Building DevSecOps Pipeline with GitLab CI

基于GitLab CI构建DevSecOps流水线

Overview

概述

GitLab provides an integrated DevSecOps platform that embeds security testing directly into the CI/CD pipeline. By leveraging GitLab's built-in security scanners---SAST, DAST, container scanning, dependency scanning, secret detection, and license compliance---teams can shift security left, catching vulnerabilities during development rather than post-deployment. GitLab Duo AI assists with false positive detection for SAST vulnerabilities, helping security teams focus on genuine issues.

GitLab提供了一个集成式DevSecOps平台，可将安全测试直接嵌入CI/CD流水线。通过利用GitLab内置的安全扫描器——SAST、DAST、容器扫描、依赖项扫描、密钥检测和许可证合规性检查——团队可以将安全左移，在开发阶段而非部署后发现漏洞。GitLab Duo AI可协助检测SAST漏洞中的误报，帮助安全团队专注于真正的问题。

When to Use

适用场景

When deploying or configuring building devsecops pipeline with gitlab ci capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

在您的环境中部署或配置基于GitLab CI能力的DevSecOps流水线时
建立符合合规要求的安全控制措施时
构建或改进该领域的安全架构时
开展需要此实现的安全评估时

Prerequisites

前提条件

GitLab Ultimate license (required for full security scanner suite)
GitLab Runner configured (shared or self-hosted)
```
.gitlab-ci.yml
```
pipeline configuration familiarity
Docker-in-Docker (DinD) or Kaniko for container builds
Application deployed to a staging environment for DAST scanning

GitLab Ultimate许可证（完整安全扫描器套件所需）
已配置GitLab Runner（共享或自托管）
熟悉
```
.gitlab-ci.yml
```
流水线配置
用于容器构建的Docker-in-Docker (DinD)或Kaniko
已部署到预发布环境的应用程序（用于DAST扫描）

Core Security Scanning Stages

核心安全扫描阶段

Static Application Security Testing (SAST)

静态应用安全测试（SAST）

SAST analyzes source code for vulnerabilities before compilation. GitLab supports 14+ languages using analyzers such as Semgrep, SpotBugs, Gosec, Bandit, and NodeJsScan. The simplest inclusion uses GitLab's managed templates.

SAST在编译前分析源代码中的漏洞。GitLab使用Semgrep、SpotBugs、Gosec、Bandit和NodeJsScan等分析器支持14+种语言。最简单的集成方式是使用GitLab的托管模板。

Dynamic Application Security Testing (DAST)

动态应用安全测试（DAST）

DAST tests running applications by simulating attack payloads against HTTP endpoints. It detects XSS, SQLi, CSRF, and other runtime vulnerabilities that static analysis cannot find. DAST requires a deployed, accessible target URL.

DAST通过向HTTP端点模拟攻击载荷来测试运行中的应用程序。它可以检测XSS、SQL注入、CSRF以及静态分析无法发现的其他运行时漏洞。DAST需要一个已部署且可访问的目标URL。

Container Scanning

容器扫描

Uses Trivy to scan Docker images for known CVEs in OS packages and application dependencies. Runs after the Docker build stage to gate images before they reach a registry.

使用Trivy扫描Docker镜像，查找操作系统包和应用程序依赖项中的已知CVE。在Docker构建阶段之后运行，以在镜像进入注册表前进行管控。

Dependency Scanning

依赖项扫描

Inspects dependency manifests (package.json, requirements.txt, pom.xml, Gemfile.lock) for known vulnerable versions. Operates at the source code level, complementing container scanning.

检查依赖项清单（package.json、requirements.txt、pom.xml、Gemfile.lock）中的已知易受攻击版本。在源代码层面运行，与容器扫描形成互补。

Secret Detection

密钥检测

Scans commits for accidentally committed credentials, API keys, tokens, and private keys using pattern matching and entropy analysis. Runs on every commit to prevent secrets from reaching the repository.

使用模式匹配和熵分析扫描提交内容，查找意外提交的凭据、API密钥、令牌和私钥。在每次提交时运行，防止密钥进入代码仓库。

Implementation

实现步骤

Complete Pipeline Configuration

完整流水线配置

yaml

undefined

yaml

undefined

.gitlab-ci.yml

stages:

build
test
security
deploy-staging
dast
deploy-production

variables: DOCKER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA SECURE_LOG_LEVEL: "info"

stages:

build
test
security
deploy-staging
dast
deploy-production

variables: DOCKER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA SECURE_LOG_LEVEL: "info"

