DevSecOps 安全测试集成：SAST、DAST 与 SCA 的实战落地

<!-- pom.xml -->
<profiles>
  <profile>
    <id>sonar</id>
    <properties>
      <sonar.host.url>http://sonarqube.company.internal:9000</sonar.host.url>
      <sonar.projectKey>my-service</sonar.projectKey>
      <sonar.qualitygate.wait>true</sonar.qualitygate.wait>
      <sonar.coverage.exclusions>**/config/**,**/dto/**</sonar.coverage.exclusions>
    </properties>
    <build>
      <plugins>
        <plugin>
          <groupId>org.sonarsource.scanner.maven</groupId>
          <artifactId>sonar-maven-plugin</artifactId>
          <version>3.9.1.2184</version>
        </plugin>
        <plugin>
          <groupId>org.jacoco</groupId>
          <artifactId>jacoco-maven-plugin</artifactId>
          <version>0.8.11</version>
          <executions>
            <execution>
              <goals>
                <goal>prepare-agent</goal>
              </goals>
            </execution>
            <execution>
              <id>report</id>
              <phase>test</phase>
              <goals>
                <goal>report</goal>
              </goals>
            </execution>
          </executions>
        </plugin>
      </plugins>
    </build>
  </profile>
</profiles>

// build.gradle
plugins {
    id "org.sonarqube" version "4.4.1.3373"
    id "jacoco"
}

sonarqube {
    properties {
        property "sonar.host.url", "http://sonarqube.company.internal:9000"
        property "sonar.projectKey", "my-service"
        property "sonar.sources", "src/main/java"
        property "sonar.tests", "src/test/java"
        property "sonar.java.coveragePlugin", "jacoco"
        property "sonar.coverage.jacoco.xmlReportPaths", "build/reports/jacoco/test/jacocoTestReport.xml"
        property "sonar.qualitygate.wait", "true"
    }
}

# 安装 SonarScanner
docker pull sonarsource/sonar-scanner-cli

# 运行扫描
docker run --rm \
  -e SONAR_HOST_URL="http://sonarqube.company.internal:9000" \
  -e SONAR_SCANNER_OPTS="-Dsonar.projectKey=my-service" \
  -e SONAR_TOKEN="sqp_xxxxxxxx" \
  -v "$(pwd):/usr/src" \
  sonarsource/sonar-scanner-cli

# rules/insecure-deserialization.yaml
rules:
  - id: java-insecure-deserialization
    languages: [java]
    message: >
      检测到不安全的 Java 反序列化操作。ObjectInputStream 读取不可信数据
      可能导致远程代码执行（RCE）。建议使用 JSON 等安全格式替代，
      或实现 lookAheadObjectInputStream 进行类名白名单校验。
    severity: ERROR
    metadata:
      cwe: "CWE-502: Deserialization of Untrusted Data"
      owasp: "A08:2021 - Software and Data Integrity Failures"
      references:
        - https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
    patterns:
      - pattern: new ObjectInputStream(...)
      - pattern-not-inside: |
          class $CLASS implements ObjectInputFilter {
            ...
          }

  - id: hardcoded-secret
    languages: [python, javascript, java, go]
    message: "检测到硬编码的敏感信息（API Key / Password / Token）"
    severity: WARNING
    patterns:
      - pattern-regex: '(?i)(api[_-]?key|password|secret|token)\s*[=:]\s*["\'][a-zA-Z0-9]{16,}["\']'

# 安装
pip install semgrep

# 运行 OWASP 规则集
semgrep --config=auto .

# 运行特定规则集
semgrep --config=p/owasp-top-ten --config=p/cwe-top-25 src/

# 输出 SARIF 格式（用于 GitHub Advanced Security）
semgrep --config=auto --sarif --output=semgrep-results.sarif .

# 仅扫描 diff（CI 场景）
semgrep --config=auto --baseline-commit=origin/main

# .github/workflows/semgrep.yml
name: Semgrep SAST

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep:develop
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Semgrep
        run: |
          semgrep ci \
            --config=auto \
            --json --output=semgrep.json
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: semgrep.json
        if: always()

