Ukufunda indlela yokwenza isebe kwiGitHub linyathelo lokuqala. Nangona kunjalo, ukwazi indlela yokudibanisa amasebe kwiGitHub ngokukhuselekileyo kubaluleke ngokufanayo kuwo onke amasebe. GitHub indlela yokusebenza. Ngoko ke, kweli nqaku, siza kukubonisa yonke inkqubo, siqala ngo indlela yokwenza isebe kwiGitHub aze akubonise indlela yokudibanisa amasebe kwiGitHub ngokukhuselekileyo. Siza kuthetha ngendlela yokurhoxisa ukudibanisa ukuba ufumana naziphi na iingxaki, kwaye ekugqibeleni, indlela iXygeni enokukunceda ngayo ukubamba yonke ingxaki ngaphambi kokuba ifike kwisebe lakho eliphambili.
Masihambe ngayo inyathelo ngenyathelo.
1. Indlela Yokwenza Isebe kwiGitHub Ngendlela Echanekileyo
Yonke indlela yokusebenza ekhuselekileyo iqala xa udala isebe kwiGitHub. Ivumela abaphuhlisi ukuba bahlukanise iimpawu, izilungiso, okanye iimvavanyo ngaphandle kokuchaphazela ikhowudi yemveliso.
Ukwenza isebe kwiGitHub:
1. Yiya kwindawo yakho yokugcina izinto
2. Cofa uhla oluya phantsi lokukhetha isebe
3. Thayipha igama lesebe lakho elitsha
4. nqakraza Yenza isebe
Ukusuka apha, isebe lakho elitsha likulungele ukusebenza. Ngoku ungacinezela ikhowudi, usebenzisane kwiinguqu, kwaye ekugqibeleni uvule i- pull requestNangona esi sisenzo esisisiseko seGitHub, sibeka inqanaba lophuhliso olukhuselekileyo.
Okubalulekileyo, ngalo lonke ixesha usenza isebe kwiGitHub, kufuneka libe yinxalenye yomsebenzi ophindaphindwayo nokhuselweyo.
2. Skena Pull Requests Ngaphambi kokuba Udibane Ngokuzenzekelayo
Xa udala isebe kwiGitHub kwaye ulungiselela uphononongo, inyathelo elilandelayo kukuqonda indlela yokudibanisa amasebe kwiGitHub ngokukhuselekileyo. Isebe ngalinye iGitHub push kufuneka iqalise ukujonga ngokuzenzekelayo. Kodwa ngaphambi kokudibanisa, kubalulekile ukuba Qinisekisa ukuba ikhowudi ayizisi ubuthathaka. Inye engakhuselekanga commit ingaveza isicelo sakho, leak secretokanye baphule iziseko ezibalulekileyo.
Ukudibanisa ikhowudi kwisebe lakho eliphambili ngumsebenzi onempembelelo enkulu. Ngaphandle kokuhlolwa ngokufanelekileyo, kunokukhokelela kwimiphumo emibi efana nale:
- Zero-day semngciphekweni ukungena kwimveliso
- Yaziwa IiCVEs yaziswa ngeepakethi zomthombo ovulekileyo
- Iimfihlo eziqinileyo ityhalelwe kwindawo yokugcina izinto
- Ukulungiswa gwenxa kweziseko zophuhliso ezibuthathaka ukuzikhusela kwakho
- Ikhowudi enobungozi okanye ephazanyisiweyo ukungena ngokuxhomekeka
Kulapho iXygeni yenza khona umahluko wokwenene
Ngokusebenzisa Iintshukumo zeGitHub, ungenza ukuba izikeni zeXygeni ezenzekelayo nanini na xa umphuhlisi evula pull request kwisebe elikhuselweyo. Isebe elikhuselweyo kwiGitHub lelo lifuna ukujongwa okanye ukuvunywa okuthile ngaphambi kokuba utshintsho luvunyelwe ukuba ludibane.
