Add DevSecOps security pipeline

.github/workflows/dast.yml

@@ -0,0 +1,127 @@
+name: dast
+
+# Динамический анализ: поднимаем DefectDojo через его штатный docker-compose
+# и сканируем OWASP ZAP (baseline + full). Тяжёлый full-scan — по расписанию и вручную.
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 2 * * 1"   # еженедельно, пн 02:00 UTC
+  push:
+    branches: [ main, master, devsecops-pipeline ]
+
+permissions:
+  contents: read
+  issues: write
+  security-events: write
+
+env:
+  TARGET_URL: http://localhost:8080
+  REPORTS_DIR: reports
+
+jobs:
+  dast:
+    name: OWASP ZAP
+    runs-on: self-hosted
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build & start DefectDojo
+        run: |
+          mkdir -p "$REPORTS_DIR"
+          # DefectDojo требует профиль БД; предпочитаем штатные helper-скрипты
+          if [ -x ./dc-build.sh ] && [ -x ./dc-up-d.sh ]; then
+            ./dc-build.sh
+            ./dc-up-d.sh postgres-redis
+          else
+            docker compose build
+            docker compose --profile postgres-redis up -d
+          fi
+          echo "Ожидаем инициализацию (миграции, статик, суперюзер)..."
+
+      - name: Wait for service
+        run: |
+          for i in $(seq 1 60); do
+            if curl -skf "$TARGET_URL/login" >/dev/null; then
+              echo "DefectDojo поднят"; exit 0
+            fi
+            echo "ждём... ($i/60)"; sleep 15
+          done
+          echo "Сервис не поднялся вовремя"; docker compose logs --tail=100; exit 1
+
+      # --- ZAP baseline (пассивный, быстрый) ---
+      - name: ZAP Baseline Scan
+        uses: zaproxy/action-baseline@v0.12.0
+        continue-on-error: true
+        with:
+          target: ${{ env.TARGET_URL }}
+          rules_file_name: .zap/rules.tsv
+          cmd_options: "-J zap-baseline.json -w zap-baseline.md"
+          allow_issue_writing: true
+
+      # --- ZAP full scan (активный: инъекции, обход и т.п.) ---
+      - name: ZAP Full Scan
+        uses: zaproxy/action-full-scan@v0.12.0
+        continue-on-error: true
+        with:
+          target: ${{ env.TARGET_URL }}
+          rules_file_name: .zap/rules.tsv
+          cmd_options: "-J zap-full.json"
+          allow_issue_writing: false
+
+      # --- ZAP АУТЕНТИФИЦИРОВАННЫЙ скан (browser-based, обходит CSRF Django) ---
+      - name: ZAP Authenticated Scan
+        continue-on-error: true
+        env:
+          ZAP_USER: ${{ secrets.ZAP_USER }}
+          ZAP_PASSWORD: ${{ secrets.ZAP_PASSWORD }}
+        run: |
+          mkdir -p zap_wrk && chmod 777 zap_wrk
+          cp .zap/zap-auth.yaml zap_wrk/
+          docker run --rm --network host \
+            -e ZAP_USER -e ZAP_PASSWORD \
+            -v "$PWD/zap_wrk:/zap/wrk:rw" \
+            ghcr.io/zaproxy/zaproxy:stable \
+            zap.sh -cmd -autorun /zap/wrk/zap-auth.yaml || true
+
+      - name: Collect ZAP reports
+        if: always()
+        run: |
+          cp -v zap-baseline.json "$REPORTS_DIR/" 2>/dev/null || true
+          cp -v zap-full.json "$REPORTS_DIR/" 2>/dev/null || true
+          # аутентифицированные отчёты: SARIF для гейта + traditional-json для DefectDojo
+          cp -v zap_wrk/zap-auth.sarif "$REPORTS_DIR/" 2>/dev/null || true
+          cp -v zap_wrk/zap-auth.json "$REPORTS_DIR/zap-auth.sarif" 2>/dev/null || true
+          cp -v zap_wrk/zap-auth-dojo.json "$REPORTS_DIR/" 2>/dev/null || true
+
+      - name: Upload ZAP results to DefectDojo
+        if: always()
+        continue-on-error: true
+        env:
+          DOJO_URL: ${{ secrets.DOJO_URL }}
+          DOJO_TOKEN: ${{ secrets.DOJO_TOKEN }}
+          DOJO_PRODUCT: "DefectDojo (self)"
+          DOJO_ENGAGEMENT: "DAST ${{ github.ref_name }}"
+        run: |
+          python3 -m pip install requests
+          python3 security/dojo_upload.py --stage dast
+
+      - name: Security Gateway (DAST)
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GATE_FAIL_ON: CRITICAL   # DAST шумит — блокируем только на critical
+        run: |
+          python3 security/gate.py --reports "$REPORTS_DIR"
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: dast-reports
+          path: |
+            ${{ env.REPORTS_DIR }}
+            zap-*.md
+
+      - name: Tear down
+        if: always()
+        run: docker compose down -v

