GitLab DevSecOps 完整實踐：安全掃描與程式碼佈署自動化

include:
  - template: Security/SAST.gitlab-ci.yml

variables:
  SAST_EXCLUDED_PATHS: "tests/,migrations/"
  SAST_EXCLUDED_ANALYZERS: "bandit,eslint"

stages:
  - build
  - test
  - security
  - deploy

compile_application:
  stage: build
  image: maven:3.8-openjdk-17
  script:
    - echo "開始編譯 Java 應用程式..."
    - mvn clean compile -DskipTests
    - echo "產生建構產物..."
    - mvn package -DskipTests
  artifacts:
    paths:
      - target/*.jar
    expire_in: 1 week
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - .m2/repository

unit_tests:
  stage: test
  image: maven:3.8-openjdk-17
  script:
    - echo "執行單元測試套件..."
    - mvn test
    - echo "產生測試覆蓋率報告..."
    - mvn jacoco:report
  artifacts:
    reports:
      junit: target/surefire-reports/TEST-*.xml
      coverage_report:
        coverage_format: cobertura
        path: target/site/jacoco/jacoco.xml
  coverage: '/Total.*?([0-9]{1,3})%/'
  dependencies:
    - compile_application

sast_security_scan:
  stage: security
  needs:
    - compile_application
  allow_failure: false
  before_script:
    - echo "準備靜態安全掃描環境..."
    - echo "掃描範圍: 排除測試與遷移檔案"
  script:
    - echo "開始深度程式碼安全分析..."
    - /analyzer run
  artifacts:
    reports:
      sast: gl-sast-report.json
    paths:
      - gl-sast-report.json
  rules:
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# 錯誤示範：敏感資訊直接寫在程式碼中
class DatabaseConnection:
    def __init__(self):
        self.config = {
            'host': 'prod-db.example.com',
            'port': 5432,
            'username': 'admin',
            'password': 'Sup3rS3cr3tP@ssw0rd',  # Secret Detection 會標記
            'database': 'production',
            'ssl_mode': 'require'
        }
    
    def connect(self):
        # 建立資料庫連線的邏輯
        pass

# 正確做法：從環境變數讀取敏感資訊
import os
from typing import Optional

class SecureDatabaseConnection:
    def __init__(self):
        self.config = {
            'host': os.getenv('DB_HOST', 'localhost'),
            'port': int(os.getenv('DB_PORT', '5432')),
            'username': os.getenv('DB_USER'),
            'password': os.getenv('DB_PASSWORD'),
            'database': os.getenv('DB_NAME'),
            'ssl_mode': os.getenv('DB_SSL_MODE', 'require')
        }
        
        self._validate_config()
    
    def _validate_config(self):
        """驗證必要的環境變數是否已設定"""
        required_vars = ['DB_USER', 'DB_PASSWORD', 'DB_NAME']
        missing_vars = [var for var in required_vars if not os.getenv(var)]
        
        if missing_vars:
            raise ValueError(
                f"缺少必要的環境變數: {', '.join(missing_vars)}"
            )
    
    def connect(self):
        """建立安全的資料庫連線"""
        try:
            # 實際的連線邏輯
            connection = self._create_connection()
            return connection
        except Exception as e:
            # 記錄錯誤但不洩漏敏感資訊
            print(f"資料庫連線失敗: {type(e).__name__}")
            raise

secret_detection:
  stage: security
  image: 
    name: registry.gitlab.com/gitlab-org/security-products/analyzers/secrets:latest
  script:
    - echo "開始掃描程式碼中的敏感資訊..."
    - /analyzer run
  artifacts:
    reports:
      secret_detection: gl-secret-detection-report.json
    paths:
      - gl-secret-detection-report.json
  allow_failure: false
  rules:
    - if: $CI_MERGE_REQUEST_IID
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
    - if: $CI_COMMIT_TAG
  variables:
    SECRET_DETECTION_EXCLUDED_PATHS: "tests/fixtures/,docs/"
    SECRET_DETECTION_HISTORIC_SCAN: "false"

variables:
  DAST_WEBSITE: "https://staging.example.com"
  DAST_AUTH_URL: "https://staging.example.com/login"
  DAST_USERNAME: "test_user"
  DAST_PASSWORD: ${DAST_TEST_PASSWORD}
  DAST_FULL_SCAN_ENABLED: "true"
  DAST_BROWSER_SCAN: "true"

deploy_staging:
  stage: deploy
  image: alpine:latest
  script:
    - echo "佈署應用程式到測試環境..."
    - apk add --no-cache curl
    - ./deploy_to_staging.sh
    - echo "等待應用程式啟動完成..."
    - sleep 30
    - |
      for i in {1..10}; do
        if curl -f ${DAST_WEBSITE}/health; then
          echo "應用程式已就緒"
          break
        fi
        echo "等待應用程式啟動 (嘗試 $i/10)..."
        sleep 10
      done
  environment:
    name: staging
    url: ${DAST_WEBSITE}
    on_stop: stop_staging