I-Xygeni ihlalutya ukuphunyezwa kwamva nje kwe pull request Ukuhamba komsebenzi ukuqinisekisa imeko yokhuseleko yotshintsho olucetywayo. Oku kuquka ukujonga imiba kwikhowudi, ukuxhomekeka, iimfihlo, kunye CI/CD ulungiseleloIsebe elipheleleyo aliskeniwa kwakhona, kodwa isiphumo somsebenzi wamva nje sisetyenziselwa ukunyanzelisa imigaqo-nkqubo kunye nokuthintela ukudibana okungakhuselekanga.
Ezi scan ziqinisekisa ukuba ikhowudi ikhuselekile kwaye ikulungele ukuveliswa. Ziyafumanisa:
- Ubuthathaka bekhowudi (SAST)
- Iiphakheji zomthombo ovulekileyo ezisengozini (SCA)
- Iimfihlo eziqinileyo
- IaC ulungelelwaniso olungalunganga
- I-malware enokubakho
Ukudibanisa olu hlolo kwangethuba luqinisekisa ukuba ngalo lonke ixesha udala isebe kwiGitHub kwaye ulungiselela ukudibana, uyenza nge ukubonakala ngokupheleleyo kunye nokulawula.
Nantsi indlela elula yokuseta:
on: pull_request: branches: [ main ] jobs: xygeni-scan: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v3 - name: Xygeni Scanner uses: xygeni/xygeni-action@3.2.0 with: token: ${{ secrets.XYGENI_TOKEN }}3. Vimba ukuHlangana okungakhuselekanga kunye Guardrails
Guardrails, qinisekisa ukuba xa udala isebe kwiGitHub okanye uzama indlela yokudibanisa amasebe kwiGitHub, kuphela utshintsho olukhuselekileyo olufikelela kwisebe lakho eliphambili ukuseta iGitHub. I-Xygeni ikunika ulawulo olupheleleyo malunga noko kudityanisiweyoUngachaza i-precisImithetho ye-e eyenzelwe imigaqo-nkqubo yakho yokhuseleko kunye nokunyamezela umngcipheko. Umzekelo:
- Vimba ukuba iyimfihlo ebalulekileyo ifunyenwe (umz., izitshixo ze-AWS, iithokheni)
- Ayiphumelelanga indlela yokwakha ukuba umngcipheko omtsha ophezulu iphakheji yomthombo ovulekileyo iqalisiwe
- Nqaba pull requests ukuba lungisa iindlela ezibuthathaka ezifana
.github/workflows/,infrastructure/, okanyesecrets.env - Nqanda ukudibana ukuba ukwehlisa umgangatho kubuyisela kwakhona yaziwa u bunzima
- Vimba CI/CD utshintsho loqwalaselo ngaphandle kokuba iphawulwe ngokufanelekileyo
- Yeka ukudibana ukuba SAST ibona ukuba iphezulu okanye imiba ebalulekileyo
- Faka ngokungqongqo ngakumbi Guardrails kumasebe emveliso ngelixa ugcina ukuguquguquka kuphuhliso
Le mithetho isebenza njengabagcini-masango abazenzekelayo. Inceda iqela lakho lidibanise kuphela oko kukhuselekileyo, akukho zimangaliso, akukho phononongo olwenziwe ngesandla, akukho mlilo ocinywa ngomzuzu wokugqibela.
Umzekelo womgaqo we-Guardrail:
guardrail block_critical_secrets on secrets when severity = critical then @fail()Impendulo ebonakalayo kwi Dashboard
Ukuqinisekisa ukubonakala ngokupheleleyo, iXygeni ibonisa iziphumo zovavanyo lwamva nje lwesimo seGuardrail.
- Okokuqala, uphawu oluluhlaza luthetha ukuba zonke iipolisi ezidlulisiweyo.
