Kev kawm paub tsim ib ceg hauv GitHub yog thawj kauj ruam. Txawm li cas los xij, kev paub txog kev sib koom ua ke cov ceg hauv GitHub kom muaj kev nyab xeeb kuj tseem ceeb rau txhua ceg. GitHub ua haujlwm. Yog li, hauv tsab ntawv no, peb yuav coj koj mus rau tag nrho cov txheej txheem, pib nrog yuav ua li cas los tsim ib ceg hauv GitHub thiab tom qab ntawd qhia koj yuav ua li cas koom ua ke cov ceg hauv GitHub muaj kev nyab xeeb. Peb kuj yuav tham txog yuav ua li cas thiaj li tshem tawm kev sib koom ua ke yog tias koj pom muaj teeb meem, thiab thaum kawg, Xygeni tuaj yeem pab koj ntes txhua qhov teeb meem ua ntej nws nkag mus rau hauv koj ceg tseem ceeb.
Cia peb taug kev los ntawm nws ib kauj ruam zuj zus.
1. Yuav ua li cas los tsim ib ceg hauv GitHub txoj kev zoo
Txhua txoj haujlwm ruaj ntseg pib thaum koj tsim ib ceg hauv GitHub. Nws tso cai rau cov neeg tsim khoom cais cov yam ntxwv, kev kho, lossis kev sim yam tsis muaj kev cuam tshuam rau cov lej tsim khoom.
Yuav tsim ib ceg hauv GitHub li cas:
1. Mus rau koj lub chaw khaws ntaub ntawv
2. Nyem rau ntawm qhov xaiv ceg ntoo
3. Sau lub npe ntawm koj ceg tshiab
4. Nyem Tsim ceg
Txij ntawm no mus, koj ceg tshiab npaj txhij mus lawm. Tam sim no koj tuaj yeem thawb cov lej, koom tes rau kev hloov pauv, thiab thaum kawg qhib ib qho pull requestTxawm hais tias qhov no yog ib qho kev nqis tes ua yooj yim ntawm GitHub, nws teeb tsa theem rau kev txhim kho kev nyab xeeb.
Qhov tseem ceeb, txhua zaus koj tsim ib ceg hauv GitHub, nws yuav tsum yog ib feem ntawm cov txheej txheem ua haujlwm rov ua dua thiab muaj kev tiv thaiv.
2. Luam theej duab Pull Requests Ua Ntej Koj Sib Koom Ua Ke
Thaum koj tsim ib ceg hauv GitHub thiab npaj rau kev tshuaj xyuas, kauj ruam tom ntej yog nkag siab txog yuav ua li cas koom ua ke cov ceg hauv GitHub kom ruaj ntseg. Txhua ceg GitHub thawb yuav tsum ua rau muaj kev kuaj xyuas tsis siv neeg. Tab sis ua ntej koom ua ke, nws yog qhov tseem ceeb rau xyuas uas cov code tsis qhia txog qhov tsis muaj zog. Ib qho tsis muaj kev nyab xeeb commit tuaj yeem qhia koj daim ntawv thov, leak secrets, lossis rhuav tshem cov khoom siv tseem ceeb.
Kev muab cov code sib koom ua ke rau hauv koj ceg tseem ceeb yog ib qho kev ua haujlwm uas muaj feem cuam tshuam loj heev. Yog tsis muaj kev kuaj xyuas kom zoo, nws tuaj yeem ua rau muaj teeb meem loj xws li:
- Qhov tsis muaj zog ntawm xoom hnub poob rau hauv kev tsim khoom
- Paub Tias Cov CVE tau qhia los ntawm cov pob khoom qhib
- Cov lus zais nyuaj tau xa mus rau lub chaw khaws ntaub ntawv
- Kev teeb tsa tsis raug ntawm cov khoom siv hauv paus uas ua rau koj txoj kev tiv thaiv tsis muaj zog
- Cov lej phem lossis cov lej raug hloov pauv nkag mus los ntawm kev vam khom
Qhov no yog qhov uas Xygeni ua qhov sib txawv tiag tiag
Los ntawm kev siv Kev ua GitHub, koj tuaj yeem ua kom lub zog kev tshuaj xyuas Xygeni tsis siv neeg thaum twg tus tsim tawm qhib ib qho pull request mus rau hauv ib ceg uas muaj kev tiv thaiv. Ib ceg uas muaj kev tiv thaiv hauv GitHub yog ib ceg uas xav tau kev kuaj xyuas lossis kev pom zoo tshwj xeeb ua ntej kev hloov pauv raug tso cai sib koom ua ke.
