云原生安全工具链#

name: Secure CI/CD Pipeline

on:
  push:
    branches: [main]

jobs:
  security-scans:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      # 1. 代码安全扫描
      - name: SAST Scan
        uses: secureCodeBot/secureCodeBot-action@main
      
      # 2. 依赖检查
      - name: Dependency Check
        uses: snyk/actions/node@main
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      
      # 3. 镜像构建
      - name: Build and push
        run: |
          docker build -t ${{ env.IMAGE_NAME }}:${{ github.sha }} .
          docker push ${{ env.IMAGE_NAME }}:${{ github.sha }}
      
      # 4. 镜像扫描
      - name: Trivy Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ env.IMAGE_NAME }}:${{ github.sha }}'
          format: 'sarif'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'
      
      # 5. 镜像签名
      - name: Sign image
        uses: sigstore/cosign-installer@v3
        with:
          cosign-release: 'v2.2.0'
        run: |
          cosign sign --yes \
            --oidc-issuer https://oauth2.sigstore.dev/auth \
            ${{ env.IMAGE_NAME }}:${{ github.sha }}
      
      # 6. 生成 SBOM
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.IMAGE_NAME }}:${{ github.sha }}
          format: spdx-json
      
      # 7. 推送配置
      - name: Update Deployment
        run: |
          kubectl set image deployment/myapp \
            myapp=${{ env.IMAGE_NAME }}:${{ github.sha }}
          kubectl rollout status deployment/myapp

  compliance-check:
    needs: security-scans
    runs-on: ubuntu-latest
    steps:
      - name: Polaris Audit
        run: |
          polaris audit --audit-path ./deploy/ \
            --webhook-url https://opa-gatekeeper/validate
      
      - name: kube-bench
        uses: aquasec/kube-bench-action@v2
        with:
          targetVersion: "1.28"

# ArgoCD 应用程序配置
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
spec:
  source:
    repoURL: https://github.com/example/myapp
    targetRevision: main
    path: k8s/production
    kustomize:
      images:
        - myregistry.com/myapp:v1.0.0
  
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true

apiVersion: beat.k8s.elastic.co/v1beta1
kind: Beat
metadata:
  name: security-beat
  namespace: security-monitoring
spec:
  type: filebeat
  elasticsearchRef:
    clusterID: elasticsearch
  config:
    filebeat.inputs:
      - type: container
        paths:
          - /var/log/falco*.log
        processors:
          - add_kubernetes_metadata: {}
      - type: container
        paths:
          - /var/log/kubernetes/audit.log
        processors:
          - add_kubernetes_metadata: {}
    output.elasticsearch:
      hosts: ["elasticsearch:9200"]