- Okuchasene, uphawu olubomvu lubonisa ukuba imiqathango enye okanye ezingaphezulu zeGuardrail zaphulwe.
Ngenxa yoko, abaphuhlisi kunye namaqela okhuseleko bafumana ukuqonda kwangoko isizathu sokuba ukudibana kuvaliwe, ngaphandle kokumba kwiilog zeCI.
Umzekelo Wokwenyani ovela kwi Dashboard:
Umzekelo, Masithi indawo yokugcina idatha ayinamasebe akhuselweyo, into eqhelekileyo engalunganga evumela abaphuhlisi ukuba batyhale commitngaphandle kokuqinisekiswa. Yingozi enkulu leyo.
I-Xygeni iyazibhaqa ngokuzenzekelayo ize iyiphawule le nto njenge isayinwe_commits umcimbi phantsi kwe CI/CD udidi. I dashboard amagqabantshintshi:
- Ubunzima: phezulu
- udidi: Sayinwe Commits
- Inkcazo: Indawo yokugcina izinto ayinamasebe akhuselweyo
- Isimo: vula
Ke ngoko, ngale ngxelo ityebileyo kwimixholo, amaqela anokuyibona ngokukhawuleza ingozi, aqonde impembelelo yayo, aze athathe amanyathelo okulungisa, konke oku kusenziwa kwi-Xygeni UI.
Yenza Indlela Yokuziphatha Yokunyanzelisa
Uhlala ulawula. Khetha ukuba ungqongqo kangakanani Guardrails kufuneke Ku:
--fail-on=critical: Iibhloko ziyadibana kuphela xa kufunyaniswe iziphumo eziqatha--never-fail: Run Guardrails kwimodi yokusebenza ngaphandle kokusebenzisa amandla ukuvavanya imigaqo-nkqubo ngaphambi kokuyinyanzelisa
Ngoko ke kwixesha elizayo xa udala isebe kwiGitHub, Guardrails sele zikhona, zikhusela pipeline kunye nokunyanzelisa iipolisi zakho ngokuzenzekelayo.
Ndingazi njani ukuba i-GitHub App ikhuselekile?
Funda indlela yokuvavanya ii-Apps zeGitHub ngaphambi kokuzifaka.
4. Rhoxisa ukudibanisa kwiGitHub ngokuzenzekelayo xa kufunyenwe iingozi
Ukuba kufunyenwe iingozi, ukuhlanganiswa kuyarhoxiswa. Olu khuseleko lukhusela yonke iprojekthi yeGitHub yesebe kwaye luqinisekisa iindlela ezilungileyo zokudibanisa amasebe kwiGitHub.
I-Xygeni idibana ngqo kwi-UI yeGitHub. Xa kufunyenwe umngcipheko:
- I-GitHub ibonisa itshekhi njengengaphumelelanga
- Ukhuseleko lweGitHub luthintela ukudibana
- Umgca wokudibanisa utsiba ikhowudi engakhuselekanga
Nokuba yimfihlo, yi-CVE, okanye iyingozi CI/CD iphethini, isiphumo siyafana: ukuhlanganiswa kurhoxisiwe kwiGitHub kwaye iphawulwe ukuze ihlolwe.
Ungajonga neziphumo ezineenkcukacha kwiXygeni:
- Imeko yokhuseleko yesebe ngalinye
- Kutheni ukudibana kuvaliwe
- Gqibezela imbali yokuskena
- Isimo se-Guardrail siboniswa ngee-icon eziluhlaza (ezidlulayo) okanye ezibomvu (ezingaphumeleliyo) kwiphepha leprojekthi
Le ngxelo ibonakalayo yenza kube lula kubaphuhlisi kunye namaqela okhuseleko ukuba bathathe inyathelo ngokuzithemba. Kwaye xa ufuna umxholo onzulu, yonke ingxaki iqhagamshela kumaxwebhu anobunzima, iithegi, indawo, kunye nesikhokelo sokunciphisa.
