6.2 Безопасность в CI/CD #

# .github/workflows/devsecops-pipeline.yml
name: DevSecOps Pipeline

on: [push, pull_request]

jobs:
  # Gate 1: Secret Detection
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
        with:
          fetch-depth: 0
      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD

  # Gate 2: Static Analysis Security Testing (SAST)
  sast:
    runs-on: ubuntu-latest
    needs: secrets-scan
    steps:
      - uses: actions/checkout@v3
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: p/security-audit p/secrets

  # Gate 3: Software Composition Analysis (SCA)
  sca:
    runs-on: ubuntu-latest
    needs: sast
    steps:
      - uses: actions/checkout@v3
      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

  # Gate 4: Container Image Scanning
  container-scan:
    runs-on: ubuntu-latest
    needs: sca
    steps:
      - uses: actions/checkout@v3
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'

  # Gate 5: Infrastructure as Code Scanning
  iac-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Checkov action
        uses: bridgecrewio/checkov-action@master
        with:
          directory: .
          framework: terraform,kubernetes,dockerfile

# SonarQube в GitHub Actions
- name: SonarQube Scan
  uses: sonarqube-quality-gate-action@master
  env:
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  with:
    scanMetadataReportFile: target/sonar/report-task.txt

# sonar-project.properties
sonar.projectKey=my-project
sonar.organization=my-org
sonar.sources=src
sonar.tests=tests
sonar.javascript.lcov.reportPaths=coverage/lcov.info

# Security rules
sonar.security.hotspots.inherited=true
sonar.security.review.inherited=true

# Semgrep configuration
- name: Semgrep
  uses: returntocorp/semgrep-action@v1
  with:
    config: >-
      p/security-audit
      p/secrets
      p/owasp-top-ten
      p/cwe-top-25

# Custom Semgrep rules (.semgrep.yml)
rules:
  - id: hardcoded-password
    patterns:
      - pattern: password = "..."
      - pattern: PASSWORD = "..."
    message: Hardcoded password detected
    languages: [python, javascript]
    severity: ERROR

  - id: sql-injection
    patterns:
      - pattern: cursor.execute("SELECT * FROM users WHERE id = " + $VAR)
    message: Possible SQL injection
    languages: [python]
    severity: WARNING

# GitHub Advanced Security
name: "CodeQL"
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    steps:
    - name: Checkout repository
      uses: actions/checkout@v3

    - name: Initialize CodeQL
      uses: github/codeql-action/init@v2
      with:
        languages: javascript, python
        queries: security-and-quality

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v2

# Constraint Template
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredsecuritycontext
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredSecurityContext
      validation:
        type: object
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredsecuritycontext
        
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.securityContext.runAsNonRoot
          msg := "Container must run as non-root user"
        }
        
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.securityContext.readOnlyRootFilesystem
          msg := "Root filesystem must be read-only"
        }

# Constraint Instance
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredSecurityContext
metadata:
  name: must-have-security-context
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters: {}

# SonarQube Quality Gate
- name: SonarQube Quality Gate check
  uses: sonarqube-quality-gate-action@master
  timeout-minutes: 5
  env:
    SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  with:
    scanMetadataReportFile: target/sonar/report-task.txt

# Custom Security Gate
- name: Security Gate
  run: |
    #!/bin/bash
    
    # Check SAST results
    if [ $(jq '.runs[0].results | length' sast-results.sarif) -gt 0 ]; then
      echo "❌ SAST findings detected"
      exit 1
    fi
    
    # Check container scan results
    CRITICAL_VULNS=$(jq '.runs[0].results[] | select(.level=="error") | length' trivy-results.sarif)
    if [ $CRITICAL_VULNS -gt 0 ]; then
      echo "❌ Critical vulnerabilities found: $CRITICAL_VULNS"
      exit 1
    fi
    
    echo "✅ All security gates passed"

# ❌ Плохие практики
export DATABASE_PASSWORD="super_secret_123"
docker run -e DB_PASS=password123 myapp
kubectl create secret generic mysecret --from-literal=password=abc123

# История Git с секретами
git log --grep="password" --all
git log -p | grep -i "api.key\|password\|secret"

# Использование GitHub Secrets
- name: Deploy to production
  env:
    DATABASE_URL: ${{ secrets.DATABASE_URL }}
    API_KEY: ${{ secrets.API_KEY }}
  run: |
    echo "Deploying with secure credentials"
    # Secrets не попадают в логи

# Vault в CI/CD
- name: Import Secrets
  uses: hashicorp/vault-action@v2.4.0
  with:
    url: https://vault.example.com:8200
    token: ${{ secrets.VAULT_TOKEN }}
    secrets: |
      secret/data/prod database_password | DATABASE_PASSWORD ;
      secret/data/prod api_key | API_KEY

# Kubernetes External Secrets
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
spec:
  provider:
    vault:
      server: "https://vault.example.com"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "example-role"
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: app-secrets
    creationPolicy: Owner
  data:
  - secretKey: database-password
    remoteRef:
      key: secret/app
      property: database_password

{
  "security_pipeline_metrics": {
    "last_24h": {
      "total_builds": 45,
      "security_gate_failures": 3,
      "avg_scan_time": "2m 34s",
      "critical_vulns_found": 2,
      "critical_vulns_fixed": 2
    },
    "trending": {
      "false_positive_rate": "8%",
      "security_debt": "12 hours",
      "compliance_score": "94%"
    }
  }
}

# Slack уведомления
- name: Notify Security Team
  if: failure()
  uses: 8398a7/action-slack@v3
  with:
    status: failure
    channel: '#security-alerts'
    text: |
      🚨 Security gate failure in ${{ github.repository }}
      Branch: ${{ github.ref }}
      Commit: ${{ github.sha }}
      Failed step: ${{ github.job }}
  env:
    SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

# 1. Создать проект с уязвимостями
mkdir vulnerable-app && cd vulnerable-app
npm init -y
npm install express@4.16.0  # старая версия с CVE

cat > app.js << 'EOF'
const express = require('express');
const app = express();

// SQL Injection vulnerability
app.get('/user', (req, res) => {
  const query = `SELECT * FROM users WHERE id = ${req.query.id}`;
  // Выполнение query...
});

// XSS vulnerability  
app.get('/search', (req, res) => {
  res.send(`<h1>Results for: ${req.query.q}</h1>`);
});

app.listen(3000);
EOF

# 2. Настроить Semgrep
semgrep --config=p/security-audit .

# 1. Создать уязвимый Dockerfile
cat > Dockerfile << 'EOF'
FROM ubuntu:18.04
RUN apt-get update
COPY . /app
RUN chmod 777 /app
USER root
CMD ["node", "app.js"]
EOF

# 2. Сканирование
docker build -t vulnerable-app .
trivy image vulnerable-app:latest

# 3. Исправить проблемы
cat > Dockerfile.secure << 'EOF'
FROM node:18-alpine
RUN addgroup -g 1001 -S nodejs
RUN adduser -S nextjs -u 1001
WORKDIR /app
COPY --chown=nextjs:nodejs . .
USER nextjs
CMD ["node", "app.js"]
EOF

# Создать .github/workflows/security.yml
name: Security Pipeline
on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      # Secret scanning
      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        
      # SAST
      - name: Semgrep
        uses: returntocorp/semgrep-action@v1
        
      # SCA  
      - name: Snyk scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
          
      # Container scan
      - name: Build and scan image
        run: |
          docker build -t myapp:${{ github.sha }} .
          trivy image myapp:${{ github.sha }}