What's the Deal with Shift-Left Security, and Why Should You Care?

1
name: SAST Security Scan
2

3
# Security: Restrict workflow triggers to prevent unauthorized runs
4
on:
5
  push:
6
    branches: [main, develop]
7
  pull_request:
8
    branches: [main]
9
  workflow_dispatch:  # Allow manual triggers for security audits
10

11
# Security: Define minimum permissions (OIDC best practice)
12
permissions:
13
  contents: read
14
  security-events: write
15
  pull-requests: write
16

17
jobs:
18
  validate-inputs:
19
    name: Validate Configuration
20
    runs-on: ubuntu-latest
21
    steps:
22
      # Security: Validate required secrets are present
23
      - name: Validate Required Secrets
24
        run: |
25
          set -euo pipefail  # Exit on error, undefined vars, pipe failures
26

27
          if [ -z "${{ secrets.SONAR_TOKEN }}" ]; then
28
            echo "::error::SONAR_TOKEN secret is not configured"
29
            exit 1
30
          fi
31

32
          if [ -z "${{ secrets.SONAR_HOST_URL }}" ]; then
33
            echo "::error::SONAR_HOST_URL secret is not configured"
34
            exit 1
35
          fi
36

37
          echo "✓ All required secrets are configured"
38

39
  sonarqube:
40
    name: SonarQube SAST Analysis
41
    runs-on: ubuntu-latest
42
    needs: validate-inputs
43

44
    # Security: Set timeout to prevent resource exhaustion
45
    timeout-minutes: 30
46

47
    steps:
48
      # Security: Use specific version tags, not @latest
49
      - name: Checkout Code
50
        uses: actions/checkout@v4
51
        with:
52
          fetch-depth: 0  # Required for blame information
53
          persist-credentials: false  # Security: Don't persist Git credentials
54

55
      # Security: Use specific LTS Java version
56
      - name: Set up JDK 17
57
        uses: actions/setup-java@v4
58
        with:
59
          java-version: '17'
60
          distribution: 'temurin'
61
          cache: 'maven'  # Built-in Maven cache
62

63
      # Security: Verify Maven wrapper integrity
64
      - name: Validate Maven Wrapper
65
        run: |
66
          set -euo pipefail
67

68
          if [ -f "mvnw" ]; then
69
            # Check if Maven wrapper jar exists and verify checksum
70
            if [ ! -f ".mvn/wrapper/maven-wrapper.jar" ]; then
71
              echo "::error::Maven wrapper jar not found"
72
              exit 1
73
            fi
74
            echo "✓ Maven wrapper validated"
75
          fi
76

77
      # Security: Run dependency vulnerability check before analysis
78
      - name: Check Dependencies
79
        run: |
80
          set -euo pipefail
81
          mvn dependency:tree -DoutputFile=dependency-tree.txt
82
          mvn org.owasp:dependency-check-maven:check \
83
            -DfailBuildOnCVSS=7 \
84
            -DsuppressionFile=dependency-check-suppressions.xml || true
85

86
      # Security: Run SonarQube with strict settings
87
      - name: Run SonarQube Analysis
88
        env:
89
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
90
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
91
          # Security: Prevent token leakage in logs
92
          SONAR_SCANNER_OPTS: "-Dsonar.log.level=INFO"
93
        run: |
94
          set -euo pipefail
95

96
          # Validate URL format (prevent injection)
97
          if ! echo "$SONAR_HOST_URL" | grep -E '^https?://[a-zA-Z0-9.-]+'; then
98
            echo "::error::Invalid SONAR_HOST_URL format"
99
            exit 1
100
          fi
101

102
          # Run analysis with security-focused settings
103
          mvn clean verify sonar:sonar \
104
            -Dsonar.projectKey=my-project \
105
            -Dsonar.qualitygate.wait=true \
106
            -Dsonar.qualitygate.timeout=300 \
107
            -Dsonar.exclusions="**/test/**,**/node_modules/**" \
108
            -Dsonar.coverage.exclusions="**/test/**" \
109
            -B  # Batch mode for CI
110

111
      # Security: Verify quality gate status
112
      - name: Check Quality Gate Status
113
        if: always()
114
        run: |
115
          set -euo pipefail
116
          echo "✓ SonarQube analysis completed"
117
          echo "View detailed report at: ${{ secrets.SONAR_HOST_URL }}"
118

119
      # Security: Upload analysis artifacts (sanitized)
120
      - name: Upload Analysis Report
121
        if: always()
122
        uses: actions/upload-artifact@v4
123
        with:
124
          name: sonarqube-analysis
125
          path: |
126
            target/sonar/report-task.txt
127
            dependency-tree.txt
128
          retention-days: 30
129
          if-no-files-found: warn
130

131
      # Security: Notify on failure
132
      - name: Notify on Failure
133
        if: failure()
134
        run: |
135
          echo "::error::SAST scan failed - review security findings before merge"
136
          exit 1

1
# Security: Define execution stages
2
stages:
3
  - validate
4
  - deploy
5
  - security-scan
6
  - report
7

8
# Security: Global variables with safe defaults
9
variables:
10
  # Prevent credential leakage in logs
11
  GIT_STRATEGY: fetch
12
  GIT_DEPTH: 1
13
  # Security: Set scan timeout
14
  ZAP_SCAN_TIMEOUT: "10"
15
  # Security: Define acceptable risk threshold
16
  ZAP_FAIL_ON_SEVERITY: "HIGH"
17

18
# Security: Validate configuration before deployment
19
validate_config:
20
  stage: validate
21
  image: alpine:latest
22
  script:
23
    - |
24
      set -euo pipefail
25

26
      # Validate required variables
27
      if [ -z "${STAGING_URL:-}" ]; then
28
        echo "ERROR: STAGING_URL not configured"
29
        exit 1
30
      fi
31

