70% 误报率降到 5%：CI/CD 安全门禁的四层防御与误报治理实录

# 扫描 Docker 镜像
trivy image --severity HIGH,CRITICAL myapp:latest

# 扫描 IaC 文件（Terraform/K8s/CloudFormation/Dockerfile）
trivy config --severity HIGH,CRITICAL ./infrastructure/

# 输出 SARIF 格式（统一报告格式，后面会讲为什么）
trivy image --format sarif -o trivy-report.sarif myapp:latest

# Gitleaks 扫描整个仓库
gitleaks detect --source . --report-format json -o gitleaks-report.json

# 只扫描当前 commit 的变更
gitleaks detect --source . --report-format json -o gitleaks-report.json --log-opts HEAD~1..HEAD

<!-- 自定义 Quality Profile：只保留安全相关规则 -->
<profile>
  <name>security-focused</name>
  <language>java</language>
  <rules>
    <!-- 启用所有 OWASP Top 10 相关规则 -->
    <rule>
      <repositoryKey>java</repositoryKey>
      <key>S2077</key> <!-- SQL Injection -->
      <priority>CRITICAL</priority>
    </rule>
    <rule>
      <repositoryKey>java</repositoryKey>
      <key>S5131</key> <!-- XSS -->
      <priority>CRITICAL</priority>
    </rule>
    <!-- 关闭噪音规则 -->
    <rule>
      <repositoryKey>java</repositoryKey>
      <key>S1186</key> <!-- 方法参数不超过 7 个 -->
      <severity>0</severity> <!-- 禁用 -->
    </rule>
  </rules>
</profile>

# semgrep-config.yml — 只启用安全和密钥泄露规则
rules:
  - include: "p/security-audit"
  - include: "p/secret-detection"
  - include: "p/java"
  # 排除代码风格规则
  - exclude: "p/java/code-style"

# 生成基线快照（一次性操作）
sonar-scanner -Dsonar.qualitygate.wait=true \
  -Dsonar.analysis.mode=preview \
  -Dsonar.newCode.period=reference_branch \
  -Dsonar.newCode.reference=main

# Quality Gate 条件
New Critial Issues > 0 → FAIL
New Blocker Issues > 0 → FAIL
# 不检查 Overall Code（存量）

# 只报告当前 commit 引入的新告警
semgrep --config p/security-audit --diff --baseline=main .

# GitLab CI — 误报标记阶段
mark-false-positive:
  stage: review
  script:
    - |
      # 检查 MR 评论中是否有 #false-positive 标记
      MR_COMMENTS=$(curl --header "PRIVATE-TOKEN: $GITLAB_TOKEN" \
        "$CI_API_V4_URL/projects/$CI_PROJECT_ID/merge_requests/$CI_MERGE_REQUEST_IID/notes")
      
      if echo "$MR_COMMENTS" | grep -q "#false-positive"; then
        echo "检测到误报标记，提取规则ID..."
        RULE_IDS=$(echo "$MR_COMMENTS" | grep -oP 'rule:(\S+)' | awk -F: '{print $2}')
        
        for RULE_ID in $RULE_IDS; do
          # 添加到项目级抑制列表
          echo "$RULE_ID" >> .semgrep-suppressions.txt
          echo "已抑制规则: $RULE_ID"
        done
        
        # 提交抑制列表
        git config user.email "security-bot@company.com"
        git config user.name "Security Bot"
        git add .semgrep-suppressions.txt
        git commit -m "chore: suppress false positive rules"
        git push origin HEAD:$CI_COMMIT_REF_NAME
      fi      
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

# 使用 --suppress 参数加载抑制列表
semgrep --config p/security-audit --suppress .semgrep-suppressions.txt .

#!/bin/bash
# security-gate.sh — 安全质量门禁检查
# 依赖：jq（JSON 解析）、各扫描器报告文件

set -euo pipefail

CRITICAL_THRESHOLD=0
HIGH_THRESHOLD=0  # L1门禁：Critical和High都阻断

# 收集各扫描器的 Critical/High 数量
CRITICAL_COUNT=0
HIGH_COUNT=0

# 解析 Semgrep 报告（JSON格式）
if [ -f semgrep-report.json ]; then
  CRITICAL_COUNT=$((CRITICAL_COUNT + $(jq '[.results[] | select(.extra.severity == "ERROR")] | length' semgrep-report.json)))
  HIGH_COUNT=$((HIGH_COUNT + $(jq '[.results[] | select(.extra.severity == "WARNING")] | length' semgrep-report.json)))
fi

