# DevSecOps流水线示例

1. 代码提交
– 代码版本控制（Git）
– 预提交钩子（Pre-commit hooks）

2. 构建阶段
– 代码编译
– 依赖分析
– 静态代码分析（SAST）

3. 测试阶段
– 单元测试
– 集成测试
– 动态应用安全测试（DAST）
– 容器安全扫描

4. 部署阶段
– 基础设施即代码（IaC）扫描
– 配置安全扫描
– 部署到测试环境

5. 监控阶段
– 运行时安全监控
– 漏洞管理
– 合规审计

# Jenkinsfile示例
pipeline {
agent any
stages {
stage(‘Checkout’) {
steps {
git branch: ‘master’, url: ‘https://github.com/fgedu/myapp.git’
}
}
stage(‘Static Code Analysis’) {
steps {
sh ‘sonar-scanner’
}
}
stage(‘Dependency Analysis’) {
steps {
sh ‘dependency-check –project “MyApp” –scan ./’
}
}
stage(‘Build’) {
steps {
sh ‘mvn clean package’
}
}
stage(‘Container Build’) {
steps {
sh ‘docker build -t fgedu/myapp:${BUILD_NUMBER} .’
}
}
stage(‘Image Scanning’) {
steps {
sh ‘trivy image fgedu/myapp:${BUILD_NUMBER}’
}
}
stage(‘Dynamic Security Testing’) {
steps {
sh ‘zap-cli quick-scan –self-contained –start-options “-config api.disablekey=true” http://fgedudb:8080’
}
}
stage(‘Deploy to Test’) {
steps {
sh ‘kubectl apply -f k8s/test-deployment.yaml’
}
}
stage(‘Security Validation’) {
steps {
sh ‘inspec exec security-profile’
}
}
stage(‘Deploy to Production’) {
steps {
sh ‘kubectl apply -f k8s/production-deployment.yaml’
}
}
}
post {
success {
echo ‘Build successful!’
}
failure {
echo ‘Build failed!’
}
}
}

# .github/workflows/devsecops.yml
name: DevSecOps Pipeline

on:
push:
branches: [ main ]
pull_request:
branches: [ main ]

jobs:
build:
runs-on: ubuntu-latest
steps:
– uses: actions/checkout@v2

– name: Set up JDK 11
uses: actions/setup-java@v2
with:
java-version: ’11’
distribution: ‘adopt’

– name: Build with Maven
run: mvn clean package

– name: Static Code Analysis
uses: SonarSource/sonarcloud-github-action@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

– name: Dependency Check
uses: dependency-check/Dependency-Check_Action@main
with:
project: ‘MyApp’
path: ‘.’
format: ‘HTML’

– name: Build Docker Image
run: docker build . –file Dockerfile –tag myapp:${{ github.sha }}

– name: Scan Docker Image
uses: aquasecurity/trivy-action@master
with:
image-ref: ‘myapp:${{ github.sha }}’
format: ‘table’
exit-code: ‘1’

– name: Deploy to Kubernetes
if: github.event_name == ‘push’ && github.ref == ‘refs/heads/main’
run: |
echo ${{ secrets.KUBE_CONFIG }} | base64 -d > kubeconfig
kubectl –kubeconfig=kubeconfig apply -f k8s/deployment.yaml

更多学习教程www.fgedu.net.cn

4. DevSecOps工具链

4.1 代码安全工具

• SonarQube：静态代码分析
• Checkmarx：静态代码分析
• Fortify：静态代码分析
• ESLint：JavaScript代码分析
• Pylint：Python代码分析

4.2 依赖分析工具

• OWASP Dependency-Check：依赖分析
• Snyk：依赖分析
• WhiteSource：依赖分析
• Retire.js：JavaScript依赖分析

4.3 容器安全工具

• Trivy：容器镜像扫描
• Clair：容器镜像漏洞扫描
• Docker Bench for Security：Docker安全检查
• Aqua Security：容器安全平台

4.4 动态安全测试工具

• OWASP ZAP：动态应用安全测试
• Burp Suite：Web应用安全测试
• Acunetix：Web应用安全测试
• Nmap：网络扫描

4.5 基础设施安全工具

• Terraform Sentinel：基础设施即代码安全
• Checkov：基础设施即代码扫描
• InSpec：安全合规测试
• Ansible：配置管理

author:www.itpux.com

5. 安全自动化

5.1 自动化安全测试

# 自动化安全测试脚本
#!/bin/bash

# 静态代码分析
echo “Running static code analysis…”
sonar-scanner

# 依赖分析
echo “Running dependency analysis…”
dependency-check –project “MyApp” –scan ./

# 容器镜像扫描
echo “Scanning container image…”
docker build -t myapp:latest .
trivy image myapp:latest

# 动态安全测试
echo “Running dynamic security testing…”
docker run -d -p 8080:8080 myapp:latest
sleep 5
zap-cli quick-scan –self-contained –start-options “-config api.disablekey=true” http://fgedudb:8080
docker stop $(docker ps -q –filter ancestor=myapp:latest)

# 基础设施即代码扫描
echo “Scanning infrastructure as code…”
checkov -d ./terraform

# 自动化安全响应脚本
#!/bin/bash

# 检查漏洞扫描结果
if grep -q “HIGH” vulnerability-report.txt; then
echo “High severity vulnerabilities found!”
# 发送告警
curl -X POST -H “Content-Type: application/json” \
-d ‘{“text”: “High severity vulnerabilities found in MyApp!”}’ \
https://hooks.slack.com/services/YOUR_SLACK_WEBHOOK_URL
# 阻止部署
exit 1
else
echo “No high severity vulnerabilities found.”
# 继续部署
kubectl apply -f k8s/deployment.yaml
fi

# 自动化合规扫描脚本
#!/bin/bash

# 运行合规扫描
echo “Running compliance scan…”
inspec exec compliance-profile

# 生成合规报告
echo “Generating compliance report…”
inspec exec compliance-profile –reporter json:compliance-report.json

# 检查合规状态
if grep -q “failed” compliance-report.json; then
echo “Compliance check failed!”
exit 1
else
echo “Compliance check passed.”
fi

更多学习教程公众号风哥教程itpux_com

6. 安全集成

6.1 代码集成

# 预提交钩子配置
#!/bin/sh

# 运行代码格式化
echo “Running code formatter…”
go fmt ./…

# 运行静态代码分析
echo “Running static code analysis…”
golangci-lint run

# 运行单元测试
echo “Running unit tests…”
go test ./…

# 构建脚本
#!/bin/bash

# 构建应用
echo “Building application…”
mvn clean package

# 运行安全测试
echo “Running security tests…”

# 静态代码分析
sonar-scanner

# 依赖分析
dependency-check –project “MyApp” –scan ./

# 容器构建
docker build -t myapp:latest .

# 容器镜像扫描
trivy image myapp:latest

# 部署脚本
#!/bin/bash

# 检查环境变量
if [ -z “$ENVIRONMENT” ]; then
echo “Error: ENVIRONMENT not set”
exit 1
fi

# 部署到测试环境
if [ “$ENVIRONMENT” = “test” ]; then
echo “Deploying to test environment…”
kubectl apply -f k8s/test-deployment.yaml

# 运行安全验证
echo “Running security validation…”
inspec exec security-profile

# 部署到生产环境
elif [ “$ENVIRONMENT” = “production” ]; then
echo “Deploying to production environment…”
kubectl apply -f k8s/production-deployment.yaml

# 运行合规检查
echo “Running compliance check…”
inspec exec compliance-profile
else
echo “Error: Invalid environment”
exit 1
fi