32
      # Security: Validate URL format (prevent injection)
33
      if ! echo "$STAGING_URL" | grep -E '^https://[a-zA-Z0-9.-]+'; then
34
        echo "ERROR: STAGING_URL must use HTTPS and valid hostname"
35
        exit 1
36
      fi
37

38
      # Security: Check for secure protocol
39
      if echo "$STAGING_URL" | grep -q '^http://'; then
40
        echo "WARNING: Non-HTTPS URL detected - security scan may be unreliable"
41
      fi
42

43
      echo "✓ Configuration validated successfully"
44
  only:
45
    - branches
46

47
# Security: Deploy to isolated staging environment
48
deploy_staging:
49
  stage: deploy
50
  image: alpine:latest
51
  needs: [validate_config]
52

53
  # Security: Set deployment timeout
54
  timeout: 15 minutes
55

56
  script:
57
    - |
58
      set -euo pipefail
59

60
      echo "Deploying to staging environment..."
61

62
      # Security: Validate deployment script exists and is executable
63
      if [ ! -f "./deploy-staging.sh" ]; then
64
        echo "ERROR: Deployment script not found"
65
        exit 1
66
      fi
67

68
      if [ ! -x "./deploy-staging.sh" ]; then
69
        echo "ERROR: Deployment script is not executable"
70
        exit 1
71
      fi
72

73
      # Security: Run deployment with strict error handling
74
      ./deploy-staging.sh
75

76
      # Security: Verify deployment health
77
      echo "Waiting for application to be ready..."
78
      for i in {1..30}; do
79
        if wget --spider --timeout=5 "${STAGING_URL}/health" 2>/dev/null; then
80
          echo "✓ Application is healthy"
81
          exit 0
82
        fi
83
        sleep 10
84
      done
85

86
      echo "ERROR: Application health check failed"
87
      exit 1
88

89
  environment:
90
    name: staging
91
    url: $STAGING_URL
92
    on_stop: cleanup_staging
93

94
  only:
95
    - branches
96

97
# Security: Run DAST scan with comprehensive checks
98
dast_scan:
99
  stage: security-scan
100
  # Security: Use specific version tag
101
  image: owasp/zap2docker-stable:latest
102
  needs: [deploy_staging]
103

104
  # Security: Set scan timeout
105
  timeout: 30 minutes
106

107
  variables:
108
    # Security: Restrict ZAP memory usage
109
    ZAP_JAVA_OPTS: "-Xmx2048m"
110

111
  script:
112
    - |
113
      set -euo pipefail
114

115
      # Security: Create working directory with proper permissions
116
      mkdir -p /zap/wrk
117
      chmod 700 /zap/wrk
118

119
      # Security: Validate target URL
120
      TARGET_URL="${STAGING_URL}"
121
      if ! echo "$TARGET_URL" | grep -E '^https://[a-zA-Z0-9.-]+'; then
122
        echo "ERROR: Invalid target URL format"
123
        exit 1
124
      fi
125

126
      echo "Starting DAST scan on: $TARGET_URL"
127

128
      # Security: Create ZAP configuration with safe settings
129
      cat > /zap/wrk/zap-config.conf << 'EOF'
130
      # Rate limiting to prevent DoS on target
131
      rules.config.script.passive.enabled=true
132
      scanner.threadPerHost=2
133
      connection.timeoutInSecs=30
134
      EOF
135

136
      # Security: Run baseline scan with strict settings
137
      zap-baseline.py \
138
        -t "$TARGET_URL" \
139
        -c /zap/wrk/zap-config.conf \
140
        -r dast-report.html \
141
        -w dast-report.md \
142
        -J dast-report.json \
143
        -x dast-report.xml \
144
        -d \
145
        -T "${ZAP_SCAN_TIMEOUT}" \
146
        -z "-config api.disablekey=true" || SCAN_EXIT_CODE=$?
147

148
      # Security: Parse results and determine severity
149
      if [ -f "dast-report.json" ]; then
150
        HIGH_COUNT=$(jq '[.site[].alerts[] | select(.riskdesc | startswith("High"))] | length' dast-report.json || echo "0")
151
        MEDIUM_COUNT=$(jq '[.site[].alerts[] | select(.riskdesc | startswith("Medium"))] | length' dast-report.json || echo "0")
152

153
        echo "Security Scan Results:"
154
        echo "  High Severity Issues: $HIGH_COUNT"
155
        echo "  Medium Severity Issues: $MEDIUM_COUNT"
156

157
        # Security: Fail on high severity issues
158
        if [ "$HIGH_COUNT" -gt 0 ]; then
159
          echo "ERROR: High severity vulnerabilities detected!"
160
          exit 1
161
        fi
162
      fi
163

164
      echo "✓ DAST scan completed successfully"
165

166
  # Security: Preserve scan results for audit
167
  artifacts:
168
    when: always
169
    paths:
170
      - dast-report.html
171
      - dast-report.json
172
      - dast-report.xml
173
      - dast-report.md
174
    reports:
175
      junit: dast-report.xml
176
    expire_in: 90 days
177

178
  # Security: Don't allow failure in production pipeline
179
  allow_failure: false
180

181
  only:
182
    - branches
183

184
# Security: Cleanup staging environment
185
cleanup_staging:
186
  stage: report
187
  image: alpine:latest
188
  script:
189
    - echo "Cleaning up staging environment..."
190
    - ./cleanup-staging.sh || true
191
  when: manual
192
  environment:
193
    name: staging
194
    action: stop

1
name: SCA Dependency Scan
2

3
# Security: Controlled trigger conditions
4
on:
5
  push:
6
    branches: [main, develop]
7
  pull_request:
8
    branches: [main]
9
    types: [opened, synchronize, reopened]
10
  schedule:
11
    # Security: Daily scan at 2 AM UTC for new CVEs
12
    - cron: '0 2 * * *'
13
  workflow_dispatch:  # Manual security audits
14

15
# Security: Minimal required permissions
16
permissions:
17
  contents: read
18
  security-events: write
19
  pull-requests: write
20
  issues: write
21

