🔍 第29课：安全扫描

# 安装Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# 扫描镜像
trivy image myregistry/myapp:v1.2.3
trivy image --severity HIGH,CRITICAL myregistry/myapp:v1.2.3
trivy image --format json --output trivy-report.json myregistry/myapp:v1.2.3

# CI门禁(发现CRITICAL则失败)
trivy image --exit-code 1 --severity CRITICAL myregistry/myapp:v1.2.3

# 扫描文件系统(代码依赖)
trivy fs --severity HIGH,CRITICAL ./

# 扫描IaC配置
trivy config ./terraform/

# 扫描K8s集群
trivy k8s --report summary cluster

docker run -d --name sonarqube -p 9000:9000 -v sonarqube-data:/opt/sonarqube/data sonarqube:community

# 创建项目+Token
curl -u admin:admin -X POST "http://localhost:9000/api/projects/create" -d "name=myapp&project=myapp"

# Maven扫描
mvn sonar:sonar -Dsonar.projectKey=myapp -Dsonar.host.url=http://localhost:9000 -Dsonar.login=

# 设置质量门禁
curl -u admin:admin -X POST "http://localhost:9000/api/qualitygates/create" -d "name=DevOps-Gate"
curl -u admin:admin -X POST "http://localhost:9000/api/qualitygates/create_condition" \
  -d "gateName=DevOps-Gate&metric=critical_violations&operator=GT&error=0"

# CI集成(扫描失败则构建失败)
mvn sonar:sonar -Dsonar.qualitygate.wait=true

cat > .github/workflows/security-scan.yml << 'EOF'
name: Security Scan
on: [push, pull_request]
jobs:
  trivy-container:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - run: docker build -t myapp:${{ github.sha }} .
    - uses: aquasecurity/trivy-action@master
      with: {image-ref: 'myapp:${{ github.sha }}', severity: 'CRITICAL,HIGH', exit-code: '1', format: 'sarif', output: 'trivy.sarif'}

  semgrep:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: returntocorp/semgrep-action@v1
      with: {config: 'p/security-audit p/secrets p/owasp-top-ten'}

  checkov-iac:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: bridgecrewio/checkov-action@master
      with: {directory: 'terraform/', framework: 'terraform'}
EOF