Ko te ako ki te waihanga i tētahi peka i GitHub te taahiraa tuatahi. Heoi, ko te mōhio ki te whakakotahi i ngā peka i GitHub me te haumaru he mea nui anō hoki mō ia peka. GitHub te tukanga mahi. Nō reira, i roto i tēnei pou, ka ārahi mātou i a koe i roto i te tukanga katoa, mai i me pēhea te hanga i tētahi peka i GitHub ā, kātahi ka whakaatu atu ki a koe me pēhea te whakakotahi i ngā peka i GitHub haumaru. Ka kōrerohia hoki e mātou me pēhea te whakakore i te hanumi mēnā ka kitea e koe he raruraru, ā, hei whakamutunga, me pēhea e taea ai e Xygeni te āwhina i a koe ki te hopu i ia raruraru i mua i te urunga ki tō peka matua.
Kia hikoi tātou i roto i tēnei taahiraa i te taahiraa.
1. Me pēhea te hanga i tētahi peka i GitHub i te ara tika
Ka tīmata ia rerengamahi haumaru ina waihangahia e koe he peka i GitHub. Mā tēnei ka taea e ngā kaiwhakawhanake te wehewehe i ngā āhuatanga, ngā whakatikatika, ngā whakamātautau rānei, me te kore e pā ki te waehere whakaputa.
Hei waihanga i tētahi peka i GitHub:
1. Haere ki tō putunga raraunga
2. Pāwhiritia te tahua taka-iho kōwhiri peka
3. Patohia te ingoa o tō peka hou
4. pāwhiri Waihanga peka
Mai i konei, kua rite tō peka hou ki te haere. Ka taea e koe te pana waehere, te mahi tahi ki ngā huringa, ā, hei te mutunga ka whakatuwhera i tētahi pull requestAhakoa he mahi GitHub taketake tēnei, ka whakatakoto i te tūāpapa mō te whanaketanga haumaru.
He mea nui, i ia wā ka hangaia e koe he peka i roto i a GitHub, me whakauru atu ki tētahi rerenga mahi ka taea te tukurua me te tiaki.
2. Matawai Pull Requests Aunoa i mua i te Hanumi
Ina hangaia e koe he peka i roto i te GitHub, ā, ka whakarite koe mō te arotake, ko te mahi e whai ake nei ko te mārama me pēhea te whakakotahi i ngā peka i roto i te GitHub me te haumaru. Me whakaoho aunoa ia pana peka GitHub i ngā tirotiro. Engari i mua i te whakakotahitanga, he mea nui kia tohua e kāore te waehere e whakauru mai i ngā ngoikoretanga. Kotahi te mea kāore i te haumaru commit ka taea te whakaatu i tō tono, leak secrets, ka pakaru rānei i ngā hanganga matua.
He mahi tino pānga te whakakotahi i te waehere ki tō peka matua. Ki te kore e tika ngā tirotiro, ka arahi pea ki ngā hua kino pēnei i:
- Ngā ngoikoretanga o te kore-rā paheke ki te whakaputa
- Kua mohiotia Nga CVE i whakaurua mai mā roto i ngā mōkihi pūtake tuwhera
- Ngā mea ngaro kua whakapūmautia i tukuna ki te putunga taonga
- Ngā whirihoranga hē o te hanganga e whakaiti ana i ō parepare
- Waehere kino, waehere kua whakarerekētia rānei te whakauru atu mā roto i ngā whakawhirinakitanga
Koinei te wāhi e tino rerekē ai a Xygeni
Ma te whakamahi Nga Mahi a GitHub, ka taea e koe te whakaoho ngā matawai aunoa a Xygeni i ngā wā katoa ka whakatuwherahia e te kaiwhakawhanake he pull request ki roto i tētahi peka tiakina. Ko tētahi peka tiakina i roto i te GitHub he peka e hiahia ana ki ngā tirotiro motuhake, ki ngā whakaaetanga rānei i mua i te whakaaetia kia hanumi ngā huringa.
Ka tātarihia e Xygeni te te whakatinanatanga hou o te pull request rerengamahi hei whakamana i te tūnga haumaru o ngā huringa kua whakaarohia. Kei roto i tēnei ko te tirotiro mō ngā take i roto i te waehere, ngā whakawhirinakitanga, ngā mea ngaro, me CI/CD whirihorangaKāore te peka katoa e matawaihia anō, engari ko te hua o te rerengamahi hou rawa atu ka whakamahia hei whakamana i ngā kaupapa here me te aukati i ngā hanumitanga haumaru kore.
Mā ēnei matawai ka whakamanahia te haumaru o te waehere, ā, kua rite hoki mō te whakaputa. Ka kitea e rātou:
- Ngā ngoikoretanga o te waehere (SAST)
- Ngā mōkihi pūtake tuwhera ngoikore (SCA)
- Ngā mea ngaro kua whakapūmautia
- IaC ngā whirihoranga hē
- Pūmanawa kino pea
Te whakaurunga mā ēnei tirotiro e whakarite wawe i ia wā ka hangaia e koe he peka i GitHub, ā, ka whakarite koe ki te hanumi, ka mahia e koe me te tino kitea me te mana whakahaere.