.github/workflows/security.yml

@@ -0,0 +1,148 @@
+name: security
+
+# SAST + SCA + secrets + IaC/image checks + Security Gateway.
+# Все отчёты приводятся к SARIF, публикуются во вкладку Security,
+# выгружаются в DefectDojo и проходят через gate.py.
+#
+# ВНИМАНИЕ: версии сторонних actions приведены как ориентир. Перед сдачей
+# зафиксируйте их (лучше — к commit SHA) и проверьте актуальность.
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write     # для комментариев gate.py в PR
+  security-events: write   # для загрузки SARIF во вкладку Security
+
+env:
+  REPORTS_DIR: reports
+
+jobs:
+  sast-sca:
+    name: SAST / SCA / IaC
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # нужна полная история для Gitleaks
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Prepare reports dir
+        run: mkdir -p "$REPORTS_DIR"
+
+      # --- Установка сканеров ---
+      - name: Install scanners
+        run: |
+          python -m pip install --upgrade pip
+          pip install semgrep bandit bandit-sarif-formatter njsscan checkov requests
+          curl -sSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+          trivy --version
+
+      # --- SAST: Semgrep (мультиязычный) ---
+      - name: Semgrep
+        continue-on-error: true
+        run: |
+          semgrep scan \
+            --config p/default --config p/security-audit \
+            --config p/python --config p/javascript \
+            --sarif --output "$REPORTS_DIR/semgrep.sarif" || true
+
+      # --- SAST: Bandit (Python) ---
+      - name: Bandit
+        continue-on-error: true
+        run: |
+          bandit -r . -f sarif -o "$REPORTS_DIR/bandit.sarif" \
+            -x ./tests,./unittests || true
+
+      # --- SAST: njsscan (JavaScript) ---
+      - name: njsscan
+        continue-on-error: true
+        run: |
+          njsscan --sarif -o "$REPORTS_DIR/njsscan.sarif" . || true
+
+      # --- SCA: Trivy filesystem (зависимости pip/npm) ---
+      - name: Trivy filesystem (SCA)
+        continue-on-error: true
+        run: |
+          trivy fs --scanners vuln --severity MEDIUM,HIGH,CRITICAL --format sarif --output "$REPORTS_DIR/trivy-fs.sarif" . || true
+
+      # --- IaC / Dockerfile misconfig: Trivy config ---
+      - name: Trivy config (IaC)
+        continue-on-error: true
+        run: |
+          trivy config --format sarif --output "$REPORTS_DIR/trivy-config.sarif" . || true
+
+      # --- IaC: Checkov (docker-compose / Dockerfile) ---
+      - name: Checkov
+        continue-on-error: true
+        run: |
+          checkov -d . --framework dockerfile,docker_compose \
+            -o sarif --output-file-path "$REPORTS_DIR" || true
+          # checkov кладёт results.sarif в каталог — переименуем
+          [ -f "$REPORTS_DIR/results.sarif" ] && mv "$REPORTS_DIR/results.sarif" "$REPORTS_DIR/checkov.sarif" || true
+
+      # --- Dockerfile lint: Hadolint по ВСЕМ Dockerfile форка ---
+      - name: Hadolint (all Dockerfiles)
+        continue-on-error: true
+        run: |
+          # (зона роста: пиннинговать версию вместо latest)
+          curl -sSL -o /tmp/hadolint \
+            https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64
+          chmod +x /tmp/hadolint
+          files=$(git ls-files | grep -Ei '(^|/)Dockerfile' | sort -u || true)
+          echo "Найдены Dockerfile: $files"
+          if [ -n "$files" ]; then
+            /tmp/hadolint -f sarif $files > "$REPORTS_DIR/hadolint.sarif" || true
+          fi
+
+      # --- Секреты: Gitleaks ---
+      - name: Gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_UPLOAD_ARTIFACT: "false"
+        with:
+          # SARIF окажется в results.sarif — скопируем ниже
+          args: detect --report-format sarif --report-path ${{ env.REPORTS_DIR }}/gitleaks.sarif --redact
+
+      # --- Публикация во вкладку Security (GitHub code scanning) ---
+      - name: Upload SARIF to GitHub Security
+        uses: github/codeql-action/upload-sarif@v3
+        continue-on-error: true
+        with:
+          sarif_file: ${{ env.REPORTS_DIR }}
+
+      # --- Выгрузка в DefectDojo ---
+      - name: Upload results to DefectDojo
+        continue-on-error: true
+        env:
+          DOJO_URL: ${{ secrets.DOJO_URL }}
+          DOJO_TOKEN: ${{ secrets.DOJO_TOKEN }}
+          DOJO_PRODUCT: "DefectDojo (self)"
+          DOJO_ENGAGEMENT: "CI ${{ github.ref_name }}"
+        run: |
+          python security/dojo_upload.py --stage sast
+
+      # --- Сохранить отчёты как артефакт ---
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: sast-reports
+          path: ${{ env.REPORTS_DIR }}
+
+      # --- SECURITY GATEWAY ---
+      - name: Security Gateway
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GATE_FAIL_ON: HIGH        # Critical/High роняют пайплайн
+        run: |
+          python security/gate.py --reports "$REPORTS_DIR"

