セキュアな CI/CD パイプラインを構築する方法

问题

CI/CD パイプラインがセキュリティチェックなしでコードをデプロイしているため、脆弱性、シークレット、悪意のある依存関係が本番環境に届いてしまいます。安全でないビルドをブロックするセキュリティゲートをパイプライン全体に組み込む必要があります。

前提条件

• CI/CD の概念（ビルド、テスト、デプロイの各段階）の理解
• 静的・動的解析ツールへの習熟
• 依存関係管理とサプライチェーンリスクに関する知識

ステップ

1. 1. Secure the source and dependencies

   Enforce branch protection: require PR reviews, signed commits, and status checks before merge. On every PR, scan dependencies for known vulnerabilities (CVE database) and license compliance. Use lockfiles (package-lock.json, pnpm-lock.yaml) to pin exact versions and detect supply chain attacks. Verify package signatures and provenance (SLSA levels). Fail the build if critical vulnerabilities are found. Use the config validator and file hash tools to verify integrity.

   入力

   pull request with new dependency

   输出

   scan: 2 CVEs found (1 critical) | status: BLOCKED

2. 2. Integrate static and dynamic analysis

   Run SAST (Static Application Security Testing) on every commit to detect code-level vulnerabilities: SQL injection, XSS, hardcoded secrets, insecure crypto. Run DAST (Dynamic Application Security Testing) against the staging deployment to find runtime vulnerabilities. Run SCA (Software Composition Analysis) for third-party dependencies. Configure tools to fail the build on critical/high findings. Use the JS linter, SQL validator, and regex tools for code quality checks.

   入力

   source code commit

   输出

   SAST: 0 critical | DAST: 1 high (XSS in /search) | status: BLOCKED

3. 3. Implement secret scanning and management

   Scan the repository for leaked secrets: API keys, passwords, private keys, tokens. Use pre-commit hooks to prevent secrets from being committed. Store secrets in a secrets manager (Vault, AWS Secrets Manager), injected as environment variables at build/runtime — never in the repo or CI config. Rotate secrets automatically. Use the env parser and hash-compare tools to manage and verify secrets. If a secret is detected, fail the build and alert the security team.

   入力

   commit containing API key

   输出

   secret scan: 1 secret detected (AWS key) | status: BLOCKED | alert sent

4. 4. Sign artifacts and enforce deployment gates

   Sign build artifacts (containers, binaries) with a build-system signing key (Sigstore/cosign, GPG). Generate SBOM (Software Bill of Materials) for each build. Enforce deployment gates: only signed artifacts from the main branch, passing all security checks, can deploy to production. Use progressive deployment (canary) with automated rollback on error rate spikes. Audit all pipeline steps immutably. Use the file hash and timestamp tools for artifact verification.

   入力

   build artifact: app-v1.2.3.tar

   输出

   signature: cosign sign | SBOM: generated | gate: PASS -> deploy

期待される結果

毎回のビルドで脆弱性、シークレット、依存関係のリスクをスキャンし、署名済みアーティファクトとデプロイゲートによって安全でないコードが本番環境に到達するのを防ぐ CI/CD パイプライン。

よくあるエラー

Security scans that don't fail the build

Configure scanners to exit non-zero on critical/high findings. A scan that only reports but doesn't block is ineffective. Use quality gates with thresholds.

Storing secrets in CI environment variables or repo

Use a secrets manager (Vault, AWS SM) with short-lived credentials injected at runtime. CI env vars are often visible in logs and to anyone with repo access.

Skipping security scans for speed

Run fast checks (SAST, secret scan) on every PR, slower checks (DAST, full dependency scan) on merge to main or nightly. Never skip for speed — optimize the tools instead.

トラブルシューティング指引

• If SAST produces too many false positives, tune the rules and establish a baseline of accepted findings, then fail only on new issues.
• If dependency scanning is slow, use incremental scanning (only changed dependencies) and cache the vulnerability database.
• For monorepos, run pipeline stages only for affected packages to balance security coverage with build speed.

セキュリティ上の制限

• CI/CD security gates reduce but do not eliminate risk — zero-days and novel attack vectors may bypass known-pattern scanners.
• All secret management happens in the secrets manager; the pipeline never logs or stores secrets in plaintext.
• The pipeline itself is a high-value target — secure the CI system with MFA, least privilege, and audit logging.