22
jobs:
23
  validate-environment:
24
    name: Validate Scan Environment
25
    runs-on: ubuntu-latest
26
    timeout-minutes: 5
27

28
    steps:
29
      - name: Validate Configuration
30
        run: |
31
          set -euo pipefail
32

33
          echo "Validating scan environment..."
34

35
          # Security: Check runner environment
36
          if [ -z "${GITHUB_WORKSPACE:-}" ]; then
37
            echo "::error::Invalid GitHub workspace"
38
            exit 1
39
          fi
40

41
          # Security: Verify Trivy is available
42
          echo "✓ Environment validated"
43

44
  trivy_filesystem_scan:
45
    name: Scan Dependencies (Filesystem)
46
    runs-on: ubuntu-latest
47
    needs: validate-environment
48
    timeout-minutes: 20
49

50
    steps:
51
      # Security: Checkout with minimal permissions
52
      - name: Checkout Code
53
        uses: actions/checkout@v4
54
        with:
55
          persist-credentials: false
56
          fetch-depth: 1
57

58
      # Security: Use specific Trivy version for reproducibility
59
      - name: Run Trivy Vulnerability Scanner
60
        uses: aquasecurity/trivy-action@0.16.1
61
        with:
62
          scan-type: 'fs'
63
          scan-ref: '.'
64
          format: 'sarif'
65
          output: 'trivy-results.sarif'
66
          severity: 'CRITICAL,HIGH'
67
          # Security: Scan for vulnerabilities and misconfigurations
68
          scanners: 'vuln,secret,config'
69
          # Security: Include license checks
70
          license-full: true
71
          # Security: Timeout protection
72
          timeout: '10m'
73
        env:
74
          # Security: Disable analytics/telemetry
75
          TRIVY_DISABLE_VEX_NOTICE: 'true'
76

77
      # Security: Validate SARIF output before upload
78
      - name: Validate SARIF Report
79
        run: |
80
          set -euo pipefail
81

82
          if [ ! -f "trivy-results.sarif" ]; then
83
            echo "::error::SARIF report not generated"
84
            exit 1
85
          fi
86

87
          # Check if file is valid JSON
88
          if ! jq empty trivy-results.sarif 2>/dev/null; then
89
            echo "::error::Invalid SARIF format"
90
            exit 1
91
          fi
92

93
          # Count vulnerabilities
94
          VULN_COUNT=$(jq '[.runs[].results[]] | length' trivy-results.sarif)
95
          echo "Found $VULN_COUNT security findings"
96

97
      # Security: Upload to GitHub Security tab
98
      - name: Upload to GitHub Security
99
        uses: github/codeql-action/upload-sarif@v3
100
        if: always()
101
        with:
102
          sarif_file: 'trivy-results.sarif'
103
          category: 'trivy-filesystem'
104

105
      # Security: Generate human-readable report
106
      - name: Generate Detailed Report
107
        uses: aquasecurity/trivy-action@0.16.1
108
        with:
109
          scan-type: 'fs'
110
          scan-ref: '.'
111
          format: 'table'
112
          output: 'trivy-report.txt'
113
          severity: 'CRITICAL,HIGH,MEDIUM'
114
          scanners: 'vuln,secret,config'
115

116
      # Security: Create sanitized report for artifact upload
117
      - name: Sanitize Report
118
        if: always()
119
        run: |
120
          set -euo pipefail
121

122
          # Remove potential secrets from report
123
          if [ -f "trivy-report.txt" ]; then
124
            # Mask potential sensitive patterns
125
            sed -i 's/[A-Za-z0-9]\{32,\}/***REDACTED***/g' trivy-report.txt
126
          fi
127

128
      # Security: Upload artifacts with retention policy
129
      - name: Upload Scan Results
130
        uses: actions/upload-artifact@v4
131
        if: always()
132
        with:
133
          name: trivy-scan-results-${{ github.run_number }}
134
          path: |
135
            trivy-results.sarif
136
            trivy-report.txt
137
          retention-days: 90
138
          if-no-files-found: error
139

140
      # Security: Enforce vulnerability threshold
141
      - name: Check Vulnerability Threshold
142
        uses: aquasecurity/trivy-action@0.16.1
143
        with:
144
          scan-type: 'fs'
145
          scan-ref: '.'
146
          exit-code: '1'
147
          severity: 'CRITICAL,HIGH'
148
          scanners: 'vuln'
149
          # Security: Ignore unfixed vulnerabilities in dev dependencies
150
          ignore-unfixed: true
151

152
      # Security: Create GitHub issue for critical findings
153
      - name: Create Security Issue
154
        if: failure()
155
        uses: actions/github-script@v7
156
        with:
157
          script: |
158
            const fs = require('fs');
159
            const report = fs.readFileSync('trivy-report.txt', 'utf8');
160

161
            const issue = await github.rest.issues.create({
162
              owner: context.repo.owner,
163
              repo: context.repo.repo,
164
              title: `🚨 Security: Critical vulnerabilities detected in ${context.ref}`,
165
              body: `## Security Scan Results\n\n` +
166
                    `**Workflow Run:** ${context.runId}\n` +
167
                    `**Commit:** ${context.sha}\n\n` +
168
                    `### Findings\n\n\`\`\`\n${report}\n\`\`\`\n\n` +
169
                    `**Action Required:** Review and remediate these vulnerabilities before merging.`,
170
              labels: ['security', 'vulnerability']
171
            });
172

173
            console.log(`Created issue #${issue.data.number}`);

1
# Security: Build Docker image with security controls
2
- name: Set up Docker Buildx
3
  uses: docker/setup-buildx-action@v3
4
  with:
5
    # Security: Enable BuildKit security features
6
    driver-opts: |
7
      image=moby/buildkit:latest
8
      network=host
9

10
# Security: Build with security scanner integration
11
- name: Build Docker Image
12
  run: |
13
    set -euo pipefail
14

