Kuphunzira momwe mungapangire nthambi mu GitHub ndi gawo loyamba. Komabe, kudziwa momwe mungaphatikizire nthambi mu GitHub mosamala ndikofunikira kwambiri pa nthambi iliyonse. GitHub mayendedwe. Chifukwa chake, mu positi iyi, tikukutsogolerani mu ndondomeko yonseyi, kuyambira ndi momwe mungapangire nthambi mu GitHub kenako ndikukuwonetsani momwe mungaphatikizire nthambi mu GitHub mosamala. Tidzakambirananso momwe mungaletsere kuphatikiza ngati mukupeza vuto lililonse, komanso potsiriza, momwe Xygeni ingakuthandizireni kuthana ndi vuto lililonse lisanafike ku nthambi yanu yayikulu.
Tiyeni tiyendemo pang'onopang'ono.
1. Momwe Mungapangire Nthambi mu GitHub Mwanjira Yoyenera
Njira iliyonse yotetezeka imayamba mukapanga nthambi mu GitHub. Imalola opanga mapulogalamu kuti azitha kusiyanitsa zinthu, kukonza, kapena kuyesa popanda kukhudza code yopangira.
Kupanga nthambi mu GitHub:
1. Pitani ku malo anu osungiramo zinthu
2. Dinani kadontho ka kusankha nthambi
3. Lembani dzina la nthambi yanu yatsopano
4. Dinani Pangani nthambi
Kuchokera pano, nthambi yanu yatsopano yakonzeka kugwiritsidwa ntchito. Tsopano mutha kugwiritsa ntchito ma code, kugwirizana pa zosintha, kenako ndikutsegula pull requestNgakhale kuti iyi ndi njira yoyambira ya GitHub, imayambitsa chitukuko chotetezeka.
Chofunika kwambiri, nthawi iliyonse mukapanga nthambi mu GitHub, iyenera kukhala gawo la njira yogwirira ntchito yobwerezabwereza komanso yotetezedwa.
2. Jambulani Pull Requests Musanayambe Kugwirizanitsa
Mukapanga nthambi mu GitHub ndikukonzekera kuwunikiranso, gawo lotsatira ndikumvetsetsa momwe mungaphatikizire nthambi mu GitHub mosamala. Nthambi iliyonse yomwe GitHub ikufuna kuyika iyenera kuyambitsa macheke odziyimira payokha. Koma musanayiphatikize, ndikofunikira kutero onetsetsani kuti Khodiyi siyiyambitsa zovuta. Chosatetezeka chimodzi commit akhoza kuwonetsa pulogalamu yanu, leak secrets, kapena kuswa zomangamanga zofunika kwambiri.
Kuphatikiza ma code mu nthambi yanu yayikulu ndi ntchito yokhudza kwambiri. Popanda kufufuza koyenera, kungayambitse zotsatirapo zoopsa monga:
- Zofooka za Zero-day kulowa mu kupanga
- Amadziwika Ma CVE zoyambitsidwa kudzera mu phukusi lotseguka
- Zinsinsi zolembedwa kukankhidwira ku malo osungiramo zinthu
- Kusintha kosasintha kwa zomangamanga zomwe zimafooketsa chitetezo chanu
- Khodi yoipa kapena yosokonezedwa kulowa kudzera mu zodalira
Apa ndi pomwe Xygeni imapanga kusiyana kwenikweni
Mwa kugwiritsa ntchito Zochita za GitHub, mukhoza kuyambitsa ma scan a Xygeni odziyimira pawokha nthawi iliyonse wopanga mapulogalamu atsegula pull request mu nthambi yotetezedwa. Nthambi yotetezedwa mu GitHub ndi nthambi yomwe imafuna macheke kapena zivomerezo zinazake musanalole kusintha kuphatikizidwe.
Xygeni ikufotokoza za kuchitidwa kwaposachedwa kwa pull request Ntchito yopita kutsimikizira momwe chitetezo cha zosintha zomwe zikuperekedwa chikukhalira. Izi zikuphatikizapo kuyang'ana nkhani mu code, kudalira, zinsinsi, ndi CI/CD masinthidweNthambi yonse siiyang'anidwanso, koma zotsatira zaposachedwa za ntchito zimagwiritsidwa ntchito kukakamiza mfundo ndikuletsa kuphatikiza kosatetezeka.
Kusanthula kumeneku kumatsimikizira kuti khodiyi ndi yotetezeka komanso yokonzeka kupangidwa. Kumazindikira:
- Zofooka za code (SAST)
- Maphukusi otseguka omwe ali pachiwopsezo (SCA)
- Zinsinsi zolembedwa
- IaC kusasinthika bwino
- Vuto la pulogalamu yaumbanda lomwe lingakhalepo
Kuphatikiza macheke awa amatsimikizira msanga kuti nthawi iliyonse mukapanga nthambi mu GitHub ndikukonzekera kuphatikiza, mumachita ndi kuwonekera kwathunthu ndi kuwongolera.