# 解析 Trivy 镜像扫描报告（JSON格式）
if [ -f trivy-image-report.json ]; then
  CRITICAL_COUNT=$((CRITICAL_COUNT + $(jq '[.Results[].Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' trivy-image-report.json)))
  HIGH_COUNT=$((HIGH_COUNT + $(jq '[.Results[].Vulnerabilities[]? | select(.Severity == "HIGH")] | length' trivy-image-report.json)))
fi

# 解析 Gitleaks 密钥泄露报告（JSON格式）
if [ -f gitleaks-report.json ]; then
  SECRET_COUNT=$(jq '[.[]] | length' gitleaks-report.json)
  CRITICAL_COUNT=$((CRITICAL_COUNT + SECRET_COUNT))
fi

echo "=== 安全扫描结果 ==="
echo "Critical 漏洞: $CRITICAL_COUNT"
echo "High 漏洞: $HIGH_COUNT"
echo "密钥泄露: ${SECRET_COUNT:-0}"
echo "========================"

# L1 门禁判断
if [ $CRITICAL_COUNT -gt $CRITICAL_THRESHOLD ]; then
  echo "❌ L1 门禁未通过：发现 $CRITICAL_COUNT 个 Critical 级别问题"
  echo "请修复后重新提交 MR"
  exit 1
fi

if [ $HIGH_COUNT -gt $HIGH_THRESHOLD ]; then
  echo "❌ L1 门禁未通过：发现 $HIGH_COUNT 个 High 级别问题"
  echo "请修复后重新提交 MR"
  exit 1
fi

echo "✅ 安全门禁通过"
exit 0

# .gitlab-ci.yml — 安全扫描流水线
stages:
  - test
  - scan
  - gate

variables:
  # 扫描器版本锁定
  SEMGREP_VERSION: "1.52.0"
  TRIVY_VERSION: "0.49.1"
  GITLEAKS_VERSION: "8.18.1"

# SAST 扫描（Semgrep 增量扫描）
semgrep-sast:
  stage: scan
  image: returntocorp/semgrep:${SEMGREP_VERSION}
  script:
    # 只扫描 MR diff 中的文件，全量扫描放在定时任务
    - |
      if [ -n "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME" ]; then
        semgrep --config p/security-audit \
          --config p/secret-detection \
          --diff --baseline=$CI_MERGE_REQUEST_TARGET_BRANCH_NAME \
          --json -o semgrep-report.json .
      else
        # 非 MR 场景（如 main 分支推送），全量扫描
        semgrep --config p/security-audit \
          --json -o semgrep-report.json .
      fi      
  artifacts:
    reports:
      reports: semgrep-report.json
    paths:
      - semgrep-report.json
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

# SCA + 容器镜像扫描（Trivy）
trivy-scan:
  stage: scan
  image: aquasec/trivy:${TRIVY_VERSION}
  script:
    # 先构建镜像（简化示例，实际中用 Kaniko 或 Docker-in-Docker）
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    
    # 扫描镜像漏洞
    - trivy image --format json -o trivy-image-report.json \
        --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
    
    # 扫描 IaC 配置文件
    - trivy config --format json -o trivy-config-report.json \
        --severity HIGH,CRITICAL ./infrastructure/
  artifacts:
    paths:
      - trivy-image-report.json
      - trivy-config-report.json
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

# 密钥泄露检测（Gitleaks 增量扫描）
gitleaks-secrets:
  stage: scan
  image: zricethezav/gitleaks:${GITLEAKS_VERSION}
  script:
    - |
      if [ -n "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME" ]; then
        # MR 增量扫描
        gitleaks detect --source . \
          --report-format json -o gitleaks-report.json \
          --log-opts "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME..HEAD"
      else
        # 全量扫描
        gitleaks detect --source . \
          --report-format json -o gitleaks-report.json
      fi      
  artifacts:
    paths:
      - gitleaks-report.json
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