15
    # Security: Validate Dockerfile exists
16
    if [ ! -f "Dockerfile" ]; then
17
      echo "::error::Dockerfile not found"
18
      exit 1
19
    fi
20

21
    # Security: Scan Dockerfile for issues before building
22
    docker run --rm -i hadolint/hadolint < Dockerfile || true
23

24
    # Security: Build with security labels and no cache for reproducibility
25
    docker build \
26
      --no-cache \
27
      --pull \
28
      --label "org.opencontainers.image.created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
29
      --label "org.opencontainers.image.revision=${{ github.sha }}" \
30
      --label "org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}" \
31
      -t myapp:${{ github.sha }} \
32
      -t myapp:scan-candidate \
33
      .
34

35
    echo "✓ Docker image built successfully"
36

37
# Security: Comprehensive image vulnerability scan
38
- name: Scan Docker Image for Vulnerabilities
39
  uses: aquasecurity/trivy-action@0.16.1
40
  with:
41
    image-ref: 'myapp:${{ github.sha }}'
42
    format: 'sarif'
43
    output: 'trivy-image-results.sarif'
44
    severity: 'CRITICAL,HIGH,MEDIUM'
45
    # Security: Scan all layers and dependencies
46
    scanners: 'vuln,secret,config'
47
    # Security: Include OS packages and application dependencies
48
    vuln-type: 'os,library'
49
    # Security: Timeout protection
50
    timeout: '15m'
51
  env:
52
    TRIVY_DISABLE_VEX_NOTICE: 'true'
53

54
# Security: Validate and upload results
55
- name: Upload Image Scan Results
56
  uses: github/codeql-action/upload-sarif@v3
57
  if: always()
58
  with:
59
    sarif_file: 'trivy-image-results.sarif'
60
    category: 'trivy-container'
61

62
# Security: Generate SBOM for supply chain security
63
- name: Generate SBOM
64
  run: |
65
    set -euo pipefail
66

67
    docker run --rm \
68
      -v /var/run/docker.sock:/var/run/docker.sock \
69
      aquasec/trivy image \
70
      --format cyclonedx \
71
      --output sbom.json \
72
      myapp:${{ github.sha }}
73

74
    # Validate SBOM is valid JSON
75
    if ! jq empty sbom.json 2>/dev/null; then
76
      echo "::error::Invalid SBOM format"
77
      exit 1
78
    fi
79

80
    echo "✓ SBOM generated successfully"
81

82
# Security: Fail build on critical vulnerabilities
83
- name: Check Image Security Threshold
84
  run: |
85
    set -euo pipefail
86

87
    # Run scan with exit code check
88
    docker run --rm \
89
      -v /var/run/docker.sock:/var/run/docker.sock \
90
      aquasec/trivy image \
91
      --exit-code 1 \
92
      --severity CRITICAL,HIGH \
93
      --ignore-unfixed \
94
      myapp:${{ github.sha }}

1
// Security: Define pipeline with strict error handling
2
pipeline {
3
    agent any
4

5
    // Security: Set global timeout to prevent resource exhaustion
6
    options {
7
        timeout(time: 1, unit: 'HOURS')
8
        timestamps()
9
        disableConcurrentBuilds()
10
        buildDiscarder(logRotator(numToKeepStr: '10'))
11
    }
12

13
    // Security: Define required tools with specific versions
14
    tools {
15
        maven 'Maven-3.9.6'
16
        jdk 'JDK-17'
17
    }
18

19
    // Security: Define environment variables with validation
20
    environment {
21
        // Security: Mask sensitive values in logs
22
        SONAR_TOKEN = credentials('sonarqube-token')
23
        SONAR_HOST_URL = credentials('sonarqube-url')
24
        // Security: Set Maven options for secure builds
25
        MAVEN_OPTS = '-Xmx2048m -Dmaven.wagon.http.ssl.insecure=false -Dmaven.wagon.http.ssl.allowall=false'
26
    }
27

28
    stages {
29
        // Security: Validate environment before starting
30
        stage('Validate Environment') {
31
            steps {
32
                script {
33
                    // Security: Check required tools are available
34
                    sh '''
35
                        set -euo pipefail
36

37
                        echo "Validating build environment..."
38

39
                        # Check Maven version
40
                        mvn --version || { echo "ERROR: Maven not found"; exit 1; }
41

42
                        # Check Java version
43
                        java -version || { echo "ERROR: Java not found"; exit 1; }
44

45
                        # Validate credentials are set
46
                        if [ -z "$SONAR_TOKEN" ]; then
47
                            echo "ERROR: SonarQube token not configured"
48
                            exit 1
49
                        fi
50

51
                        echo "✓ Environment validated successfully"
52
                    '''
53
                }
54
            }
55
        }
56

57
        // Security: Checkout with validation
58
        stage('Checkout') {
59
            steps {
60
                script {
61
                    // Security: Clean workspace before checkout
62
                    deleteDir()
63

64
                    // Security: Checkout with specific branch validation
65
                    checkout([
66
                        $class: 'GitSCM',
67
                        branches: [[name: '*/main']],
68
                        extensions: [
69
                            [$class: 'CleanCheckout'],
70
                            [$class: 'CloneOption', depth: 0, noTags: false, reference: '', shallow: false]
71
                        ],
72
                        userRemoteConfigs: [[
73
                            url: 'https://github.com/yourorg/yourrepo.git',
74
                            credentialsId: 'github-credentials'
75
                        ]]
76
                    ])
77

78
                    // Security: Verify workspace integrity
79
                    sh '''
80
                        set -euo pipefail
81

82
                        if [ ! -f "pom.xml" ]; then
83
                            echo "ERROR: pom.xml not found - invalid project structure"
84
                            exit 1
85
                        fi
86

87
                        echo "✓ Workspace validated"
88
                    '''
89
                }
90
            }
91
        }
92