dast_full_scan:
  stage: security
  image:
    name: owasp/zap2docker-stable:latest
  variables:
    GIT_STRATEGY: none
  script:
    - mkdir -p /zap/wrk
    - echo "開始完整的動態安全掃描..."
    - echo "目標網站: ${DAST_WEBSITE}"
    - |
      zap-full-scan.py \
        -t ${DAST_WEBSITE} \
        -r dast-report.html \
        -J gl-dast-report.json \
        -a \
        --hook=/zap/auth_hook.py
    - echo "掃描完成，分析結果..."
  artifacts:
    paths:
      - dast-report.html
    reports:
      dast: gl-dast-report.json
    expire_in: 30 days
  dependencies:
    - deploy_staging
  allow_failure: true
  only:
    - merge_requests
    - schedules

dependency_scanning:
  stage: security
  image: 
    name: registry.gitlab.com/gitlab-org/security-products/analyzers/gemnasium:latest
  script:
    - echo "分析專案依賴套件安全性..."
    - /analyzer run
  artifacts:
    reports:
      dependency_scanning: gl-dependency-scanning-report.json
    paths:
      - gl-dependency-scanning-report.json
  allow_failure: false
  rules:
    - if: $CI_MERGE_REQUEST_IID
      changes:
        - package.json
        - package-lock.json
        - requirements.txt
        - Pipfile
        - Pipfile.lock
        - pom.xml
        - build.gradle
        - go.mod
        - go.sum
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

license_scanning:
  stage: security
  image:
    name: registry.gitlab.com/gitlab-org/security-products/analyzers/license-finder:latest
  script:
    - echo "掃描套件授權條款..."
    - /analyzer run
  artifacts:
    reports:
      license_scanning: gl-license-scanning-report.json
  allow_failure: true
  only:
    - merge_requests

# 不良實務：使用過時的基礎映像
FROM ubuntu:16.04
RUN apt-get update && apt-get install -y python3 python3-pip
COPY requirements.txt .
RUN pip3 install -r requirements.txt
COPY app.py .
CMD ["python3", "app.py"]

# 良好實務：使用最新的安全基礎映像
FROM ubuntu:22.04-slim AS base

# 建立非特權使用者
RUN groupadd -r appuser && useradd -r -g appuser appuser

# 更新系統套件並安裝必要元件
RUN apt-get update && \
    apt-get upgrade -y && \
    apt-get install -y --no-install-recommends \
        python3.10 \
        python3-pip && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# 建構階段：安裝依賴
FROM base AS builder
WORKDIR /build
COPY requirements.txt .
RUN pip3 install --user --no-cache-dir -r requirements.txt

# 執行階段：最小化映像
FROM base AS runtime
WORKDIR /app

# 從建構階段複製安裝的套件
COPY --from=builder /root/.local /root/.local
COPY --chown=appuser:appuser app.py .

# 使用非特權使用者執行
USER appuser

# 暴露應用程式埠
EXPOSE 8080

# 健康檢查
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD python3 -c "import requests; requests.get('http://localhost:8080/health')"

CMD ["python3", "app.py"]

build_container:
  stage: build
  image: docker:24-dind
  services:
    - docker:24-dind
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
    DOCKER_DRIVER: overlay2
  before_script:
    - echo $CI_REGISTRY_PASSWORD | docker login -u $CI_REGISTRY_USER --password-stdin $CI_REGISTRY
  script:
    - echo "建構 Docker 容器映像..."
    - docker build 
        --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')
        --build-arg VCS_REF=$CI_COMMIT_SHORT_SHA
        --build-arg VERSION=$CI_COMMIT_TAG
        --tag $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
        --tag $CI_REGISTRY_IMAGE:latest
        .
    - echo "推送映像到容器註冊表..."
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - docker push $CI_REGISTRY_IMAGE:latest
    - echo "產生映像清單..."
    - docker inspect $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA > image-manifest.json
  artifacts:
    paths:
      - image-manifest.json
    expire_in: 7 days
  after_script:
    - docker logout $CI_REGISTRY

container_scanning:
  stage: security
  image:
    name: registry.gitlab.com/gitlab-org/security-products/analyzers/container-scanning:latest
  variables:
    GIT_STRATEGY: none
    CS_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    CS_SEVERITY_THRESHOLD: "high"
  script:
    - echo "開始掃描容器映像: ${CS_IMAGE}"
    - gtcs scan
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
    paths:
      - gl-container-scanning-report.json
  dependencies:
    - build_container
  allow_failure: false

iac_security_scan:
  stage: security
  image:
    name: bridgecrew/checkov:latest
    entrypoint: [""]
  script:
    - echo "掃描 Terraform 基礎設施定義..."
    - checkov -d terraform/ 
        --framework terraform
        --output json
        --output-file gl-iac-report.json
        --soft-fail
    - echo "掃描 Kubernetes 設定檔..."
    - checkov -d k8s/
        --framework kubernetes
        --output json
        --output-file gl-k8s-report.json
        --soft-fail
  artifacts:
    reports:
      sast: gl-iac-report.json
    paths:
      - gl-iac-report.json
      - gl-k8s-report.json
  allow_failure: true
  only:
    changes:
      - terraform/**/*
      - k8s/**/*