CI/CD 보안: 공급망 공격 막기

flowchart TD
    subgraph Supply_Chain [Supply Chain Flow]
        Source[Dev Code] -->|Push| Repo[Git Repo]
        Repo -->|Trigger| CI[CI Server]
        CI -->|Pull| Deps[Dependencies]
        CI -->|Build| Artifact[Docker Image]
        Artifact -->|Push| Registry[Registry]
        Registry -->|Pull| Prod[Production]
    end
    
    Attack1(Typosquatting<br/>Dependency Confusion) -.->|Poison| Deps
    Attack2(Leaked Secrets<br/>CI Takeover) -.->|Compromise| CI
    Attack3(Image Tampering<br/>Registry Hijack) -.->|Inject| Registry
    Attack4(Account Takeover<br/>Maintainer Social Eng) -.->|Poison| Source
    
    style Attack1 fill:#ffcdd2,stroke:#d32f2f
    style Attack2 fill:#ffcdd2,stroke:#d32f2f
    style Attack3 fill:#ffcdd2,stroke:#d32f2f
    style Attack4 fill:#ffcdd2,stroke:#d32f2f

{
  "_type": "https://in-toto.io/Statement/v0.1",
  "subject": [
    {
      "name": "ghcr.io/myorg/myapp",
      "digest": {
        "sha256": "abc123..."
      }
    }
  ],
  "predicateType": "https://slsa.dev/provenance/v1",
  "predicate": {
    "buildDefinition": {
      "buildType": "https://actions.github.io/buildtypes/workflow/v1",
      "externalParameters": {
        "workflow": ".github/workflows/build.yml",
        "ref": "refs/heads/main",
        "inputs": {}
      }
    },
    "runDetails": {
      "builder": {
        "id": "https://github.com/actions/runner"
      },
      "metadata": {
        "invocationId": "https://github.com/myorg/myapp/actions/runs/12345",
        "startedOn": "2026-03-24T02:00:00Z"
      }
    }
  }
}

Month 1 (L1):
├── GitHub Actions 워크플로우 정리
├── SLSA GitHub Generator로 Provenance 생성
└── SBOM 생성 자동화

Month 2-3 (L2):
├── Provenance에 Sigstore 서명 추가
├── 서명 검증 게이트 추가 (CI)
└── 의존성 검증 자동화 (Dependabot + Renovate)

Month 4-6 (L3):
├── 격리된 빌드 환경 (Ephemeral Runner)
├── Hermetic Build (네트워크 차단 빌드)
└── 재현 가능한 빌드 검증

# .github/workflows/sbom.yml
name: Build with SBOM

on:
  push:
    branches: [main]

permissions:
  contents: read
  packages: write
  id-token: write   # OIDC

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4 SHA pin

      - name: Build Docker Image
        run: docker build -t ghcr.io/myorg/myapp:${{ github.sha }} .

      # Syft로 SBOM 생성 (CycloneDX)
      - name: Generate SBOM
        uses: anchore/sbom-action@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1  # v0.17.0
        with:
          image: ghcr.io/myorg/myapp:${{ github.sha }}
          format: cyclonedx-json
          output-file: sbom.cyclonedx.json

      # Grype로 취약점 스캔
      - name: Vulnerability Scan
        uses: anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a  # v3
        with:
          sbom: sbom.cyclonedx.json
          fail-build: true
          severity-cutoff: high    # High 이상 발견 시 빌드 실패

      # SBOM을 아티팩트로 저장
      - name: Upload SBOM
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3  # v4
        with:
          name: sbom
          path: sbom.cyclonedx.json

# Syft로 이미지의 SBOM 생성
syft ghcr.io/myorg/myapp:latest -o cyclonedx-json > sbom.json

# Grype로 취약점 스캔 (SBOM 기반)
grype sbom:sbom.json --only-fixed --fail-on high

# 특정 라이브러리 검색 (log4j 사태 대응)
cat sbom.json | jq '.components[] | select(.name | contains("log4j"))'

# 라이선스 감사
cat sbom.json | jq '[.components[].licenses[]?.license.id] | group_by(.) | map({license: .[0], count: length})'