93
        // Security: Dependency vulnerability check
94
        stage('Security: Dependency Check') {
95
            steps {
96
                script {
97
                    sh '''
98
                        set -euo pipefail
99

100
                        echo "Checking dependencies for known vulnerabilities..."
101

102
                        # Run OWASP Dependency Check
103
                        mvn org.owasp:dependency-check-maven:check \
104
                            -DfailBuildOnCVSS=7 \
105
                            -DskipTestScope=true \
106
                            -DsuppressionFile=dependency-check-suppressions.xml \
107
                            -Dformats=HTML,JSON,JUNIT || {
108
                                echo "WARNING: Vulnerabilities found in dependencies"
109
                                exit 0
110
                            }
111

112
                        echo "✓ Dependency check completed"
113
                    '''
114
                }
115
            }
116
            post {
117
                always {
118
                    // Security: Archive dependency check report
119
                    publishHTML([
120
                        allowMissing: true,
121
                        alwaysLinkToLastBuild: true,
122
                        keepAll: true,
123
                        reportDir: 'target',
124
                        reportFiles: 'dependency-check-report.html',
125
                        reportName: 'OWASP Dependency Check'
126
                    ])
127
                }
128
            }
129
        }
130

131
        // Security: Secure build process
132
        stage('Build') {
133
            steps {
134
                script {
135
                    sh '''
136
                        set -euo pipefail
137

138
                        echo "Building project with security checks..."
139

140
                        # Security: Build with strict compiler warnings
141
                        mvn clean package \
142
                            -DskipTests=false \
143
                            -Dmaven.test.failure.ignore=false \
144
                            -Dcheckstyle.failOnViolation=true \
145
                            -Denforcer.fail=true \
146
                            -B  # Batch mode for CI
147

148
                        # Security: Verify build artifacts
149
                        if [ ! -f "target/*.jar" ]; then
150
                            echo "ERROR: Build artifact not found"
151
                            exit 1
152
                        fi
153

154
                        echo "✓ Build completed successfully"
155
                    '''
156
                }
157
            }
158
            post {
159
                success {
160
                    // Security: Archive build artifacts with checksum
161
                    script {
162
                        sh 'sha256sum target/*.jar > target/checksums.txt'
163
                        archiveArtifacts artifacts: 'target/*.jar,target/checksums.txt', fingerprint: true
164
                    }
165
                }
166
            }
167
        }
168

169
        // Security: SonarQube SAST analysis
170
        stage('SonarQube Analysis') {
171
            steps {
172
                script {
173
                    def scannerHome = tool 'SonarQubeScanner'
174

175
                    // Security: Run SonarQube with strict quality profiles
176
                    withSonarQubeEnv('SonarQube') {
177
                        sh """
178
                            set -euo pipefail
179

180
                            echo "Running SonarQube security analysis..."
181

182
                            # Security: Validate SonarQube URL
183
                            if ! echo "\$SONAR_HOST_URL" | grep -E '^https://[a-zA-Z0-9.-]+'; then
184
                                echo "ERROR: Invalid SonarQube URL"
185
                                exit 1
186
                            fi
187

188
                            # Run analysis with security-focused settings
189
                            ${scannerHome}/bin/sonar-scanner \
190
                                -Dsonar.projectKey=my-project \
191
                                -Dsonar.sources=src/main \
192
                                -Dsonar.tests=src/test \
193
                                -Dsonar.java.binaries=target/classes \
194
                                -Dsonar.java.test.binaries=target/test-classes \
195
                                -Dsonar.coverage.jacoco.xmlReportPaths=target/site/jacoco/jacoco.xml \
196
                                -Dsonar.exclusions='**/test/**,**/node_modules/**' \
197
                                -Dsonar.log.level=INFO
198

199
                            echo "✓ SonarQube analysis completed"
200
                        """
201
                    }
202
                }
203
            }
204
        }
205

206
        // Security: Enforce quality gate
207
        stage('Quality Gate') {
208
            steps {
209
                script {
210
                    // Security: Wait for quality gate with timeout
211
                    timeout(time: 10, unit: 'MINUTES') {
212
                        def qg = waitForQualityGate()
213

214
                        if (qg.status != 'OK') {
215
                            // Security: Log quality gate failure
216
                            echo "ERROR: Quality Gate failed with status: ${qg.status}"
217
                            echo "Review security findings at: ${env.SONAR_HOST_URL}"
218

219
                            // Security: Fail the build
220
                            error "Quality Gate failed - security standards not met"
221
                        }
222

223
                        echo "✓ Quality Gate passed"
224
                    }
225
                }
226
            }
227
        }
228

229
        // Security: Conditional deployment
230
        stage('Deploy') {
231
            when {
232
                allOf {
233
                    branch 'main'
234
                    expression { currentBuild.result == null || currentBuild.result == 'SUCCESS' }
235
                }
236
            }
237
            steps {
238
                script {
239
                    sh '''
240
                        set -euo pipefail
241

242
                        echo "Deploying application with security verification..."
243

244
                        # Security: Verify artifact integrity before deployment
245
                        if ! sha256sum -c target/checksums.txt; then
246
                            echo "ERROR: Artifact integrity check failed"
247
                            exit 1
248
                        fi
249

250
                        # Your secure deployment steps here
251
                        echo "✓ Deployment completed successfully"
252
                    '''
253
                }
254
            }
255
        }
256
    }
257

258
    // Security: Post-build actions with notifications
259
    post {
260
        always {
261
            // Security: Clean workspace after build
262
            cleanWs()
263
        }
264

265
        success {
266
            echo 'Pipeline completed successfully with all security checks passed'
267
        }
268

269
        failure {
270
            script {
271
                // Security: Send notification on failure
272
                emailext(
273
                    subject: "SECURITY ALERT: Pipeline Failed - ${currentBuild.fullDisplayName}",
274
                    body: """
275
                        Build failed with security issues:
276

