📋 第30课：依赖审计

npm audit
npm audit --audit-level=high
npm audit fix
npm audit fix --force

# 生成SBOM
npx @cyclonedx/cyclonedx-npm -o sbom.json

# Snyk深度扫描
npm install -g snyk
snyk auth 
snyk test --severity-threshold=high
snyk monitor

# 安全策略
cat > .npmrc << 'EOF'
audit=true
audit-level=high
ignore-scripts=true
package-lock=true
EOF

pip install pip-audit safety cyclonedx-bom
pip-audit -r requirements.txt
pip-audit --desc
safety check -r requirements.txt

# 生成SBOM
cyclonedx-py requirements -i requirements.txt -o sbom.json

# Poetry
poetry show --outdated

cat > .github/workflows/dependency-scan.yml << 'EOF'
name: Dependency Audit
on:
  schedule: [{cron: '0 6 * * 1'}]  # 每周一
  pull_request: {paths: ['package-lock.json', 'requirements.txt']}
jobs:
  npm-audit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-node@v4
      with: {node-version: '20'}
    - run: npm ci
    - run: npm audit --audit-level=high
    - run: npx @cyclonedx/cyclonedx-npm -o sbom.json

  python-audit:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - run: |
        pip install pip-audit safety cyclonedx-bom
        pip-audit -r requirements.txt
        safety check -r requirements.txt
        cyclonedx-py requirements -i requirements.txt -o sbom.json
EOF