DevSecOps Pipeline

Eine DevSecOps-Pipeline automatisiert Sicherheitsprüfungen in allen Phasen des Software-Entwicklungszyklus. Das Ziel: Schwachstellen frühzeitig finden (billiger zu fixen) und kein unsicherer Code in Produktion deployen.

Pipeline-Architektur

Stage 1 - Pre-Commit (Developer-Workstation):

• Semgrep/Bandit: SAST im IDE oder pre-commit Hook
• gitleaks: Secrets-Scan (kein API-Key im Commit!)

#!/bin/bash
semgrep --config=p/security --error .
gitleaks detect --source . --exit-code 1

Stage 2 - Build (CI, z.B. GitLab CI):

sast-scan:
  image: returntocorp/semgrep
  script:
    - semgrep --config=p/owasp-top-ten --json > semgrep.json
  artifacts:
    reports:
      sast: semgrep.json

sca-scan:
  image: node:20
  script:
    - npm audit --json > npm-audit.json
    - npx snyk test --json > snyk.json
  allow_failure: false  # Bei Critical: Pipeline stop!

container-scan:
  image: aquasec/trivy
  script:
    - trivy image --exit-code 1 --severity CRITICAL $IMAGE

Stage 3 - Test (Staging):

dast-scan:
  script:
    - docker run owasp/zap2docker-stable zap-baseline.py
        -t https://staging.example.com
        -r zap-report.html
        --exit-code 1  # Bei HIGH: Pipeline stop!

Stage 4 - Deploy (Production):

iac-scan:
  image: bridgecrew/checkov
  script:
    - checkov -d ./terraform --framework terraform
        --hard-fail-on HIGH,CRITICAL

Security Gate-Logik:

Schweregrad	Aktion
CRITICAL	Pipeline sofort stoppen, kein Merge erlaubt
HIGH	Pipeline stoppen (konfigurierbar)
MEDIUM	Warning, Ticket erstellen, Merge erlaubt
LOW/INFO	Log, Trend verfolgen

Konkrete Tool-Konfigurationen

Semgrep (SAST) - GitHub Actions:

name: SAST Scan
on: [push, pull_request]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/django
            p/nodejs
            p/java
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

Trivy (Container + IaC Scanning):

# Dockerfile-Scan:
trivy config ./Dockerfile

# Image-Scan vor Push:
trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest

# Kubernetes YAML:
trivy config ./k8s/

# GitHub Actions:
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ${{ env.IMAGE }}
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'
    exit-code: '1'

gitleaks (Secrets Detection) - .gitleaks.toml Konfiguration:

[allowlist]
  regexes = [
    '''fake-api-key-.*''',   # Test-Keys ignorieren
    '''example\.com''',      # Beispiel-Domains ignorieren
  ]

# .pre-commit-config.yaml:
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

OWASP Dependency-Check (SCA für Java/.NET):

mvn org.owasp:dependency-check-maven:check \
  -DfailBuildOnCVSS=7  # Fail bei CVSS >= 7

DAST mit Nuclei (schnell, Template-basiert):

nuclei -u https://staging.example.com \
  -t cves/ \
  -severity critical,high \
  -o nuclei-results.txt \
  -exit-code  # Exit 1 bei Findings