.zap/rules.tsv

@@ -0,0 +1,7 @@
+# ZAP scan rules — управление уровнем алертов (FAIL / WARN / IGNORE)
+# Формат: <alertId>\t<threshold>\t<comment>
+# Полный список ID: https://www.zaproxy.org/docs/alerts/
+# Ниже — пример подавления типичного шума на dev-инстансе.
+10015	WARN	(Incomplete or No Cache-control Header Set)
+10096	IGNORE	(Timestamp Disclosure — низкий риск на тестовом стенде)
+10027	IGNORE	(Information Disclosure - Suspicious Comments)

.zap/zap-auth.yaml

@@ -0,0 +1,76 @@
+# ZAP Automation Framework — АУТЕНТИФИЦИРОВАННЫЙ скан DefectDojo.
+# Browser-based авторизация: ZAP реально заполняет форму логина в headless-браузере,
+# поэтому Django CSRF-токен (csrfmiddlewaretoken) подхватывается автоматически.
+#
+# Запуск (см. dast.yml):
+#   docker run --network host -e ZAP_USER -e ZAP_PASSWORD \
+#     -v $PWD/zap_wrk:/zap/wrk:rw ghcr.io/zaproxy/zaproxy:stable \
+#     zap.sh -cmd -autorun /zap/wrk/zap-auth.yaml
+# ${ZAP_USER}/${ZAP_PASSWORD} подставляются ZAP из переменных окружения.
+
+env:
+  contexts:
+    - name: defectdojo
+      urls:
+        - "http://localhost:8080"
+      includePaths:
+        - "http://localhost:8080.*"
+      excludePaths:
+        - "http://localhost:8080/logout.*"
+        - ".*/logout/?$"
+      authentication:
+        method: "browser"
+        parameters:
+          loginPageUrl: "http://localhost:8080/login"
+          loginPageWait: 5
+          browserId: "firefox-headless"
+        verification:
+          method: "poll"
+          loggedInRegex: '\\bLogout\\b'
+          loggedOutRegex: '\\bLogin\\b'
+          pollUrl: "http://localhost:8080/"
+          pollFrequency: 60
+          pollUnits: "requests"
+      sessionManagement:
+        method: "cookie"
+      users:
+        - name: "zaptester"
+          credentials:
+            username: "${ZAP_USER}"
+            password: "${ZAP_PASSWORD}"
+  parameters:
+    failOnError: false
+    failOnWarning: false
+    progressToStdout: true
+
+jobs:
+  - type: spider
+    parameters:
+      context: defectdojo
+      user: "zaptester"
+      maxDuration: 5
+  - type: spiderAjax
+    parameters:
+      context: defectdojo
+      user: "zaptester"
+      maxDuration: 5
+      browserId: "firefox-headless"
+  - type: passiveScan-wait
+    parameters:
+      maxDuration: 5
+  - type: activeScan
+    parameters:
+      context: defectdojo
+      user: "zaptester"
+      maxRuleDurationInMins: 3
+      maxScanDurationInMins: 30
+  - type: report               # для Security Gateway
+    parameters:
+      template: "sarif-json"
+      reportDir: "/zap/wrk"
+      reportFile: "zap-auth"
+  - type: report               # для нативного парсера DefectDojo
+    parameters:
+      template: "traditional-json"
+      reportDir: "/zap/wrk"
+      reportFile: "zap-auth-dojo"