ci-cd パイプラインのセキュリティ: DevSecOps 実践ガイド

# pre-commit フックの設定例
repos:
  - repo: https:--github.com-gitleaks-gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
        name: Detect hardcoded secrets

  - repo: https:--github.com-hadolint-hadolint
    rev: v2.12.0
    hooks:
      - id: hadolint-docker
        name: Lint Dockerfile

# GitHub Actions での Shift-Left セキュリティ
security-checks:
  runs-on: ubuntu-latest
  steps:
    - uses: actions-checkout@v4

    - name: SAST - SonarQube Scan
      uses: SonarSource/sonarqube-scan-action@master
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
        SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

    - name: Secrets Detection
      uses: gitleaks/gitleaks-action@v2
      env:
        GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

    - name: Dependency Check
      uses: dependency-check/Dependency-Check_Action@main
      with:
        path: '.'
        format: 'SARIF'

    - name: SCA Scan
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        severity: 'CRITICAL,HIGH'

    - name: Container Image Scan
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: 'ghcr.io/your-org/app:${{ github.sha }}'
        format: 'sarif'
        severity: 'CRITICAL,HIGH'
        exit-code: '1'

# Kubernetes マニフェストとHelmチャートのスキャン
trivy config ./k8s-manifests/
kubescape scan framework nsa ./helm-charts/
checkov -d ./terraform/

# Cosign でイメージに署名（キーレス署名）
cosign sign --yes ghcr.io/your-org/app@sha256:abc123

# 署名の検証
cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "https://github.com/your-org/" \
  ghcr.io/your-org/app@sha256:abc123

    - name: Generate SBOM
      uses: anchore/sbom-action@v0
      with:
        image: ghcr.io/your-org/app:${{ github.sha }}
        format: spdx-json
        output-file: sbom.spdx.json

    - name: Attest SBOM
      uses: actions/attest-sbom@v1
      with:
        subject-name: ghcr.io/your-org/app
        subject-digest: sha256:abc123
        sbom-path: sbom.spdx.json

# 特権コンテナの禁止ポリシー
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sPSPPrivilegedContainer
metadata:
  name: deny-privileged
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    exemptImages:
      - "istio-proxyv2:*"

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-signed-images
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io-your-org-*"
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/your-org/*"
                    issuer: "https://token.actions.githubusercontent.com"

# Falco によるランタイムセキュリティ監視
- rule: Unexpected Network Connection
  desc: Detect network connections to unexpected destinations
  condition: >
    outbound and not (fd.sip in (allowed_outbound_destinations))
  output: >
    Unexpected outbound connection
    (command=%proc.cmdline connection=%fd.name user=%user.name)
  priority: WARNING

    - name: Generate Attestation
      uses: actions/attest-build-provenance@v1
      with:
        subject-name: ghcr.io/your-org/app
        subject-digest: sha256:abc123