# 安全质量门禁
security-gate:
  stage: gate
  image: alpine:3.19
  needs:
    - job: semgrep-sast
      optional: true
    - job: trivy-scan
      optional: true
    - job: gitleaks-secrets
      optional: true
  before_script:
    - apk add --no-cache jq bash
  script:
    - bash scripts/security-gate.sh
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == "main"

# Semgrep 原生支持 SARIF 输出
semgrep --config p/security-audit --sarif -o semgrep.sarif .

# Trivy 原生支持 SARIF 输出
trivy image --format sarif -o trivy.sarif myapp:latest

# SonarQube 通过 API 导出 SARIF
curl "$SONAR_HOST/api/issues/search?componentKeys=$PROJECT_KEY&format=sarif" \
  -o sonar.sarif

# GitLab CI — SARIF 报告渲染
semgrep-sast:
  artifacts:
    reports:
      reports: semgrep.sarif  # GitLab 会自动渲染到 MR

# 解决方案：排除自动生成文件
sonar-scanner \
  -Dsonar.exclusions="**/generated/**,**/*.pb.go,**/pb_*" \
  -Dsonar.cpd.exclusions="**/generated/**" \
  -Dsonar.coverage.exclusions="**/generated/**"

# 方案：在内网镜像服务器上定期同步 Trivy 数据库
# 在有外网的机器上执行
trivy --download-db-only

# 把数据库文件拷贝到 CI Runner
# /root/.cache/trivy/db/trivy.db

# CI 中使用 --skip-db-update 跳过在线更新
trivy image --skip-db-update --severity HIGH,CRITICAL myapp:latest

# crontab — 每天凌晨 3 点同步 Trivy 数据库
0 3 * * * rsync -avz /root/.cache/trivy/db/ ci-internal-server:/data/trivy-db/

# 错误规则：过于宽泛
rules:
  - id: dangerous-exec
    patterns:
      - pattern: exec($X)
    message: "检测到 exec 调用，可能存在命令注入风险"
    severity: ERROR

# 正确规则：排除测试文件和已知安全调用
rules:
  - id: dangerous-exec
    patterns:
      - pattern: exec($X)
      - pattern-not-either:
          - pattern: subprocess.run(...)  # subprocess.run 是安全的
          - pattern: exec(open("...").read())  # 已知的安全模式
    paths:
      exclude:
        - "tests/**"
        - "*_test.go"
        - "**/testdata/**"
    message: "检测到 exec 调用，可能存在命令注入风险"
    severity: ERROR

# .gitlab-ci.yml — 按环境分级门禁
security-gate-test:
  extends: security-gate-base
  variables:
    CRITICAL_THRESHOLD: 0  # 测试环境：密钥泄露仍阻断
    HIGH_THRESHOLD: 999    # High 漏洞不阻断
  rules:
    - if: $CI_COMMIT_BRANCH =~ /^feature\//
    - if: $CI_COMMIT_BRANCH =~ /^develop$/

security-gate-prod:
  extends: security-gate-base
  variables:
    CRITICAL_THRESHOLD: 0
    HIGH_THRESHOLD: 0     # 生产环境：High 也阻断
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^release\//

# 每日全量扫描（凌晨 2 点）
scheduled-full-scan:
  stage: scan
  script:
    - semgrep --config p/security-audit --json -o full-scan-report.json .
    - # 上传到安全 Dashboard
    - curl -X POST "$SECURITY_DASHBOARD/api/reports" \
        -H "Content-Type: application/json" \
        -d @full-scan-report.json
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"

# 扫描全量 Git 历史
gitleaks detect --source . --log-opts="--all" --report-format json -o history-leaks.json

# 如果发现历史泄露，需要用 git-filter-repo 清理
pip install git-filter-repo
git filter-repo --invert-paths --path-separator config/secrets.yml
git push --force origin main