Include GitLab managed security templates

include:

template: Security/SAST.gitlab-ci.yml
template: Security/Secret-Detection.gitlab-ci.yml
template: Security/Dependency-Scanning.gitlab-ci.yml
template: Security/Container-Scanning.gitlab-ci.yml
template: DAST.gitlab-ci.yml
template: Security/License-Scanning.gitlab-ci.yml

build: stage: build image: docker:24.0 services: - docker:24.0-dind variables: DOCKER_TLS_CERTDIR: "/certs" script: - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY - docker build -t $DOCKER_IMAGE . - docker push $DOCKER_IMAGE rules: - if: $CI_COMMIT_BRANCH

unit-tests: stage: test image: $DOCKER_IMAGE script: - npm ci - npm run test:coverage coverage: '/Lines\s*:\s*(\d+.?\d*)%/' artifacts: reports: junit: junit-report.xml coverage_report: coverage_format: cobertura path: coverage/cobertura-coverage.xml

include:

template: Security/SAST.gitlab-ci.yml
template: Security/Secret-Detection.gitlab-ci.yml
template: Security/Dependency-Scanning.gitlab-ci.yml
template: Security/Container-Scanning.gitlab-ci.yml
template: DAST.gitlab-ci.yml
template: Security/License-Scanning.gitlab-ci.yml

build: stage: build image: docker:24.0 services: - docker:24.0-dind variables: DOCKER_TLS_CERTDIR: "/certs" script: - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY - docker build -t $DOCKER_IMAGE . - docker push $DOCKER_IMAGE rules: - if: $CI_COMMIT_BRANCH

unit-tests: stage: test image: $DOCKER_IMAGE script: - npm ci - npm run test:coverage coverage: '/Lines\s*:\s*(\d+.?\d*)%/' artifacts: reports: junit: junit-report.xml coverage_report: coverage_format: cobertura path: coverage/cobertura-coverage.xml

Override SAST to run in security stage

sast: stage: security variables: SAST_EXCLUDED_PATHS: "spec,test,tests,tmp,node_modules" SEARCH_MAX_DEPTH: 10

Override container scanning

container_scanning: stage: security variables: CS_IMAGE: $DOCKER_IMAGE CS_SEVERITY_THRESHOLD: "HIGH"

Override dependency scanning

dependency_scanning: stage: security

Override secret detection

secret_detection: stage: security

License compliance scanning

license_scanning: stage: security

deploy-staging: stage: deploy-staging image: bitnami/kubectl:latest script: - kubectl set image deployment/app app=$DOCKER_IMAGE -n staging - kubectl rollout status deployment/app -n staging --timeout=300s environment: name: staging url: https://staging.example.com rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

license_scanning: stage: security

deploy-staging: stage: deploy-staging image: bitnami/kubectl:latest script: - kubectl set image deployment/app app=$DOCKER_IMAGE -n staging - kubectl rollout status deployment/app -n staging --timeout=300s environment: name: staging url: https://staging.example.com rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

DAST runs against deployed staging

dast: stage: dast variables: DAST_WEBSITE: https://staging.example.com DAST_FULL_SCAN_ENABLED: "true" DAST_BROWSER_SCAN: "true" needs: - deploy-staging rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

deploy-production: stage: deploy-production image: bitnami/kubectl:latest script: - kubectl set image deployment/app app=$DOCKER_IMAGE -n production - kubectl rollout status deployment/app -n production --timeout=300s environment: name: production url: https://app.example.com when: manual rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

undefined

dast: stage: dast variables: DAST_WEBSITE: https://staging.example.com DAST_FULL_SCAN_ENABLED: "true" DAST_BROWSER_SCAN: "true" needs: - deploy-staging rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

deploy-production: stage: deploy-production image: bitnami/kubectl:latest script: - kubectl set image deployment/app app=$DOCKER_IMAGE -n production - kubectl rollout status deployment/app -n production --timeout=300s environment: name: production url: https://app.example.com when: manual rules: - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

undefined

Security Approval Policies

安全审批策略

Configure scan execution policies to enforce mandatory security scans:

Navigate to Security & Compliance > Policies
Create a "Scan Execution Policy" requiring SAST and secret detection on all branches
Create a "Merge Request Approval Policy" requiring security team approval when critical vulnerabilities are detected

配置扫描执行策略以强制实施必需的安全扫描：

导航至“安全与合规 > 策略”
创建“扫描执行策略”，要求所有分支运行SAST和密钥检测
创建“合并请求审批策略”，当检测到严重漏洞时，要求安全团队审批

Custom SAST Ruleset Configuration

自定义SAST规则集配置

Create

.gitlab/sast-ruleset.toml

to customize analyzer behavior:

toml

[semgrep]
  [[semgrep.ruleset]]
    dirs = ["src"]

  [[semgrep.passthrough]]
    type = "url"
    target = "/sgrep-rules/custom-rules.yml"
    value = "https://semgrep.dev/p/owasp-top-ten"