Xygeni tshuaj xyuas qhov kev ua tiav qhov tseeb pull request workflow los xyuas kom meej tias qhov kev ruaj ntseg ntawm cov kev hloov pauv uas tau thov. Qhov no suav nrog kev kuaj xyuas cov teeb meem hauv cov lej, kev vam khom, cov lus zais, thiab CI/CD configurationsTag nrho ceg tsis tau rov luam theej dua, tab sis cov txiaj ntsig ua haujlwm tshiab tshaj plaws yog siv los ua kom muaj cov cai thiab thaiv kev sib koom ua ke tsis muaj kev nyab xeeb.
Cov kev luam theej no ua pov thawj tias cov lej muaj kev nyab xeeb thiab npaj txhij rau kev tsim khoom. Lawv ntes tau:
- Qhov tsis muaj zog ntawm cov lej (SAST)
- Cov pob khoom qhib uas tsis muaj zog (SCA)
- Cov lus zais nyuaj
- IaC kev teeb tsa tsis raug
- Tej zaum yuav muaj malware
Sib koom ua ke cov kev kuaj xyuas no ua kom ntseeg tau tias thaum ntxov tias txhua zaus koj tsim ib ceg hauv GitHub thiab npaj los sib koom ua ke, koj ua nws nrog tag nrho visibility thiab tswj.
Nov yog kev teeb tsa yooj yim:
on: pull_request: branches: [ main ] jobs: xygeni-scan: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v3 - name: Xygeni Scanner uses: xygeni/xygeni-action@3.2.0 with: token: ${{ secrets.XYGENI_TOKEN }}3. Thaiv Kev Tsis Nyab Xeeb Sib Koom Tes nrog Guardrails
Guardrails, xyuas kom meej tias thaum koj tsim ib ceg hauv GitHub lossis sim ua li cas koom ua ke ceg hauv GitHub, tsuas yog cov kev hloov pauv nyab xeeb mus txog koj ceg tseem ceeb GitHub teeb tsa. Xygeni muab rau koj kev tswj hwm tag nrho rau yam uas tau koom ua keKoj tuaj yeem txhais ua ntejcisCov cai uas tau tsim los rau koj cov cai kev ruaj ntseg thiab kev kam rau kev pheej hmoo. Piv txwv li:
- Thaiv yog tias muaj qhov zais cia tseem ceeb pom muaj (piv txwv li, AWS keys, tokens)
- Ua tsis tiav qhov kev tsim kho yog tias ib kev pheej hmoo siab tshiab pob khoom qhib tau qhia tawm
- Tsis kam pull requests uas hloov kho cov kev nkag siab zoo li
.github/workflows/,infrastructure/, los yogsecrets.env - Tiv thaiv kev sib koom ua ke yog tias ib downgrade rov qhia dua paub vulnerabilities
- Thaiv CI/CD kev hloov kho tshwj tsis yog tias tau sau npe kom raug
- Tsum kev sib koom ua ke yog tias SAST ntes tau siab lossis cov teeb meem tseem ceeb
- Siv cov kev cai nruj dua Guardrails ntawm cov ceg tsim khoom thaum ua kom yooj ywm hauv kev loj hlob
Cov cai no ua haujlwm zoo li cov neeg saib xyuas lub rooj vag tsis siv neeg. Lawv pab koj pab neeg sib koom ua ke tsuas yog yam uas muaj kev nyab xeeb xwb, tsis muaj kev xav tsis thoob, tsis muaj kev tshuaj xyuas tes, tsis muaj kev tua hluav taws thaum kawg.
Piv txwv txoj cai Guardrail:
guardrail block_critical_secrets on secrets when severity = critical then @fail()Cov Lus Teb Rov Qab Hauv Qhov Muag Dashboard
Yuav kom pom tseeb tag nrho, Xygeni qhia cov txiaj ntsig ntawm qhov kev ntsuam xyuas tshiab ntawm Guardrail status.
- Ua ntej txhua yam, lub cim ntsuab txhais tau tias txhua txoj cai tau dhau los.