# .github/workflows/codeql.yml
name: CodeQL Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 3 * * 1'  # 每周一早 3 点扫描

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write

    strategy:
      fail-fast: false
      matrix:
        language: [java, python, javascript]

    steps:
      - uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@v2

      - name: Perform Analysis
        uses: github/codeql-action/analyze@v2
        with:
          category: "/language:${{ matrix.language }}"

# Docker 运行 ZAP 基线扫描
docker run -t --rm \
  -v $(pwd):/zap/wrk/:rw \
  -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://staging.example.com \
  -g gen.conf \
  -r zap-report.html \
  -w zap-report.md \
  -J zap-report.json

# 参数说明：
# -t: 目标 URL
# -g: 生成默认配置文件（首次运行）
# -r: HTML 报告输出
# -w: Markdown 报告输出
# -J: JSON 报告输出

docker run -t --rm \
  -v $(pwd):/zap/wrk/:rw \
  ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t https://staging.example.com \
  -c zap-full-scan.conf \
  -r zap-full-report.html

docker run -t --rm \
  -v $(pwd):/zap/wrk/:rw \
  ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
  -t https://api.example.com/openapi.json \
  -f openapi \
  -r api-report.html

# 表单认证配置
docker run -t --rm \
  -v $(pwd):/zap/wrk/:rw \
  ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://app.example.com \
  --authMethod form-based \
  --authLoginUrl https://app.example.com/login \
  --authUsername admin@example.com \
  --authPassword $ZAP_AUTH_PASSWORD

# .github/workflows/dast.yml
name: DAST Scan

on:
  workflow_run:
    workflows: ["Deploy to Staging"]
    types: [completed]

jobs:
  zap-scan:
    runs-on: ubuntu-latest
    if: github.event.workflow_run.conclusion == 'success'
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.10.0
        with:
          target: 'https://staging.example.com'
          rules_file_name: '.zap/rules.tsv'
          cmd_options: '-a'

      - name: Upload Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: zap-report
          path: report_*.html

# 安装
npm install -g snyk

# 认证
snyk auth

# 测试项目依赖
snyk test --severity-threshold=high

# 监控项目（持续跟踪新漏洞）
snyk monitor --org=my-org --project-name=my-service

# 测试容器镜像
snyk container test myapp:latest --file=Dockerfile

# 生成修复建议
snyk fix

<plugin>
  <groupId>io.snyk</groupId>
  <artifactId>snyk-maven-plugin</artifactId>
  <version>2.2.0</version>
  <executions>
    <execution>
      <id>snyk-test</id>
      <phase>test</phase>
      <goals>
        <goal>test</goal>
      </goals>
      <configuration>
        <severityThreshold>high</severityThreshold>
        <failOnIssues>true</failOnIssues>
      </configuration>
    </execution>
  </executions>
</plugin>

version: 2
updates:
  # Maven 依赖
  - package-ecosystem: "maven"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
    open-pull-requests-limit: 10
    reviewers:
      - "team/backend"
    labels:
      - "dependencies"
      - "security"
    # 自动合并 patch 级别的安全更新
    auto-merge: true
    allow:
      - dependency-type: "direct"
    commit-message:
      prefix: "deps"
      include: "scope"

  # GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"

# Maven
dependency:tree -DoutputType=dot

# 或使用 CycloneDX Maven 插件
mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom

# Node.js
npm install -g @cyclonedx/cyclonedx-npm
cyclonedx-npm --output-file sbom.json

# 验证 SBOM
cyclonedx-cli validate --input-file sbom.json --fail-on-errors

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "components": [
    {
      "type": "library",
      "name": "spring-boot",
      "version": "3.2.0",
      "purl": "pkg:maven/org.springframework.boot/spring-boot@3.2.0",
      "licenses": [{"license": {"id": "Apache-2.0"}}],
      "hashes": [{"alg": "SHA-256", "content": "..."}]
    }
  ]
}