  [[semgrep.passthrough]]
    type = "url"
    target = "/sgrep-rules/java-rules.yml"
    value = "https://semgrep.dev/p/java"

创建

.gitlab/sast-ruleset.toml

以自定义分析器行为：

toml

[semgrep]
  [[semgrep.ruleset]]
    dirs = ["src"]

  [[semgrep.passthrough]]
    type = "url"
    target = "/sgrep-rules/custom-rules.yml"
    value = "https://semgrep.dev/p/owasp-top-ten"

  [[semgrep.passthrough]]
    type = "url"
    target = "/sgrep-rules/java-rules.yml"
    value = "https://semgrep.dev/p/java"

Security Dashboard and Vulnerability Management

安全仪表板与漏洞管理

Vulnerability Report

漏洞报告

GitLab consolidates all scanner findings into a single Vulnerability Report accessible at Security & Compliance > Vulnerability Report. Each vulnerability includes:

Severity rating (Critical, High, Medium, Low, Info)
Scanner source (SAST, DAST, Container, Dependency, Secret)
Location in source code or image layer
Remediation guidance and suggested fixes
Status tracking (Detected, Confirmed, Dismissed, Resolved)

GitLab将所有扫描器的发现整合到一个统一的漏洞报告中，可通过“安全与合规 > 漏洞报告”访问。每个漏洞包含：

严重等级（Critical、High、Medium、Low、Info）
扫描器来源（SAST、DAST、容器、依赖项、密钥）
在源代码或镜像层中的位置
修复指南和建议修复方案
状态跟踪（已检测、已确认、已驳回、已解决）

Merge Request Security Widget

合并请求安全小部件

Every merge request displays a security scanning widget showing:

New vulnerabilities introduced by the MR
Fixed vulnerabilities resolved by the MR
Comparison against the target branch baseline

每个合并请求都会显示一个安全扫描小部件，展示：

该MR引入的新漏洞
该MR修复的已解决漏洞
与目标分支基线的对比

Pipeline Optimization

流水线优化

Parallel execution: Security scanners run concurrently in the security stage
Caching: Use CI cache for dependency downloads to speed up scanning
Incremental scanning: SAST can scan only changed files using
```
SAST_INCREMENTAL: "true"
```
Fail conditions: Set
```
allow_failure: false
```
on critical scanners to enforce quality gates

并行执行：安全扫描器在安全阶段并发运行
缓存：使用CI缓存存储依赖项下载内容，加快扫描速度
增量扫描：SAST可使用
```
SAST_INCREMENTAL: "true"
```
仅扫描变更的文件
失败条件：为关键扫描器设置
```
allow_failure: false
```
以实施质量门控

Monitoring and Metrics

监控与指标

Metric	Description	Target
Pipeline security coverage	Percentage of projects with all scanners enabled	> 95%
Critical vulnerability MTTR	Time from detection to resolution for critical findings	< 48 hours
False positive rate	Percentage of dismissed-as-false-positive findings	< 15%
Secret detection block rate	Percentage of secret commits blocked by push rules	> 99%

指标	描述	目标
流水线安全覆盖率	启用所有扫描器的项目占比	> 95%
严重漏洞平均修复时间	从检测到解决严重漏洞的时间	< 48小时
误报率	被驳回为误报的发现占比	< 15%
密钥检测拦截率	被推送规则拦截的密钥提交占比	> 99%

building-devsecops-pipeline-with-gitlab-ci

Original

Translation

Building DevSecOps Pipeline with GitLab CI

基于GitLab CI构建DevSecOps流水线

Overview

概述

When to Use

适用场景

Prerequisites

前提条件

Core Security Scanning Stages

核心安全扫描阶段

Static Application Security Testing (SAST)

静态应用安全测试（SAST）

Dynamic Application Security Testing (DAST)

动态应用安全测试（DAST）

Container Scanning

容器扫描

Dependency Scanning

依赖项扫描

Secret Detection

密钥检测

Implementation

实现步骤

Complete Pipeline Configuration

完整流水线配置

.gitlab-ci.yml

.gitlab-ci.yml

Include GitLab managed security templates

Include GitLab managed security templates

Override SAST to run in security stage

Override SAST to run in security stage

Override container scanning

Override container scanning

Override dependency scanning

Override dependency scanning

Override secret detection

Override secret detection

License compliance scanning

License compliance scanning

DAST runs against deployed staging

DAST runs against deployed staging

Security Approval Policies

安全审批策略

Custom SAST Ruleset Configuration

自定义SAST规则集配置

Security Dashboard and Vulnerability Management

安全仪表板与漏洞管理

Vulnerability Report

漏洞报告

Merge Request Security Widget

合并请求安全小部件

Pipeline Optimization

流水线优化

Monitoring and Metrics

监控与指标

References

参考资料