DevSecOps：安全左移

# .semgrep.yml - Semgrep 规则配置
rules:
  # 检测硬编码密钥
  - id: hardcoded-secret
    patterns:
      - pattern: |
          $VAR = "..."
      - metavariable-regex:
          metavariable: $VAR
          regex: "(?i)(password|secret|api_key|token|private_key)"
      - metavariable-regex:
          metavariable: '"..."'
          regex: ".{8,}"
    message: "检测到硬编码的敏感信息，请使用环境变量或密钥管理服务"
    severity: ERROR
    languages: [python, javascript, typescript, java, go]

  # 检测 SQL 注入风险
  - id: sql-injection-string-format
    patterns:
      - pattern-either:
          - pattern: |
              $CURSOR.execute("..." + $VAR)
          - pattern: |
              $CURSOR.execute(f"...{$VAR}...")
          - pattern: |
              $CURSOR.execute("...%s..." % $VAR)
    message: "检测到 SQL 拼接，存在 SQL 注入风险，请使用参数化查询"
    severity: ERROR
    languages: [python]

  # 检测不安全的反序列化
  - id: unsafe-deserialization
    patterns:
      - pattern: pickle.loads(...)
      - pattern-not: pickle.loads(b"...")
    message: "pickle.loads 处理不可信数据可能导致远程代码执行，请使用 json 或 protobuf"
    severity: WARNING
    languages: [python]

  # 检测不安全的 CORS 配置
  - id: cors-wildcard
    patterns:
      - pattern: |
          {"Access-Control-Allow-Origin": "*"}
      - pattern-not-inside: |
          {"Access-Control-Allow-Origin": "*", "Access-Control-Allow-Credentials": ...}
    message: "CORS 配置为通配符，请确认是否需要限制来源域名"
    severity: WARNING
    languages: [python, javascript, typescript]

# .github/workflows/security-scan.yml
name: DevSecOps Security Pipeline

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]
  schedule:
    - cron: '0 2 * * 1'  # 每周一凌晨全量扫描

permissions:
  security-events: write
  contents: read

jobs:
  # 1. Secret 扫描 - 检测代码中的敏感信息泄露
  secret-scan:
    name: Secret Detection
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 获取完整历史用于扫描

      - name: Gitleaks Secret Scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

  # 2. SAST 扫描 - 静态代码安全分析
  sast-scan:
    name: SAST Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Semgrep SAST Scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/cwe-top-25
            p/javascript
            p/python
            .semgrep.yml
          publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
          generateSarif: "1"

      - name: Upload SARIF Results
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

  # 3. SCA 扫描 - 依赖漏洞检查
  sca-scan:
    name: Dependency Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy SCA Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'  # Critical/High 漏洞阻断流水线

      - name: Upload Trivy SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  # 4. 容器镜像扫描
  container-scan:
    name: Container Image Scan
    runs-on: ubuntu-latest
    needs: [sast-scan, sca-scan]  # 依赖前置扫描通过
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker Image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Trivy Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'table'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          ignore-unfixed: true

  # 5. IaC 扫描 - 基础设施代码安全检查
  iac-scan:
    name: IaC Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Checkov IaC Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: 'infra/'
          framework: 'terraform,kubernetes,dockerfile'
          output_format: 'sarif'
          output_file_path: 'checkov-results.sarif'
          soft_fail: false  # 检查失败时阻断

      - name: Upload Checkov SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'checkov-results.sarif'

  # 6. DAST 扫描 - 动态安全测试（仅对 Staging 环境）
  dast-scan:
    name: DAST Scan (Staging)
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    needs: [container-scan]
    steps:
      - uses: actions/checkout@v4

      - name: OWASP ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: 'https://staging.myapp.example.com'
          rules_file_name: 'zap-rules.tsv'
          cmd_options: '-a -j'
          issue_title: 'ZAP Baseline Scan Report'
          fail_action: false  # DAST 初期不阻断，避免误报影响交付

# zap-rules.tsv - OWASP ZAP 扫描规则配置
# 格式: 规则ID	动作	URL正则	参数	说明
# IGNORE: 忽略  WARN: 警告  FAIL: 备案后失败

10038	IGNORE	.*		Directories - 暂不需要检查目录枚举
10040	IGNORE	.*		Source Code Disclosure - 误报率高
10171	IGNORE	.*		Authentication Request - 登录接口不检查
40012	WARN	.*		X-Frame-Options Header
40018	WARN	.*		X-Content-Type-Options Header
10202	FAIL	.*		Absence of Anti-CSRF Tokens
40014	FAIL	.*		Cross Site Scripting (Reflected)
40019	FAIL	.*		Cross Site Scripting (Persistent)
90019	FAIL	.*		Server Side Request Forgery
90020	FAIL	.*		Remote Code Execution

// sonar-qube-security-gate.json - SonarQube 安全质量门禁
{
  "name": "DevSecOps Security Gate",
  "conditions": [
    {
      "metric": "security_rating",
      "operator": "GREATER_THAN",
      "value": "1",
      "errorThreshold": "1"
    },
    {
      "metric": "security_hotspots_reviewed",
      "operator": "LESS_THAN",
      "value": "100",
      "errorThreshold": "100"
    },
    {
      "metric": "vulnerabilities",
      "operator": "GREATER_THAN",
      "value": "0",
      "errorThreshold": "0"
    },
    {
      "metric": "security_remediation_effort",
      "operator": "GREATER_THAN",
      "value": "0",
      "errorThreshold": "0"
    }
  ]
}

1. 发现者提交安全例外请求（Security Exception Request）
2. 说明：漏洞详情、不修复理由、补偿控制措施、风险接受者
3. 安全团队评审，给出风险等级和补偿控制建议
4. 风险接受者（通常是工程总监或 CTO）签字确认
5. 例外有效期最长 90 天，到期自动重新评估
6. 所有例外记录在安全例外注册表中