- Qhov sib txawv, lub cim liab qhia tias ib lossis ntau qhov xwm txheej Guardrail raug ua txhaum.
Yog li ntawd, ob tus neeg tsim khoom thiab pab pawg kev ruaj ntseg tau txais kev nkag siab tam sim ntawd txog vim li cas kev sib koom ua ke raug thaiv, yam tsis tau khawb rau hauv CI cav.
Piv txwv tiag tiag los ntawm Dashboard:
Piv txwv li, Cia peb hais tias lub chaw cia khoom tsis muaj ceg tiv thaiv, qhov kev teeb tsa tsis raug uas tso cai rau cov neeg tsim khoom thawb commits yam tsis muaj kev txheeb xyuas. Qhov ntawd yog qhov txaus ntshai heev.
Xygeni cia li ntes thiab cim qhov no ua ib qho kos npe_commits qhov teeb meem nyob rau hauv CI/CD qeb. Cov dashboard Cov ntsiab lus tseem ceeb:
- Mob hnyav: High
- hom: Kos npe Commits
- Piav qhia: Lub chaw cia khoom tsis muaj ceg tiv thaiv
- raws li txoj cai: Qhib
Yog li ntawd, nrog cov lus taw qhia nplua nuj no, cov pab pawg tuaj yeem txheeb xyuas qhov kev pheej hmoo sai sai, nkag siab txog nws qhov cuam tshuam, thiab ua cov kauj ruam kho, txhua yam los ntawm Xygeni UI.
customize Kev coj ua raws li txoj cai
Koj yeej ib txwm tswj tau koj tus kheej. Xaiv seb koj yuav ua li cas nruj Guardrails yuav tsum:
--fail-on=critical: Kev sib koom ua ke ntawm cov khoom siv tsuas yog thaum muaj kev tshawb pom loj heev--never-fail: khiav Guardrails nyob rau hauv hom qhuav-khiav los sim cov cai ua ntej siv
Yog li ntawd, lub sijhawm tom ntej koj tsim ib ceg hauv GitHub, koj Guardrails twb nyob ntawd lawm, tiv thaiv koj pipeline thiab siv koj cov cai tsis siv neeg.
Kuv Yuav Paub Li Cas Yog Tias GitHub App Muaj Kev Nyab Xeeb?
Kawm paub yuav ua li cas soj ntsuam GitHub Apps ua ntej nruab lawv.
4. Tshem tawm Kev Sib Koom Ua Ke hauv GitHub Thaum Pom Kev Pheej Hmoo
Yog tias pom muaj kev pheej hmoo, qhov kev sib koom ua ke yuav raug tshem tawm. Qhov kev tiv thaiv no tiv thaiv txhua ceg GitHub project thiab ua kom muaj kev coj ua zoo tshaj plaws ntawm kev sib koom ua ke ceg hauv GitHub.
Xygeni sib koom ua ke ncaj qha rau hauv GitHub's UI. Thaum pom muaj kev pheej hmoo:
- GitHub qhia tias qhov kev kuaj xyuas ua tsis tiav
- GitHub txoj kev tiv thaiv tiv thaiv kev sib koom ua ke
- Cov kab sib koom ua ke hla cov lej tsis ruaj ntseg
Txawm nws yog ib qho zais cia, CVE, lossis txaus ntshai CI/CD qauv, qhov tshwm sim yog tib yam: tus Kev sib koom ua ke raug tshem tawm hauv GitHub thiab tau cim rau kev tshuaj xyuas.
Koj tuaj yeem saib cov txiaj ntsig ntxaws ntxaws hauv Xygeni:
- Qhov xwm txheej kev ruaj ntseg ntawm txhua ceg
- Vim li cas kev sib koom ua ke raug thaiv
- Ua tiav keeb kwm scan
- Cov xwm txheej ntawm txoj kev tiv thaiv qhia los ntawm cov cim ntsuab (dhau) lossis liab (ua tsis tiav) hauv nplooj ntawv project
Cov lus tawm tswv yim pom no ua rau nws yooj yim rau cov neeg tsim khoom thiab cov pab pawg kev ruaj ntseg los ua haujlwm nrog kev ntseeg siab. Thiab thaum koj xav tau cov ntsiab lus tob dua, txhua qhov teeb meem txuas mus rau cov ntaub ntawv nrog qhov hnyav, cov cim npe, qhov chaw, thiab cov lus qhia txog kev txo qis.
