} up -d --no-deps backend waf