GitHub Actions 依赖安全：Dependabot、SBOM 与供应链防护

# .github/dependabot.yml
version: 2
updates:
  # npm 依赖
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "Asia/Shanghai"
    open-pull-requests-limit: 10
    reviewers:
      - "octocat"
    labels:
      - "dependencies"
      - "security"
    commit-message:
      prefix: "chore"
      include: "scope"

  # Python 依赖
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    target-branch: "main"

  # GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

Dependabot 安全更新功能：
- 自动检测依赖中的已知 CVE
- 自动生成修复 PR（升级到有修复的版本）
- 在 repo → Security → Dependabot alerts 中查看

# 启用：Settings → Security → Dependabot alerts → Enable
# Settings → Security → Dependabot security updates → Enable

# .github/workflows/auto-merge-dependabot.yml
name: Auto-merge Dependabot PRs

on: pull_request

jobs:
  auto-merge:
    runs-on: ubuntu-latest
    if: github.actor == 'dependabot[bot]'
    steps:
      - name: Dependabot metadata
        id: metadata
        uses: dependabot/fetch-metadata@v1

      - name: Auto-merge patch/minor
        if: steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor'
        run: gh pr merge --auto --merge "$PR_URL"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# .github/workflows/sbom.yml
name: Generate SBOM

on:
  push:
    branches: [main]

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          format: spdx-json
          output-file: sbom.spdx.json

      - name: Upload SBOM
        uses: actions/upload-artifact@v3
        with:
          name: sbom
          path: sbom.spdx.json

# GitHub 自动生成依赖图：
# Insights → Dependency graph
# 查看：直接依赖、间接依赖、许可证信息

# 许可证合规检查：
# Settings → Code security → Dependency review → Enable
# PR 中新增有漏洞或有许可证冲突的依赖时会阻塞

      - name: Build artifact
        run: npm run build

      - name: Sign artifact with Sigstore
        uses: sigstore/cosign-installer@v3
      - run: cosign sign-blob --yes dist/app.js --output-signature app.js.sig
        env:
          COSIGN_EXPERIMENTAL: 1

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v1
        with:
          subject-path: 'dist/**/*'

# .github/workflows/codeql.yml
name: CodeQL

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 9 * * 1'  # 每周一 9 点

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      matrix:
        language: [javascript, python]

    steps:
      - uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ matrix.language }}

      - name: Autobuild
        uses: github/codeql-action/autobuild@v2

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2

# CodeQL 支持自定义安全查询规则
# .github/codeql/custom-queries/
# 可针对特定漏洞模式编写 QL 查询

# 自动扫描仓库中泄露的密钥：
# - AWS 密钥
# - GitHub Token
# - Slack Token
# - 自定义模式（企业版）

# 启用：Settings → Security → Secret scanning → Enable
# 推送含密钥的代码 → 立即告警并提供撤销建议

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']

# 使用 GitHub Secrets 而非硬编码
secrets.MY_API_KEY  # 仓库级
vars.MY_VARIABLE    # 仓库级变量（非加密）

# 环境级密钥（prod/staging 分离）
# Settings → Environments → Production → Secrets

使用第三方 Action 前检查：
1) 官方认证：是否被 GitHub 验证（蓝勾）
2) Star 数和维护活跃度
3) 源代码审查：看 action.yml 和 entrypoint 做了什么
4) 版本锁定：用 SHA 而非 tag
5) 权限最小化：限制 GITHUB_TOKEN 权限

# 坏：使用 mutable tag
- uses: actions/checkout@v4

# 好：使用 commit SHA（不可变）
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

# 更好：用 Dependabot 自动更新 SHA
# Dependabot 会监控 Action 更新并自动发 PR

jobs:
  build:
    permissions:
      contents: read      # 只读代码
      packages: write     # 只写包
      security-events: write  # 安全扫描用

1) 评估影响：漏洞是否在代码路径中被触发
2) 查看 Dependabot PR：是否已自动生成修复
3) 测试修复：引入新版本是否破坏兼容性
4) 紧急修复：如 POC 公开，立即修复/release
5) 通知用户：如影响已发布版本，发布安全公告

# .github/workflows/security-release.yml
name: Security Release

on:
  workflow_dispatch:
    inputs:
      severity:
        description: 'Severity (low/medium/high/critical)'
        required: true

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run full test suite
        run: npm test
      - name: Publish security patch
        run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}