Anei tētahi whakaritenga māmā ake:
on: pull_request: branches: [ main ] jobs: xygeni-scan: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v3 - name: Xygeni Scanner uses: xygeni/xygeni-action@3.2.0 with: token: ${{ secrets.XYGENI_TOKEN }}3. Ka hanumi te Ārai Kore Haumaru ki Guardrails
Guardrails, kia mōhio koe, ina hangaia e koe he peka i GitHub, ina ngana rānei koe ki te whakakotahi i ngā peka i GitHub, ko ngā huringa haumaru anake ka tae atu ki tō tatūnga GitHub o tō peka matua. Ka hoatu e Xygeni ki a koe te mana katoa mō ngā mea ka hanumihiaKa taea e koe te tautuhi i muacisngā ture e hāngai ana ki ō kaupapa here haumarutanga me te manawanui ki ngā mōrearea. Hei tauira:
- Āraia mēnā he mea ngaro nui ka kitea (hei tauira, ngā kī AWS, ngā tohu)
- Kāore i angitu te hanga mēnā he mōrearea nui hou kua whakaurua mai te mōkihi pūtake tuwhera
- Whakakore pull requests e whakarerekētia ngā ara tairongo rite
.github/workflows/,infrastructure/, raneisecrets.env - Ārai i ngā hanumitanga mēnā he ka tīmata anō te whakahekenga mohiotia ngā whakaraerae
- Poraka CI/CD ngā huringa whirihoranga ki te kore e tohua tika
- Whakamutua ngā hanumi mēnā SAST kitea te tiketike, te ngā take nui
- Whakamahia kia kaha ake Guardrails i runga i ngā peka whakaputa me te pupuri tonu i te ngāwari o te whanaketanga
Ka mahi ēnei ture hei kaitiaki kuaha aunoa. Ka āwhina i tō rōpū ki te whakakotahi i ngā mea haumaru anake, kāore he ohorere, kāore he arotake ā-ringa, kāore he tinei ahi i te meneti whakamutunga.
Tauira ture parepare:
guardrail block_critical_secrets on secrets when severity = critical then @fail()Urupare Ātaata i roto i te Dashboard
Hei whakarite kia kitea katoatia, ka whakaatuhia e Xygeni te hua o te aromatawai hou o te mana o te Guardrail.
- Tuatahi, ko te tohu o te ata matomato kua paahitia ngā kaupapa here katoa.
- He rereke, he tohu whero kei te takahia tētahi, ētahi rānei o ngā tikanga o te Parearai.
Nā reira, ka mārama tonu ngā kaiwhakawhanake me ngā tīma haumarutanga ki te take i aukatia ai te hanumi, me te kore e keri hohonu ki ngā rangitaki CI.
Tauira Tuturu mai i te Dashboard:
Hei tauira, Me kī tātou kāore he peka tiaki i roto i tētahi putunga raraunga, he hapa whirihoranga noa e āhei ai ngā kaiwhakawhanake ki te pana commitkāore he manatoko. He mōrearea nui tēnā.
Ka kitea aunoatia tēnei e Xygeni, ā, ka tohua hoki hei hainatia_commits take i raro i te CI/CD kāwai. Ko te dashboard miramira:
- Taumaha: Tino Hāngai
- momo: Kua haina Commits
- Whakamārama: Kāore he peka tiaki o te putunga raraunga
- tūnga: tuwhera
Nō reira, mā te urupare whai kiko ki ngā horopaki, ka taea e ngā tīma te tautuhi wawe i te mōrearea, te mārama ki tōna pānga, me te mahi i ngā mahi whakatika, mai i te Xygeni UI katoa.
Whakaritea Whanoke Whakamana
Kei a koe tonu te mana whakahaere. Kōwhiria te kaha o te mahi Guardrails me:
--fail-on=critical: Ka hanumi te poraka i ngā kitenga kino anake--never-fail: Whakahaere Guardrails i roto i te aratau whakamaroke hei whakamātautau i ngā kaupapa here i mua i te whakatinanatanga
Nō reira, ā te wā e hanga ai koe i tētahi peka i GitHub, Guardrails kei reira kē, e tiaki ana i a koe pipeline me te whakatinana aunoa i ō kaupapa here.
Me pēhea taku mōhio mēnā he haumaru te taupānga GitHub?
Akohia me pēhea te aromatawai i ngā Taupānga GitHub i mua i te tāutanga.
4. Whakakore Aunoa i te Hanumi i roto i te GitHub Ina Kitea Ngā Mōrearea
Mena ka kitea he mōrearea, ka whakakorehia te hanumitanga. Ka tiakina e tēnei pareparenga ia peka o te kaupapa GitHub, ā, ka whakatinanahia ngā mahi pai mō te hanumitanga o ngā peka i roto i te GitHub.
