如何Build 安全 CI/CD Pipeline
Design CI/CD pipeline 具有安全 gates 在每个阶段: 依赖 scanning, SAST, DAST, secret 检测, 和 artifact 签名.
问题
你的 CI/CD pipeline deploys 代码无 安全 checks, allowing vulnerabilities, secrets, 和 malicious dependencies 到 reach production. 你需要integrate 安全 gates 遍及 pipeline 该阻止不安全 builds.
前置条件
- Understanding 的 CI/CD concepts (构建, 测试, deploy 阶段)
- 熟悉静态和 动态分析 tools
- Knowledge 的依赖管理和 supply 链接 risks
步骤
-
1. Secure the source and dependencies
Enforce branch protection: require PR reviews, signed commits, and status checks before merge. On every PR, scan dependencies for known vulnerabilities (CVE database) and license compliance. Use lockfiles (package-lock.json, pnpm-lock.yaml) to pin exact versions and detect supply chain attacks. Verify package signatures and provenance (SLSA levels). Fail the build if critical vulnerabilities are found. Use the config validator and file hash tools to verify integrity.
输入pull request with new dependency输出scan: 2 CVEs found (1 critical) | status: BLOCKED -
2. Integrate static and dynamic analysis
Run SAST (Static Application Security Testing) on every commit to detect code-level vulnerabilities: SQL injection, XSS, hardcoded secrets, insecure crypto. Run DAST (Dynamic Application Security Testing) against the staging deployment to find runtime vulnerabilities. Run SCA (Software Composition Analysis) for third-party dependencies. Configure tools to fail the build on critical/high findings. Use the JS linter, SQL validator, and regex tools for code quality checks.
输入source code commit输出SAST: 0 critical | DAST: 1 high (XSS in /search) | status: BLOCKED -
3. Implement secret scanning and management
Scan the repository for leaked secrets: API keys, passwords, private keys, tokens. Use pre-commit hooks to prevent secrets from being committed. Store secrets in a secrets manager (Vault, AWS Secrets Manager), injected as environment variables at build/runtime — never in the repo or CI config. Rotate secrets automatically. Use the env parser and hash-compare tools to manage and verify secrets. If a secret is detected, fail the build and alert the security team.
输入commit containing API key输出secret scan: 1 secret detected (AWS key) | status: BLOCKED | alert sent -
4. Sign artifacts and enforce deployment gates
Sign build artifacts (containers, binaries) with a build-system signing key (Sigstore/cosign, GPG). Generate SBOM (Software Bill of Materials) for each build. Enforce deployment gates: only signed artifacts from the main branch, passing all security checks, can deploy to production. Use progressive deployment (canary) with automated rollback on error rate spikes. Audit all pipeline steps immutably. Use the file hash and timestamp tools for artifact verification.
输入build artifact: app-v1.2.3.tar输出signature: cosign sign | SBOM: generated | gate: PASS -> deploy
预期结果
CI/CD pipeline where 每个构建是 scanned 为 vulnerabilities, secrets, 和依赖 risks, 具有 signed artifacts 和部署 gates 该 prevent 不安全代码从 reaching production.
常见错误
- Security scans that don't fail the build
- Configure scanners to exit non-zero on critical/high findings. A scan that only reports but doesn't block is ineffective. Use quality gates with thresholds.
- Storing secrets in CI environment variables or repo
- Use a secrets manager (Vault, AWS SM) with short-lived credentials injected at runtime. CI env vars are often visible in logs and to anyone with repo access.
- Skipping security scans for speed
- Run fast checks (SAST, secret scan) on every PR, slower checks (DAST, full dependency scan) on merge to main or nightly. Never skip for speed — optimize the tools instead.
排障指引
- If SAST produces too many false positives, tune the rules and establish a baseline of accepted findings, then fail only on new issues.
- If dependency scanning is slow, use incremental scanning (only changed dependencies) and cache the vulnerability database.
- For monorepos, run pipeline stages only for affected packages to balance security coverage with build speed.
安全限制
- CI/CD security gates reduce but do not eliminate risk — zero-days and novel attack vectors may bypass known-pattern scanners.
- All secret management happens in the secrets manager; the pipeline never logs or stores secrets in plaintext.
- The pipeline itself is a high-value target — secure the CI system with MFA, least privilege, and audit logging.