277
                        Project: ${env.JOB_NAME}
278
                        Build Number: ${env.BUILD_NUMBER}
279
                        Build URL: ${env.BUILD_URL}
280

281
                        Action Required: Review security findings before proceeding.
282
                    """,
283
                    to: 'security-team@example.com',
284
                    mimeType: 'text/plain'
285
                )
286
            }
287
        }
288

289
        unstable {
290
            echo 'Build unstable - review security warnings'
291
        }
292
    }
293
}

1
# Security: Docker Compose configuration for DAST testing
2
version: '3.8'
3

4
services:
5
  # Application under test
6
  app:
7
    image: myapp:latest
8
    container_name: dast-target-app
9

10
    # Security: Network isolation
11
    networks:
12
      - dast-network
13

14
    # Security: Resource limits to prevent DoS
15
    deploy:
16
      resources:
17
        limits:
18
          cpus: '1.0'
19
          memory: 1G
20
        reservations:
21
          cpus: '0.5'
22
          memory: 512M
23

24
    # Security: Port mapping (localhost only)
25
    ports:
26
      - "127.0.0.1:3000:3000"
27

28
    # Security: Environment variables (use .env file for secrets)
29
    environment:
30
      - NODE_ENV=test
31
      - LOG_LEVEL=info
32
      # Security: Disable debug modes in test
33
      - DEBUG=false
34

35
    # Security: Health check for readiness
36
    healthcheck:
37
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/health"]
38
      interval: 10s
39
      timeout: 5s
40
      retries: 5
41
      start_period: 30s
42

43
    # Security: Read-only root filesystem where possible
44
    read_only: true
45

46
    # Security: Drop unnecessary capabilities
47
    cap_drop:
48
      - ALL
49
    cap_add:
50
      - NET_BIND_SERVICE
51

52
    # Security: Run as non-root user
53
    user: "1000:1000"
54

55
    # Security: Temporary volumes for writable paths
56
    tmpfs:
57
      - /tmp:noexec,nosuid,size=100M
58
      - /var/tmp:noexec,nosuid,size=100M
59

60
  # OWASP ZAP scanner
61
  zap:
62
    image: owasp/zap2docker-stable:latest
63
    container_name: dast-zap-scanner
64

65
    # Security: Network isolation
66
    networks:
67
      - dast-network
68

69
    # Security: Resource limits
70
    deploy:
71
      resources:
72
        limits:
73
          cpus: '2.0'
74
          memory: 2G
75
        reservations:
76
          cpus: '1.0'
77
          memory: 1G
78

79
    # Security: Wait for app to be healthy before scanning
80
    depends_on:
81
      app:
82
        condition: service_healthy
83

84
    # Security: Custom entrypoint for enhanced scanning
85
    entrypoint: ["/bin/bash", "-c"]
86
    command:
87
      - |
88
        set -euo pipefail
89

90
        echo "Starting DAST security scan..."
91

92
        # Security: Wait for app to be fully ready
93
        sleep 10
94

95
        # Security: Create secure working directory
96
        mkdir -p /zap/wrk
97
        chmod 700 /zap/wrk
98

99
        # Security: Configure ZAP with safe settings
100
        cat > /zap/wrk/zap-options.prop << 'EOF'
101
        # Rate limiting to prevent DoS
102
        scanner.threadPerHost=2
103
        connection.timeoutInSecs=30
104
        # Disable risky attack vectors in test environment
105
        scanner.attackMode=standard
106
        EOF
107

108
        # Security: Run baseline scan with comprehensive reporting
109
        zap-baseline.py \
110
          -t http://app:3000 \
111
          -c /zap/wrk/zap-options.prop \
112
          -r /zap/wrk/dast-report.html \
113
          -w /zap/wrk/dast-report.md \
114
          -J /zap/wrk/dast-report.json \
115
          -x /zap/wrk/dast-report.xml \
116
          -d \
117
          -T 15 \
118
          -z "-config api.disablekey=true" || true
119

120
        # Security: Generate summary
121
        if [ -f "/zap/wrk/dast-report.json" ]; then
122
          echo "Scan completed. Analyzing results..."
123

124
          # Parse JSON for vulnerabilities
125
          HIGH_COUNT=$$(jq '[.site[].alerts[] | select(.riskdesc | startswith("High"))] | length' /zap/wrk/dast-report.json 2>/dev/null || echo "0")
126
          MEDIUM_COUNT=$$(jq '[.site[].alerts[] | select(.riskdesc | startswith("Medium"))] | length' /zap/wrk/dast-report.json 2>/dev/null || echo "0")
127
          LOW_COUNT=$$(jq '[.site[].alerts[] | select(.riskdesc | startswith("Low"))] | length' /zap/wrk/dast-report.json 2>/dev/null || echo "0")
128

129
          echo "========================================"
130
          echo "DAST Scan Results:"
131
          echo "  High Severity:   $$HIGH_COUNT"
132
          echo "  Medium Severity: $$MEDIUM_COUNT"
133
          echo "  Low Severity:    $$LOW_COUNT"
134
          echo "========================================"
135

136
          # Security: Set exit code based on findings
137
          if [ "$$HIGH_COUNT" -gt 0 ]; then
138
            echo "CRITICAL: High severity vulnerabilities detected!"
139
            exit 1
140
          fi
141
        else
142
          echo "ERROR: Scan report not generated"
143
          exit 1
144
        fi
145

146
        echo "DAST scan completed successfully"
147

148
    # Security: Mount reports directory with restricted permissions
149
    volumes:
150
      - type: bind
151
        source: ./reports
152
        target: /zap/wrk
153
        read_only: false
154

155
    # Security: Run as non-root user
156
    user: "1000:1000"
157

158
    # Security: Drop unnecessary capabilities
159
    cap_drop:
160
      - ALL
161

162
# Security: Isolated network for testing
163
networks:
164
  dast-network:
165
    driver: bridge
166
    internal: false
167
    ipam:
168
      config:
169
        - subnet: 172.28.0.0/16