Sigstore
├── Cosign:   컨테이너 이미지 서명·검증
├── Fulcio:   단명 인증서 발급 (OIDC → x509)
├── Rekor:    불변 투명성 로그 (서명 기록)
└── Gitsign:  Git 커밋 서명

# .github/workflows/sign.yml
name: Build, Sign, Attest

on:
  push:
    branches: [main]

permissions:
  contents: read
  packages: write
  id-token: write
  attestations: write

env:
  REGISTRY: ghcr.io
  IMAGE: myorg/myapp

jobs:
  build-sign:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

      - name: Login to GHCR
        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and Push
        id: build
        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09
        with:
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}

      # Cosign 설치
      - name: Install Cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20

      # 키리스 서명 (OIDC → Fulcio 인증서 → Rekor 투명성 로그)
      - name: Sign Image
        env:
          DIGEST: ${{ steps.build.outputs.digest }}
        run: |
          cosign sign --yes \
            ${{ env.REGISTRY }}/${{ env.IMAGE }}@${DIGEST}

      # SBOM 첨부 (Attestation)
      - name: Generate and Attach SBOM
        run: |
          syft ${{ env.REGISTRY }}/${{ env.IMAGE }}@${{ steps.build.outputs.digest }} \
            -o cyclonedx-json > sbom.json
          cosign attest --yes \
            --predicate sbom.json \
            --type cyclonedx \
            ${{ env.REGISTRY }}/${{ env.IMAGE }}@${{ steps.build.outputs.digest }}

      # SLSA Provenance 첨부
      - name: Attest Provenance
        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

# 서명 검증 (키리스)
cosign verify \
  --certificate-identity "https://github.com/myorg/myapp/.github/workflows/sign.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/myorg/myapp@sha256:abc123...

# SBOM Attestation 검증
cosign verify-attestation \
  --type cyclonedx \
  --certificate-identity "https://github.com/myorg/myapp/.github/workflows/sign.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/myorg/myapp@sha256:abc123...

# Rekor 투명성 로그 조회
rekor-cli search --sha sha256:abc123...

# ❌ 위험: 태그는 덮어쓰기 가능
- uses: actions/checkout@v4

# ✅ 안전: 커밋 해시는 불변
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.7

# ❌ 전역 쓰기 권한 (기본값이 위험할 수 있음)
permissions: write-all

# ✅ 필요한 최소 권한만
permissions:
  contents: read
  packages: write
  id-token: write   # OIDC만

# ❌ 위험: 장기 키 유출 시 무제한 접근
- name: Configure AWS
  env:
    AWS_ACCESS_KEY_ID: ${{ secrets.AWS_KEY }}
    AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET }}

# ✅ 안전: 임시 토큰 (15분 유효)
- name: Configure AWS (OIDC)
  uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502
  with:
    role-to-assume: arn:aws:iam::123456789012:role/github-actions
    aws-region: ap-northeast-2
    # AWS IAM Trust Policy에서 repo·branch·workflow를 조건으로 제한

# PR 빌드: 테스트만 (시크릿 접근 불가)
on:
  pull_request:
    branches: [main]

# Main 빌드: 빌드 + 배포 (시크릿 접근 가능)
on:
  push:
    branches: [main]

# ❌ 매우 위험: 외부 PR 코드가 시크릿에 접근 가능
on: pull_request_target

# ✅ 안전: 외부 PR에는 시크릿 미노출
on: pull_request

# .npmrc (npm)
@myorg:registry=https://npm.pkg.github.com
# 내부 스코프 패키지는 반드시 Private Registry에서만 가져옴

# settings.xml (Maven)
<mirrors>
  <mirror>
    <id>internal-only</id>
    <mirrorOf>*</mirrorOf>
    <url>https://nexus.internal.com/repository/maven-public/</url>
  </mirror>
</mirrors>

# CI에서 lock 파일 일관성 강제
- name: Install (frozen lockfile)
  run: npm ci    # package-lock.json과 정확히 일치해야 함
  # npm install은 lock 파일을 수정할 수 있어 위험

