DevSecOps 파이프라인: CI/CD에 보안 게이트 넣기

코드 → SAST → SCA → 빌드 → 이미지 스캔 → DAST → 배포 → 런타임 모니터링

name: Security Scan
on: [push, pull_request]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        uses: semgrep/semgrep-action@v1
        with:
          config: p/owasp-top-ten
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript, python
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

  sca:
    steps:
      - name: Snyk Security Scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      - name: Trivy 취약점 스캔
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: my-app:${{ github.sha }}
          exit-code: '1'
          severity: 'HIGH,CRITICAL'

      - name: TruffleHog Secrets Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}

      - name: OWASP ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: 'https://staging.myapp.com'
          fail_action: true

      - name: Checkov IaC Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ./terraform
          framework: terraform

# 로컬에서 CI와 같은 스캔 재현
semgrep ci --config auto               # SAST
trivy fs --severity HIGH,CRITICAL .    # 의존성·설정
gitleaks detect --source . --redact    # 비밀값
# 의존성 경고가 실제로 사용되는 패키지인지 확인
npm ls <package>    # 또는 pip show <package>

# 개념 예: PR에서 Trivy
- name: trivy fs
  run: trivy fs --exit-code 1 --severity HIGH,CRITICAL .