Tldr Merge Xwb Yam Uas Muaj Kev Nyab Xeeb
Hauv kev xaus lus, ntawm no yog yuav ua li cas sib koom ua ke kom ruaj ntseg tom qab koj tsim ib ceg hauv GitHub:
- Tsim ib ceg hauv GitHub los ntawm UI
- Qhib kev luam theej duab tsis siv neeg nrog txhua pull request nrog Xygeni
- Thaiv kev sib koom ua ke uas tsis ruaj ntseg siv Guardrails
- Siv cov cai tshuaj xyuas sab server rau kev tswj hwm tob dua
- Tshem tawm kev sib koom ua ke hauv GitHub thaum muaj qee yam tsis ua tiav
- Saib tag nrho cov txiaj ntsig hauv Xygeni's dashboard
Yog xav paub ntxiv txog kev tiv thaiv chaw cia khoom, nyeem peb cov lus qhia Cov Lus Nug Txog Kev Ruaj Ntseg ntawm GitHub: Txhua Tus Kws Tsim Khoom Yuav Tsum Paub Dab Tsi.
Txawm hais tias kev sib koom ua ke yog ib qho kev ua haujlwm yooj yim, kev ua nws kom ruaj ntseg yuav tsum tau pom tseeb thiab kev ua haujlwm tsis siv neeg. Nrog Xygeni, koj tsis yog tsuas yog sib koom ua ke cov lej xwb, koj kuj sib koom ua ke kev ntseeg siab.
Tiv thaiv txhua ceg GitHub nrog kev ntseeg siab
Ib qho teeb meem uas tsis tau saib xyuas hauv ib qho pull request tuaj yeem ua rau koj ceg tseem ceeb puas tsuaj. Cov tshuab luam theej ib txwm feem ntau khiav lig dhau, tsis pom qhov txaus ntshai tseem ceeb, lossis ua tsis tau raws li cov cai tseem ceeb.
Yog vim li ntawd kev tiv thaiv koj cov ceg GitHub yuav tsum tau ntau dua li tsuas yog luam theej duab xwb.
Xygeni muab kev siv zog tiag tiag. Thaum twg a pull request tsom mus rau ib ceg uas muaj kev tiv thaiv, Xygeni tshuaj xyuas qhov kev ua tiav tshiab kawg ntawm koj CI/CD kev ua haujlwm. Nws tsis rov luam theej tag nrho ceg. Hloov chaw, nws ntsuas cov txiaj ntsig tshiab tshaj plaws los xyuas seb puas muaj teeb meem kev ruaj ntseg hauv cov lej, kev vam khom, kev zais cia, thiab kev teeb tsa kev ua haujlwm. Koj tsis yog tsuas yog ceeb toom xwb. Koj tau txais kev tiv thaiv.
Dab tsi ua rau nws txawv:
- Kev lees paub tag nrho cov ntsiab lus: Guardrails siv txoj cai siv cov ntsiab lus nplua nuj xws li qhov hnyav, kev siv tsis raug, thiab cov ntaub ntawv ceg.
- Kev koom ua ke ntawm GitHub: Txhua yam los ntawm kev luam theej duab mus rau kev siv zog khiav hauv koj cov txheej txheem GitHub, tsis tas yuav muaj cov ntawv sau tshwj xeeb lossis cov lej nplaum.
- Kev tshuaj xyuas sab server: Sab server Guardrails lees paub cov txiaj ntsig tom qab upload, ntxiv ib txheej thib ob ntawm kev tswj hwm sab nraum pipeline.
Es tsis txhob cia siab rau koj qhov kev teeb tsa CI los ntes txhua yam, Xygeni siv cov txheej txheem tsis siv neeg, raws li txoj cai.cisions ua ntej muaj dab tsi mus txog koj ceg tseem ceeb.
Txawm hais tias kev sib koom ua ke yog ib qho kev ua haujlwm yooj yim, kev ua nws kom ruaj ntseg yuav tsum tau pom tseeb thiab automation. Nrog Xygeni, koj tsis tsuas yog tiv thaiv koj cov repos, koj tiv thaiv txhua ceg GitHub nrog kev ntseeg siab.