Nayi njira yosavuta yokhazikitsira:
on: pull_request: branches: [ main ] jobs: xygeni-scan: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v3 - name: Xygeni Scanner uses: xygeni/xygeni-action@3.2.0 with: token: ${{ secrets.XYGENI_TOKEN }}3. Letsani Kugwirizana Kosatetezeka ndi Guardrails
GuardrailsOnetsetsani kuti mukapanga nthambi mu GitHub kapena kuyesa kuphatikiza nthambi mu GitHub, kusintha kotetezeka kokha ndiko komwe kumafika pa nthambi yanu yayikulu yokhazikitsa GitHub. Xygeni imakupatsani ulamuliro wonse pa zomwe zimagwirizanitsidwaMukhoza kufotokoza precisMalamulo a e ogwirizana ndi mfundo zanu zachitetezo komanso kulekerera zoopsa. Mwachitsanzo:
- Letsani ngati chinsinsi chofunikira yapezeka (monga makiyi a AWS, ma tokeni)
- Kulephera kumanga ngati chiopsezo chachikulu chatsopano phukusi lotseguka layambitsidwa
- Onetsani pull requests kuti sinthani njira zobisika ngati
.github/workflows/,infrastructure/kapenasecrets.env - Letsani kusakanikirana ngati kutsitsa kumabweretsanso odziwika zovuta
- Dulani CI/CD kusintha kwa kasinthidwe pokhapokha ngati pali zilembo zoyenera
- Siyani kuphatikizana ngati SAST imazindikira kwambiri kapena nkhani zovuta
- Ikani zokhwima kwambiri Guardrails pa nthambi zopangira pamene mukupitirizabe kusinthasintha pakukula
Malamulo awa amagwira ntchito ngati alonda odziyimira pawokha. Amathandiza gulu lanu kuphatikiza zomwe zili zotetezeka zokha, palibe zodabwitsa, palibe ndemanga pamanja, palibe kuzimitsa moto kwa mphindi yomaliza.
Chitsanzo cha lamulo la Guardrail:
guardrail block_critical_secrets on secrets when severity = critical then @fail()Ndemanga Zowoneka mu Dashboard
Kuti zitsimikizire kuti Guardrail ikuwoneka bwino, Xygeni ikuwonetsa zotsatira za kuwunika kwaposachedwa kwa momwe Guardrail ilili.
- Choyambirira, chizindikiro chobiriwira chimatanthauza mfundo zonse zomwe zaperekedwa.
- Motsutsana, chizindikiro chofiira chimasonyeza kuti lamulo limodzi kapena angapo a Guardrail aphwanyidwa.
Zotsatira zake, opanga mapulogalamu ndi magulu achitetezo amapeza chidziwitso mwachangu cha chifukwa chomwe kuphatikizana kunaletsedwera, popanda kufufuza zolemba za CI.
Chitsanzo Chenicheni kuchokera ku Dashboard:
Mwachitsanzo, tiyerekeze kuti malo osungiramo zinthu alibe nthambi zotetezedwa, kusasinthika kofala komwe kumalola opanga mapulogalamu kukankhira commitpopanda chitsimikizo. Ndi chiopsezo chachikulu.
Xygeni imazindikira yokha ndikuyiyika chizindikiro ngati kusainidwa_commits nkhani pansi pa CI/CD gulu. The dashboard zazikulu:
- Kulimba: High
- Type: Wosayina Commits
- Kufotokozera: Malo osungiramo zinthu alibe nthambi zotetezedwa
- Chikhalidwe: Open
Chifukwa chake, ndi ndemanga zambirizi, magulu amatha kuzindikira mwachangu chiopsezocho, kumvetsetsa momwe chikukhudzira, ndikuchitapo kanthu kokonza, zonse kuchokera ku Xygeni UI.
Sinthani Khalidwe Lokakamiza Anthu
Mumakhala ndi ulamuliro nthawi zonse. Sankhani momwe mungakhalire okhwima Guardrails ziyenera kukhala:
--fail-on=critical: Block imaphatikizana pokhapokha ngati papezeka zotsatira zoopsa--never-fail: Thamangani Guardrails mu mode dry-run kuti muyese mfundo musanayambe kugwiritsa ntchito
Kotero nthawi ina mukapanga nthambi mu GitHub, Guardrails alipo kale, akuteteza pipeline ndi kukakamiza mfundo zanu zokha.
Kodi Ndingadziwe Bwanji Ngati Pulogalamu ya GitHub Ndi Yotetezeka?
Phunzirani momwe mungayang'anire mapulogalamu a GitHub musanawayike.
4. Letsani Kuphatikiza mu GitHub Mwachangu Pamene Zoopsa Zikupezeka
Ngati zoopsa zapezeka, kuphatikizana kumathetsedwa. Chitetezo ichi chimateteza nthambi iliyonse ya polojekiti ya GitHub ndipo chimalimbikitsa njira zabwino zolumikizira nthambi mu GitHub.