1
# Security: Azure DevOps DAST Pipeline with Comprehensive Controls
2
trigger:
3
  branches:
4
    include:
5
      - main
6
      - develop
7
  paths:
8
    exclude:
9
      - docs/*
10
      - '*.md'
11

12
# Security: Scheduled security scans
13
schedules:
14
  - cron: '0 2 * * 0'  # Weekly scan on Sunday at 2 AM
15
    displayName: 'Weekly Security Scan'
16
    branches:
17
      include:
18
        - main
19
    always: true
20

21
# Security: Define variables with validation
22
variables:
23
  - name: stagingUrl
24
    value: 'https://staging.example.com'
25
  - name: zapTimeout
26
    value: '15'
27
  - name: maxScanDuration
28
    value: '30'
29
  # Security: Use variable groups for secrets
30
  - group: 'security-credentials'
31

32
pool:
33
  vmImage: 'ubuntu-22.04'  # Use specific version
34

35
stages:
36
- stage: Validate
37
  displayName: 'Validate Configuration'
38
  jobs:
39
  - job: ValidateEnvironment
40
    displayName: 'Validate Security Environment'
41
    timeoutInMinutes: 10
42
    steps:
43
    - bash: |
44
        set -euo pipefail
45

46
        echo "Validating security scan configuration..."
47

48
        # Security: Validate staging URL format
49
        if ! echo "$(stagingUrl)" | grep -E '^https://[a-zA-Z0-9.-]+'; then
50
          echo "##vso[task.logissue type=error]Invalid staging URL format - must use HTTPS"
51
          exit 1
52
        fi
53

54
        # Security: Check for required secrets
55
        if [ -z "$(stagingUsername)" ] || [ -z "$(stagingPassword)" ]; then
56
          echo "##vso[task.logissue type=error]Authentication credentials not configured"
57
          exit 1
58
        fi
59

60
        echo "✓ Configuration validated successfully"
61
      displayName: 'Validate Configuration'
62

63
- stage: SecurityTest
64
  displayName: 'DAST Security Testing'
65
  dependsOn: Validate
66
  condition: succeeded()
67
  jobs:
68
  - job: PrepareScan
69
    displayName: 'Prepare Security Scan'
70
    timeoutInMinutes: 10
71
    steps:
72
    # Security: Create secure working directory
73
    - bash: |
74
        set -euo pipefail
75

76
        mkdir -p $(Build.ArtifactStagingDirectory)/zap-config
77
        mkdir -p $(Build.ArtifactStagingDirectory)/zap-reports
78
        chmod 700 $(Build.ArtifactStagingDirectory)/zap-config
79

80
        echo "✓ Scan directories prepared"
81
      displayName: 'Prepare Scan Environment'
82

83
  - job: DASTScan
84
    displayName: 'Run DAST Security Scan'
85
    dependsOn: PrepareScan
86
    timeoutInMinutes: $(maxScanDuration)
87

88
    steps:
89
    # Security: Pull specific Docker image version
90
    - task: Docker@2
91
      displayName: 'Pull OWASP ZAP Image'
92
      inputs:
93
        command: 'pull'
94
        arguments: 'owasp/zap2docker-stable:2.14.0'
95
      retryCountOnTaskFailure: 3
96

97
    # Security: Verify target availability before scanning
98
    - bash: |
99
        set -euo pipefail
100

101
        echo "Verifying target application is accessible..."
102

103
        MAX_RETRIES=10
104
        RETRY_COUNT=0
105

106
        while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
107
          if curl -sSf -m 10 "$(stagingUrl)/health" > /dev/null 2>&1; then
108
            echo "✓ Target application is healthy"
109
            exit 0
110
          fi
111

112
          RETRY_COUNT=$((RETRY_COUNT + 1))
113
          echo "Attempt $RETRY_COUNT/$MAX_RETRIES failed, retrying..."
114
          sleep 10
115
        done
116

117
        echo "##vso[task.logissue type=error]Target application not accessible"
118
        exit 1
119
      displayName: 'Verify Target Availability'
120

121
    # Security: Create authenticated scan configuration
122
    - bash: |
123
        set -euo pipefail
124

125
        echo "Creating secure ZAP configuration..."
126

127
        # Security: Create authentication context with validation
128
        cat > $(Build.ArtifactStagingDirectory)/zap-config/auth-config.yaml << EOF
129
        ---
130
        env:
131
          contexts:
132
            - name: "Staging Environment"
133
              urls:
134
                - "$(stagingUrl)"
135
              authentication:
136
                method: "form"
137
                parameters:
138
                  loginUrl: "$(stagingUrl)/login"
139
                  loginRequestData: "username={%username%}&password={%password%}"
140
                verification:
141
                  method: "response"
142
                  loggedInRegex: "\\QLogout\\E"
143
                  loggedOutRegex: "\\QLogin\\E"
144
              sessionManagement:
145
                method: "cookie"
146
          users:
147
            - name: "test-user"
148
              credentials:
149
                username: "\$(TEST_USERNAME)"
150
                password: "\$(TEST_PASSWORD)"
151
        EOF
152

153
        # Security: Validate configuration file
154
        if [ ! -s "$(Build.ArtifactStagingDirectory)/zap-config/auth-config.yaml" ]; then
155
          echo "##vso[task.logissue type=error]Failed to create auth configuration"
156
          exit 1
157
        fi
158

159
        echo "✓ Authentication configuration created"
160
      displayName: 'Create Auth Configuration'
161
      env:
162
        TEST_USERNAME: $(stagingUsername)
163
        TEST_PASSWORD: $(stagingPassword)
164

165
    # Security: Run comprehensive DAST scan
166
    - bash: |
167
        set -euo pipefail
168

169
        echo "Starting DAST security scan..."
170
        echo "Target: $(stagingUrl)"
171
        echo "Timeout: $(zapTimeout) minutes"
172