# Gradle
- name: Verify dependency checksums
  run: ./gradlew --write-verification-metadata sha256
  # gradle/verification-metadata.xml 생성 → CI에서 검증

# .github/workflows/security-scan.yml
name: Security Scan

on:
  pull_request:
  schedule:
    - cron: '0 6 * * 1'   # 매주 월요일 06:00 UTC

permissions:
  contents: read
  security-events: write

jobs:
  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

      # Trivy로 종합 취약점 스캔
      - name: Trivy Vulnerability Scan
        uses: aquasecurity/trivy-action@7b7aa354d6fee01c15c5a35820aaca9bb3476551
        with:
          scan-type: fs
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH

      # GitHub Security tab에 결과 업로드
      - name: Upload to Security Tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Build Image
        run: docker build -t myapp:scan .

      - name: Trivy Container Scan
        uses: aquasecurity/trivy-action@7b7aa354d6fee01c15c5a35820aaca9bb3476551
        with:
          image-ref: myapp:scan
          format: table
          severity: CRITICAL,HIGH
          exit-code: 1   # 발견 시 빌드 실패

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
        with:
          fetch-depth: 0    # 전체 히스토리 (과거 커밋 포함)

      - name: gitleaks
        uses: gitleaks/gitleaks-action@cb7149a9b57195b609c63e8518d2c6056677d2d0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# kyverno-image-verify.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce    # 위반 시 배포 차단
  background: false
  rules:
    - name: verify-cosign-signature
      match:
        any:
          - resources:
              kinds:
                - Pod
      verifyImages:
        - imageReferences:
            - "ghcr.io/myorg/*"
          attestors:
            - entries:
                - keyless:
                    issuer: "https://token.actions.githubusercontent.com"
                    subject: "https://github.com/myorg/*/.github/workflows/*@refs/heads/main"
                    rekor:
                      url: "https://rekor.sigstore.dev"
          attestations:
            - type: https://cyclonedx.org/bom
              conditions:
                any:
                  - all:
                      - key: "{{ components[].name }}"
                        operator: AnyNotIn
                        value: ["blocked-library-v1"]

# policy.rego
package kubernetes.admission

deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    not startswith(container.image, "ghcr.io/myorg/")
    msg := sprintf("Untrusted registry: %v. Only ghcr.io/myorg/ allowed.", [container.image])
}

deny[msg] {
    input.request.kind.kind == "Pod"
    container := input.request.object.spec.containers[_]
    not contains(container.image, "@sha256:")
    msg := sprintf("Image %v must use digest (@sha256:), not tag.", [container.image])
}

flowchart TD
    Dev[Developer] -->|Push| Repo[Git Repository]
    
    subgraph CI [CI Pipeline - GitHub Actions]
        Repo -->|PR| Test[Unit Test + Lint]
        Test -->|Pass| SecScan[Security Scan<br/>gitleaks + Trivy]
        SecScan -->|Pass| Build[Docker Build]
        Build --> SBOM[SBOM 생성<br/>Syft CycloneDX]
        Build --> Sign[Cosign 서명<br/>Keyless OIDC]
        SBOM --> Attest[SBOM Attestation<br/>Cosign attest]
        Sign --> Prov[SLSA Provenance<br/>attest-build-provenance]
    end
    
    subgraph Registry [Container Registry]
        Attest --> GHCR[GHCR<br/>Image + Sig + SBOM + Provenance]
    end
    
    subgraph K8s [Kubernetes Cluster]
        GHCR -->|Pull| Verify{Kyverno<br/>서명 검증}
        Verify -->|Valid| Deploy[Deploy ✅]
        Verify -->|Invalid| Block[Block 🛑]
    end
    
    Rekor[(Rekor<br/>투명성 로그)] -.-> Sign
    Fulcio[(Fulcio<br/>인증서)] -.-> Sign

# .github/workflows/scorecard.yml
name: OpenSSF Scorecard

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read
  security-events: write

jobs:
  scorecard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
      
      - name: Run Scorecard
        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46
        with:
          results_file: scorecard.json
          results_format: json

      - name: Upload Results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: scorecard.json