# 安装
pip install checkov

# 扫描 Terraform
checkov -d ./terraform --framework terraform --output json

# 仅检查特定规则
checkov -d ./terraform --check CKV_AWS_1,CKV_AWS_2

# 安装
docker pull kubesec/kubesec:latest

# 扫描 K8s 资源
docker run -i kubesec/kubesec:latest scan /dev/stdin < pod.yaml

# Helm 安装
helm repo add fairwinds-stable https://charts.fairwinds.com/stable
helm install polaris fairwinds-stable/polaris --namespace polaris --create-namespace

# CLI 扫描
polaris audit --audit-path ./k8s-manifests/

# git-secrets：防止将敏感信息提交到仓库
git secrets --install
git secrets --register-aws
git secrets --scan

# Trivy：容器镜像中的硬编码密钥扫描
trivy image --scanners secret myapp:latest

# truffleHog：深度密钥扫描
truffleHog filesystem --directory=. --only-verified

# .github/workflows/security-pipeline.yml
name: Full Security Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  # Stage 1: Secret Detection
  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD
          extra_args: --debug --only-verified

  # Stage 2: SAST
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Semgrep Scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/cwe-top-25
            p/security-audit
      
      - name: SonarQube Scan
        uses: sonarqube-quality-gate-action@master
        with:
          scanMetadataReportFile: .sonarqube/out/.sonar/report-task.txt

  # Stage 3: SCA
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Snyk Test
        uses: snyk/actions/node@master
        with:
          args: --severity-threshold=high
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      
      - name: Generate SBOM
        run: |
          npm install -g @cyclonedx/cyclonedx-npm
          cyclonedx-npm --output-file sbom.json
      
      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

  # Stage 4: Build & Image Scan
  build-scan:
    runs-on: ubuntu-latest
    needs: [secret-scan, sast, sca]
    steps:
      - uses: actions/checkout@v4
      
      - name: Build Image
        run: docker build -t myapp:${{ github.sha }} .
      
      - name: Trivy Image Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: sarif
          output: trivy-image-results.sarif
      
      - name: Upload Image Scan Results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: trivy-image-results.sarif

  # Stage 5: DAST (on staging after deploy)
  dast:
    runs-on: ubuntu-latest
    needs: build-scan
    if: github.ref == 'refs/heads/main'
    steps:
      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.10.0
        with:
          target: 'https://staging.example.com'
          rules_file_name: '.zap/rules.tsv'

# Semgrep 增量扫描
semgrep --diff-aware --baseline-commit=origin/main

# SonarQube PR 分析（只扫描变更）
sonar-scanner -Dsonar.pullrequest.key=$PR_NUMBER \
  -Dsonar.pullrequest.branch=$BRANCH_NAME \
  -Dsonar.pullrequest.base=main

# .github/workflows/compliance-audit.yml
name: Security Compliance Evidence

on:
  schedule:
    - cron: '0 2 * * 1'  # 每周一收集

jobs:
  collect-evidence:
    runs-on: ubuntu-latest
    steps:
      - name: Run Security Scans
        run: |
          semgrep --config=auto --json -o evidence/semgrep-$(date +%Y%m%d).json
          snyk test --json > evidence/snyk-$(date +%Y%m%d).json
          trivy fs --scanners vuln,secret,misconfig --format json -o evidence/trivy-$(date +%Y%m%d).json .

      - name: Generate SBOM
        run: |
          cyclonedx-npm --output-file evidence/sbom-$(date +%Y%m%d).json

      - name: Upload to Compliance Archive
        run: |
          aws s3 sync evidence/ s3://compliance-archive/security/$(date +%Y/%m/)