Hlanganisa iTldr kuphela Oko Kukhuselekileyo
Ukushwankathela, nantsi indlela yokudibanisa ngokukhuselekileyo emva kokuba wenze isebe kwiGitHub:
- Yenza isebe kwiGitHub nge-UI
- Qalisa ukuskena ngokuzenzekelayo ngayo yonke pull request kunye neXygeni
- Vimba ukudibana okungakhuselekanga usebenzisa Guardrails
- Sebenzisa imigaqo-nkqubo yophicotho-zincwadi ecaleni kweseva ukuze ufumane ulawulo olunzulu
- Rhoxisa ukudibana kwiGitHub xa kukho into engaphumeleliyo
- Jonga zonke iziphumo kwiXygeni's dashboard
Ukuze ufumane ezinye iindlela ezilungileyo zokukhusela indawo yokugcina izinto, funda eyethu Imibuzo ebuzwa rhoqo malunga noKhuseleko lweGitHub: Oko Wonke uMphuhlisi Afanele Akwazi.
Nangona ukudibanisa kuyinto eqhelekileyo, ukuyenza ngokukhuselekileyo kufuna ukubonakala ngokoqobo kunye nokuzenzekela. Nge-Xygeni, awuhlanganisi nje ikhowudi, udibanisa ukuthembana.
Khusela lonke iSebe leGitHub ngokuzithemba
Ingxaki enye engajongwanga kwi pull request zinokubeka emngciphekweni isebe lakho eliphambili. Iiskena zemveli zihlala zisebenza emva kwexesha, ziphuthelwe ziingozi ezibalulekileyo, okanye zisilele ukunyanzelisa imigaqo-nkqubo ebalulekileyo.
Yiyo loo nto ukukhusela amasebe akho eGitHub kuthatha okungaphezulu kokuskena nje.
IXygeni inika ukunyanzeliswa kokwenyani. Xa pull request ijolise kwisebe elikhuselweyo, iXygeni ihlalutya ukuphunyezwa kwamva nje kwe- CI/CD indlela yokusebenza. Ayiphinde iskenwe lonke isebe. Endaweni yoko, ivavanya iziphumo zamva nje ukujonga imiba yokhuseleko kwikhowudi, ukuxhomekeka, iimfihlo, kunye noqwalaselo lomsebenzi. Awulumkiswa nje kuphela. Ukhuselekile.
Yintoni eyenza ukuba yahluke:
- Ukuqinisekiswa komxholo opheleleyo: Guardrails ukunyanzelisa umgaqo-nkqubo kusetyenziswa umxholo otyebileyo njengobukhali, ukusetyenziswa, kunye ne-metadata yamasebe.
- Udibaniso lweGitHub olwakhelwe ngaphakathi: Yonke into ukusuka ekuskeni ukuya ekunyanzeliseni umthetho isebenza ngokwendalo ngaphakathi kwendlela yakho yokusebenza yeGitHub, akukho mfuneko yezikripthi ezenziwe ngokwezifiso okanye ikhowudi yeglue.
- Uhlolo lwecala leseva: Icala lomncedisi Guardrails qinisekisa iziphumo emva kokulayisha, wongeza umaleko wesibini wolawulo ngaphandle pipeline.
Endaweni yokuthembela kulungiselelo lwakho lwe-CI ukuze lubambe yonke into, i-Xygeni isebenzisa i-de ezenzekelayo, esekelwe kwimigaqo-nkqubocisii-ions ngaphambi kokuba nantoni na ifikelele kwisebe lakho eliphambili.
Nangona ukudibanisa kuyinto elula, ukuyenza ngokukhuselekileyo kufuna ukubonakala ngokoqobo kunye nokwenza izinto ngokuzenzekelayo. NgeXygeni, awukhuseli nje kuphela ii-repos zakho, ukhusela lonke isebe leGitHub ngokuzithemba.