Ka hono tika a Xygeni ki te atanga kaiwhakamahi o GitHub. Ina kitea he mōrearea:
- E whakaatu ana a GitHub i te tirotiro kua rahua
- Ka āraihia te hanumi e ngā parenga a GitHub
- Ka pekehia e te rarangi hanumi te waehere kore haumaru
Ahakoa he mea ngaro, he CVE, he mea morearea rānei CI/CD tauira, he rite tonu te hua: te kua whakakorehia te hanumi i roto i te GitHub ā, kua tohua kia arotakehia.
Ka taea hoki e koe te tiro i ngā hua taipitopito i roto i te Xygeni:
- Te tūnga haumaru o ia peka
- He aha i āraia ai te hanumitanga
- Hītori matawai katoa
- Ko te tūnga o te arai ārai e whakaaturia ana mā ngā ata kakariki (paahi) whero rānei (rahua) i te whārangi kaupapa
Mā tēnei urupare ā-kanohi ka māmā ake te mahi a ngā kaiwhakawhanake me ngā tīma haumarutanga me te maia. Ā, ina hiahia koe ki tētahi horopaki hohonu ake, ka hono ia take ki ngā tuhinga me te kaha, ngā tohu, te tauwāhi, me ngā aratohu whakaiti.
Tldr Hanumi Anake He aha te mea Haumaru
Hei whakarāpopototanga, anei te huarahi ki te hanumi haumaru i muri i te waihanga i tētahi peka i GitHub:
- Waihangahia he peka i GitHub mā te UI
- Whakaohohia ngā matawai aunoa me ia pull request me Xygeni
- Āraia ngā hanumitanga kore-haumaru mā te whakamahi i Guardrails
- Whakamahia ngā kaupapa here arotake taha-tūmau mō te whakahaere hohonu ake
- Whakakorehia te hanumi i roto i te GitHub ina rahua tetahi mea
- Whakaarohia ngā hua katoa i roto i te Xygeni's dashboard
Mō ētahi atu mahi pai mō te tiaki putunga, pānuihia ā mātou Ngā Pātai Auau mō te Haumarutanga o GitHub: Ngā Mea Me Mōhio Ngā Kaiwhakawhanake Katoa.
Ahakoa he mahi taketake te whakakotahitanga, me tino kitea, me aunoa hoki te mahi haumaru. Ki a Xygeni, ehara i te mea ka whakakotahi noa koe i te waehere, engari ka whakakotahi hoki i te whakawhirinaki.
Tiakina ia Peka GitHub me te Whakapono
Kotahi te take i warewarehia i roto i te pull request ka taea e ēnei te whakararu i tō peka matua. He maha ngā wā ka roa rawa te oma o ngā matawai tuku iho, ka ngaro ngā mōrearea nui, ka kore rānei e whakatinana i ngā kaupapa here whai tikanga.
Koia te take he nui atu i te matawai noa te mahi hei tiaki i ō peka GitHub.
Ka whakaratohia e Xygeni te whakatinanatanga tuturu. A, no te pull request e aro ana ki tētahi peka tiakina, ka tātarihia e Xygeni te whakatinanatanga hou o tō CI/CD rerengamahi. Kāore e matawai anō i te peka katoa. Engari, ka arotakehia ngā hua hou hei tirotiro i ngā take haumarutanga i roto i te waehere, ngā whakawhirinakitanga, ngā mea ngaro, me ngā whirihoranga rerengamahi. Kāore koe e whakamōhiotia noa. Ka tiakina koe.
He aha te mea rereke:
- Whakamanatanga horopaki-katoa: Guardrails whakatinanahia ngā kaupapa here mā te whakamahi i ngā horopaki whai kiko pēnei i te kaha, te āheinga ki te whakamahi, me ngā raraunga peka.
- Whakaurunga GitHub kua hangaia: Mai i te matawai ki te whakatinanatanga ka oma noa i roto i ō rerengamahi GitHub, kāore he hiahia mō ngā tuhinga ritenga, waehere whakapiri rānei.
- Ngā arotake taha-tūmau: Taha-tūmau Guardrails whakamanahia ngā hua i muri i te tukuake, me te tāpiri i tētahi paparanga tuarua o te mana whakahaere i waho o te pipeline.
Engari i te whakawhirinaki ki tō tautuhinga CI hei hopu i ngā mea katoa, ka whakamahia e Xygeni te pūnaha whakahaere aunoa, e hangai ana ki ngā kaupapa here.cisngā iona i mua i te taenga atu o tetahi mea ki tō peka matua.
Ahakoa he mahi taketake te whakakotahitanga, me tino kitea, me aunoa hoki te mahi haumaru. Mā Xygeni, ehara i te mea ka tiakina noa ō repo, engari ka tiakina hoki e koe ia peka GitHub me te maia.
