DevSecOps 流水线实践

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
        args: ['protect', '--staged']

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: detect-private-key
      - id: check-added-large-files

# 安装
pip install pre-commit
pre-commit install

# GitLeaks 扫描历史提交
gitleaks detect --source . --report-path gitleaks-report.json

# 深度扫描（支持熵分析和正则）
trufflehog git https://github.com/org/repo.git \
  --branch=main \
  --only-verified \
  --json

# 扫描结果示例
{
  "SourceMetadata": {"Data": {"Git": {"commit": "abc123"}}},
  "Redacted": "AKIA****************",
  "DetectorName": "AWS",
  "DecoderName": "PLAIN",
  "Verified": true
}

# 镜像漏洞扫描
trivy image myapp:latest --severity HIGH,CRITICAL

# 扫描结果
┌──────────┬────────────────┬──────────┬────────┬───────────────────┐
│ Library  │ Vulnerability  │ Severity │ Status │ Installed Version │
├──────────┼────────────────┼──────────┼────────┼───────────────────┤
│ openssl  │ CVE-2023-xxxx  │ CRITICAL │ fixed  │ 1.1.1n-r0         │
│ log4j    │ CVE-2021-44228 │ CRITICAL │ fixed  │ 2.14.1            │
└──────────┴────────────────┴──────────┴────────┴───────────────────┘

# Dockerfile 扫描（最佳实践）
trivy config Dockerfile

# 文件系统扫描
trivy filesystem .

# GitLab CI
container_scan:
  stage: security
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  allow_failure: false

# GitHub Actions
- name: Scan Docker image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:latest'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'

# 扫描 Terraform/K8s yaml/CloudFormation
checkov -d terraform/

# 特定检查
checkov --file k8s-deployment.yaml --framework kubernetes

# 结果
Passed checks: 15, Failed checks: 3, Skipped checks: 0

Check: CKV_K8S_22: "Use read-only root filesystem"
FAILED for resource: Deployment.myapp

# security.feature
Feature: Security tests for AWS infrastructure
  Scenario: Ensure all S3 buckets are encrypted
    Given I have AWS S3 bucket defined
    Then it must contain server_side_encryption_configuration

stages:
  - build
  - test
  - security
  - deploy

variables:
  DOCKER_DRIVER: overlay2

# ========== 构建阶段 ==========
build:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

# ========== 安全阶段 ==========
secrets_check:
  stage: security
  image: zricethezav/gitleaks:latest
  script:
    - gitleaks detect --source . --verbose
  allow_failure: false

sast:
  stage: security
  image: returntocorp/semgrep
  script:
    - semgrep --config=p/owasp-top-ten --config=p/ci --json --output=semgrep.json .
  artifacts:
    reports:
      sast: semgrep.json
  allow_failure: false

sca:
  stage: security
  image: maven:3.9-eclipse-temurin
  script:
    - mvn org.owasp:dependency-check-maven:check -DfailBuildOnCVSS=7
  artifacts:
    reports:
      dependency_scanning: target/dependency-check-report.json
  allow_failure: false

container_scan:
  stage: security
  image: aquasec/trivy:latest
  script:
    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  allow_failure: false

iac_scan:
  stage: security
  image: bridgecrew/checkov:latest
  script:
    - checkov -d terraform/ --compact --quiet
  allow_failure: false

# ========== 部署阶段 ==========
deploy_staging:
  stage: deploy
  script:
    - helm upgrade --install myapp ./helm-chart --namespace staging
  environment:
    name: staging
    url: https://staging.example.com

# .github/workflows/security.yml
name: Security Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            p/ci
      - uses: github/codeql-action/init@v3
        with:
          languages: java
      - uses: github/codeql-action/analyze@v3

  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Snyk
        uses: snyk/actions/maven@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

  container-scan:
    runs-on: ubuntu-latest
    needs: build
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
      - name: Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
      - name: Upload scan
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

# .semgrep/custom-rules.yml
rules:
  - id: insecure-random
    pattern: Math.random()
    languages:
      - javascript
      - typescript
    message: "Math.random() is not cryptographically secure. Use crypto.randomBytes() instead."
    severity: ERROR

  - id: sql-injection-risk
    patterns:
      - pattern-either:
          - pattern: |
              $QUERY.execute($X + $Y)
          - pattern: |
              $QUERY.execute(`${$X}...`)
    languages:
      - javascript
    message: "Potential SQL injection. Use parameterized queries."
    severity: ERROR

// RASP 拦截 SQL 注入示例（概念）
public class SQLInjectionHook {
    // Hook JDBC Statement.execute()
    public static void onExecute(String sql) {
        // 1. 检查 SQL 语句中是否包含非法拼接模式
        if (containsTaintedData(sql)) {
            // 2. 提取用户输入在 SQL 中的具体位置
            List<TaintRange> taints = extractTaintRanges(sql);

            // 3. 如果用户输入进入了语法关键位置（WHERE/ORDER BY/UNION 后）
            if (isInCriticalSyntaxPosition(taints)) {
                // 4. 阻断并告警
                blockAndAlert("SQL Injection detected", sql, taints);
                throw new SecurityException("Blocked SQL Injection attempt");
            }
        }
    }
}

# 生成 SBOM（SPDX 格式）
syft myapp:latest -o spdx-json > sbom.spdx.json

# 漏洞关联扫描（对比漏洞数据库）
grype sbom.spdx.json --add-cpes-if-none

# SBOM 签名校验（确保未被篡改）
cosign sign-blob sbom.spdx.json --key cosign.key

# .security-baseline.yml
rules:
  network:
    - public_access: deny_by_default
    - tls_version: "1.2+"
    - cipher_suites: modern
    
  authentication:
    - mfa_required: true
    - password_policy: nist_800_63b
    - session_timeout: 30m
    
  data:
    - encryption_at_rest: aes_256
    - encryption_in_transit: tls_1.2
    - pii_masking: true
    
  logging:
    - audit_logs: enabled
    - retention_days: 365
    - tamper_protection: true
    
  containers:
    - non_root_user: required
    - read_only_root_fs: true
    - no_privilege_escalation: true
    - drop_capabilities: [ALL]