Xygeni imalumikizidwa mwachindunji mu UI ya GitHub. Ngati chiopsezo chapezeka:
- GitHub ikuwonetsa cheke ngati chalephera
- Chitetezo cha GitHub chimaletsa kusakanikirana
- Mzere wophatikizana umadutsa khodi yosatetezeka
Kaya ndi chinsinsi, CVE, kapena choopsa CI/CD chitsanzo, zotsatira zake ndi zomwezo: Kugwirizanitsa kwathetsedwa mu GitHub ndipo yalembedwa kuti iwunikidwenso.
Mukhozanso kuwona zotsatira zatsatanetsatane mu Xygeni:
- Chitetezo cha nthambi iliyonse
- Chifukwa chomwe kuphatikizana kunaletsedwera
- Mbiri yonse yojambulira
- Mkhalidwe wa Guardrail ukuwonetsedwa kudzera mu zizindikiro zobiriwira (pass) kapena zofiira (fail) patsamba la polojekitiyi
Ndemanga yowoneka bwino iyi imapangitsa kuti opanga mapulogalamu ndi magulu achitetezo azitha kuchitapo kanthu molimba mtima. Ndipo mukafuna nkhani yozama, nkhani iliyonse imalumikizana ndi zolemba zokhala ndi kuopsa, zilembo, malo, ndi malangizo ochepetsera vutoli.
Tldr Gwirizanitsani Zokha Zomwe Zili Zotetezeka
Mwachidule, nayi momwe mungagwirizanitsire bwino mutapanga nthambi mu GitHub:
- Pangani nthambi mu GitHub kudzera mu UI
- Yambitsani ma scan odziyimira pawokha ndi chilichonse pull request ndi Xygeni
- Letsani zosakaniza zosatetezeka pogwiritsa ntchito Guardrails
- Gwiritsani ntchito mfundo zowunikira mbali ya seva kuti muwongolere bwino
- Letsani kuphatikiza mu GitHub ngati china chake chalephera
- Onani zotsatira zonse mu Xygeni's dashboard
Kuti mudziwe njira zina zabwino zotetezera malo osungiramo zinthu, werengani zathu Mafunso Ofunsidwa Kawirikawiri pa Zachitetezo cha GitHub: Zimene Wopanga Mapulogalamu Aliyense Ayenera Kudziwa.
Ngakhale kuti kuphatikiza ndi ntchito yofunikira, kuchita izi mosamala kumafuna kuwonekera kwenikweni komanso kudzipangira wekha. Ndi Xygeni, simungophatikiza ma code okha, koma muphatikiza chidaliro.
Tetezani Nthambi Iliyonse ya GitHub Ndi Chidaliro
Nkhani imodzi yosaganiziridwa mu pull request zingakhudze nthambi yanu yayikulu. Makina ojambulira akale nthawi zambiri amachedwa kwambiri, amaphonya zoopsa zazikulu, kapena amalephera kutsatira mfundo zofunikira.
Ndicho chifukwa chake kuteteza nthambi zanu za GitHub kumafuna zambiri osati kungofufuza.
Xygeni imapereka malamulo enieni. Pamene a pull request ikuyang'ana nthambi yotetezedwa, Xygeni ikuwunika momwe ntchito yanu yaposachedwa yachitikira CI/CD mayendedwe. Sichiyang'ananso nthambi yonse. M'malo mwake, imawunika zotsatira zaposachedwa kuti ione ngati pali mavuto achitetezo mu ma code, kudalira, zinsinsi, ndi makonzedwe a mayendedwe. Simungodziwitsidwa. Muli otetezedwa.
Zomwe zimapangitsa kuti zikhale zosiyana:
- Kutsimikizira kwathunthu: Guardrails Gwiritsani ntchito mfundo pogwiritsa ntchito zinthu monga kuopsa, kugwiritsa ntchito zinthu molakwika, ndi metadata ya nthambi.
- Kuphatikiza kwa GitHub komwe kwamangidwa: Chilichonse kuyambira kusanthula mpaka kukhazikitsa malamulo chimagwira ntchito mkati mwa ntchito zanu za GitHub, popanda chifukwa cholemba zolemba kapena glue code.
- Kuwunika mbali ya seva: Seva-mbali Guardrails tsimikizirani zotsatira mutatha kukweza, ndikuwonjezera gawo lachiwiri la ulamuliro kunja kwa pipeline.
M'malo modalira kukhazikitsidwa kwa CI yanu kuti igwire chilichonse, Xygeni imagwiritsa ntchito njira yodziyimira yokha, yokhazikika pa mfundocisma ayoni asanafike ku nthambi yanu yayikulu.
Ngakhale kuphatikiza ndi ntchito yofunikira, kuchita izi mosamala kumafuna kuwonekera bwino komanso kudzipangira wekha. Ndi Xygeni, simungoteteza ma repos anu okha, koma mumateteza nthambi iliyonse ya GitHub molimba mtima.