173
        # Security: Run ZAP with resource limits and timeout
174
        docker run --rm \
175
          --name zap-scanner-$(Build.BuildId) \
176
          --memory=2g \
177
          --cpus=2 \
178
          -v $(Build.ArtifactStagingDirectory)/zap-config:/zap/wrk/config:ro \
179
          -v $(Build.ArtifactStagingDirectory)/zap-reports:/zap/wrk/reports:rw \
180
          -e "ZAP_JAVA_OPTS=-Xmx1536m" \
181
          owasp/zap2docker-stable:2.14.0 \
182
          zap-full-scan.py \
183
            -t "$(stagingUrl)" \
184
            -n /zap/wrk/config/auth-config.yaml \
185
            -U test-user \
186
            -r /zap/wrk/reports/dast-report.html \
187
            -w /zap/wrk/reports/dast-report.md \
188
            -J /zap/wrk/reports/dast-report.json \
189
            -x /zap/wrk/reports/dast-report.xml \
190
            -d \
191
            -T $(zapTimeout) \
192
            -z "-config api.disablekey=true -config spider.maxDuration=$(zapTimeout) -config scanner.threadPerHost=2" \
193
            || SCAN_EXIT_CODE=$?
194

195
        # Security: Analyze scan results
196
        if [ -f "$(Build.ArtifactStagingDirectory)/zap-reports/dast-report.json" ]; then
197
          echo "Analyzing scan results..."
198

199
          # Parse vulnerability counts
200
          HIGH_COUNT=$(jq '[.site[].alerts[] | select(.riskdesc | startswith("High"))] | length' \
201
            $(Build.ArtifactStagingDirectory)/zap-reports/dast-report.json 2>/dev/null || echo "0")
202
          MEDIUM_COUNT=$(jq '[.site[].alerts[] | select(.riskdesc | startswith("Medium"))] | length' \
203
            $(Build.ArtifactStagingDirectory)/zap-reports/dast-report.json 2>/dev/null || echo "0")
204
          LOW_COUNT=$(jq '[.site[].alerts[] | select(.riskdesc | startswith("Low"))] | length' \
205
            $(Build.ArtifactStagingDirectory)/zap-reports/dast-report.json 2>/dev/null || echo "0")
206

207
          echo "========================================"
208
          echo "DAST Scan Results Summary:"
209
          echo "  High Severity:   $HIGH_COUNT"
210
          echo "  Medium Severity: $MEDIUM_COUNT"
211
          echo "  Low Severity:    $LOW_COUNT"
212
          echo "========================================"
213

214
          # Security: Set pipeline variables for reporting
215
          echo "##vso[task.setvariable variable=highVulnCount;isOutput=true]$HIGH_COUNT"
216
          echo "##vso[task.setvariable variable=mediumVulnCount;isOutput=true]$MEDIUM_COUNT"
217

218
          # Security: Fail on high severity findings
219
          if [ "$HIGH_COUNT" -gt 0 ]; then
220
            echo "##vso[task.logissue type=error]Critical vulnerabilities detected: $HIGH_COUNT high severity issues"
221
            exit 1
222
          fi
223

224
          echo "✓ DAST scan completed successfully"
225
        else
226
          echo "##vso[task.logissue type=error]Scan report not generated"
227
          exit 1
228
        fi
229
      displayName: 'Run OWASP ZAP Scan'
230
      timeoutInMinutes: $(maxScanDuration)
231

232
    # Security: Sanitize reports before publishing
233
    - bash: |
234
        set -euo pipefail
235

236
        echo "Sanitizing scan reports..."
237

238
        # Security: Remove potential credentials from reports
239
        find $(Build.ArtifactStagingDirectory)/zap-reports -type f -exec \
240
          sed -i 's/$(stagingUsername)/***REDACTED***/g' {} \;
241

242
        # Security: Generate report summary
243
        cat > $(Build.ArtifactStagingDirectory)/zap-reports/scan-summary.txt << EOF
244
        DAST Security Scan Summary
245
        ==========================
246
        Build ID: $(Build.BuildId)
247
        Target URL: $(stagingUrl)
248
        Scan Date: $(date -u +"%Y-%m-%d %H:%M:%S UTC")
249
        Pipeline: $(Build.DefinitionName)
250

251
        Reports generated:
252
        - HTML: dast-report.html
253
        - JSON: dast-report.json
254
        - XML: dast-report.xml
255
        - Markdown: dast-report.md
256
        EOF
257

258
        echo "✓ Reports sanitized"
259
      displayName: 'Sanitize Reports'
260
      condition: always()
261

262
    # Security: Publish scan artifacts
263
    - task: PublishBuildArtifacts@1
264
      displayName: 'Publish DAST Reports'
265
      inputs:
266
        PathtoPublish: '$(Build.ArtifactStagingDirectory)/zap-reports'
267
        ArtifactName: 'dast-security-reports-$(Build.BuildId)'
268
        publishLocation: 'Container'
269
      condition: always()
270

271
    # Security: Publish test results
272
    - task: PublishTestResults@2
273
      displayName: 'Publish Test Results'
274
      inputs:
275
        testResultsFormat: 'JUnit'
276
        testResultsFiles: '$(Build.ArtifactStagingDirectory)/zap-reports/dast-report.xml'
277
        testRunTitle: 'DAST Security Scan'
278
        mergeTestResults: true
279
        failTaskOnFailedTests: true
280
      condition: always()
281

282
- stage: Report
283
  displayName: 'Security Reporting'
284
  dependsOn: SecurityTest
285
  condition: always()
286
  jobs:
287
  - job: GenerateReport
288
    displayName: 'Generate Security Report'
289
    steps:
290
    # Security: Send notification on findings
291
    - bash: |
292
        set -euo pipefail
293

294
        echo "Generating security report summary..."
295

296
        # Add custom reporting logic here
297
        echo "✓ Security scan completed"
298
        echo "Review detailed findings in published artifacts"
299
      displayName: 'Generate Summary'