DevSecOps Pipeline Setup

Problème

La sécurité est testée manuellement en fin de cycle, ce qui laisse passer des vulnérabilités en production.

Solution

Pipeline CI/CD avec sécurité automatisée à chaque étape (shift-left).

Pipeline type (GitHub Actions)

# .github/workflows/security.yml
name: Security Pipeline
on: [push, pull_request]

jobs:
  secret-scanning:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - name: Trufflehog
        uses: trufflesecurity/trufflehog@main
        with:
          path: .

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: "p/owasp-top-ten"

  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Trivy
        run: |
          trivy fs --severity HIGH,CRITICAL .
          trivy fs --format cyclonedx --output sbom.json .

  dast:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: OWASP ZAP Baseline
        uses: zaproxy/action-baseline@v0.13.0
        with:
          target: 'https://staging.example.com'

  container-scanning:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - name: Build
        run: docker build -t app .
      - name: Trivy Container
        run: trivy image --severity HIGH,CRITICAL app

Outils par étape

Pre-commit hooks

# .git/hooks/pre-commit
#!/bin/sh
detect-secrets scan --staged
semgrep --config p/owasp-top-ten --error

Références

• [[KNOW-REF-048]] — OWASP DevSecOps Guideline
• [[KNOW-REF-049]] — OWASP DevGuard
• [[KNOW-REF-055]] — DSOVS
• [[KNOW-REF-056]] — SPVS
• [[KNOW-PAT-220]] — Secure SDLC Checklist
• [[KNOW-PAT-225]] — Secrets Management