chore(security): Baseline-Update Prüfstempel und release-checks
Makefile und scripts/security/stamp.py aus cj/security-baseline, leere docs/RELEASE-AUSNAHMEN.md, AGENTS.md-Abschnitt zu Stempeln und Release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Grovy311
parent
ad9ca4cae5
commit
e2cc00dccc
4 changed files with 392 additions and 4 deletions
40
Makefile
40
Makefile
|
|
@ -8,7 +8,12 @@
|
|||
# Wann was läuft:
|
||||
# beim Coden make quick (Lint + Tests; TESTS=... nur betroffene + Sicherheitstests)
|
||||
# vor dem Push make prepush (nur was der Diff braucht, siehe scripts/security/changed_scope.py)
|
||||
# vor Deploy make check (alles, über Skill pre-release-gate)
|
||||
# vor Deploy make release-checks (check + mutation [+ container], nur ohne gültigen Stempel;
|
||||
# über Skill pre-release-gate)
|
||||
# nach Deploy make zap / make fuzz (gegen die eigene Live-Instanz, blockiert das Go nicht)
|
||||
#
|
||||
# Stempel: check, prepush, mutation, container, zap und fuzz merken sich in reports/stamps/, für
|
||||
# welchen Commit sie grün waren (scripts/security/stamp.py). `make stamp` zeigt den Stand.
|
||||
# wöchentlich make weekly (check + Trivy, zeitabhängige Funde wie neue CVEs)
|
||||
|
||||
-include baseline.mk
|
||||
|
|
@ -19,6 +24,7 @@ NODE_DIR ?= frontend
|
|||
SEMGREP_RULES ?= .semgrep
|
||||
SCRIPTS ?= scripts/security
|
||||
MUTATIONS ?= security-mutations.toml
|
||||
STAMP ?= python3 $(SCRIPTS)/stamp.py
|
||||
NODE_IMAGE ?= node:24
|
||||
OPENAPI_PATH ?= /openapi.json
|
||||
FUZZ_CHECKS ?= not_a_server_error
|
||||
|
|
@ -65,7 +71,7 @@ GITLEAKS :=docker run --rm -u $(UID_GID) -v "$(CURDIR)":/repo $(GIT_MOUNT) $(G
|
|||
NPM ?= $(if $(shell command -v npm 2>/dev/null),npm --prefix $(NODE_DIR),docker run --rm -u $(UID_GID) -e HOME=/tmp -v "$(CURDIR)":/w -w /w/$(NODE_DIR) $(NODE_IMAGE) npm)
|
||||
|
||||
.DEFAULT_GOAL := help
|
||||
.PHONY: help setup quick prepush check weekly lint test secrets secrets-diff sast sast-diff audit trivy-fs container zap fuzz mutation mutmut vet-deps
|
||||
.PHONY: help setup quick prepush check release-checks release-report stamp weekly lint test secrets secrets-diff sast sast-diff audit trivy-fs container zap fuzz mutation mutmut vet-deps
|
||||
|
||||
help: ## Diese Übersicht
|
||||
@grep -hE '^[a-z-]+:.*## ' $(MAKEFILE_LIST) | awk -F':.*## ' '{printf " make %-12s %s\n", $$1, $$2}'
|
||||
|
|
@ -86,12 +92,30 @@ endif
|
|||
quick: lint test ## Lint + Tests beim Coden; nur betroffene: make quick TESTS="tests/test_x.py"
|
||||
|
||||
prepush: ## Vor dem Push: nur die Prüfungen, die der Diff braucht (BASE=ref setzt die Basis)
|
||||
@$(STAMP) begin prepush
|
||||
@python3 $(SCRIPTS)/changed_scope.py explain $(BASE)
|
||||
@t=$$(python3 $(SCRIPTS)/changed_scope.py targets $(BASE)) && $(MAKE) --no-print-directory $$t && echo "make prepush: grün ($$t)"
|
||||
@t=$$(python3 $(SCRIPTS)/changed_scope.py targets $(BASE)) && t=$$($(STAMP) pending $$t) && if [ -z "$$t" ]; then echo "make prepush: für diesen Commit schon alles grün (make stamp)"; else $(MAKE) --no-print-directory $$t && $(STAMP) record prepush $$t && echo "make prepush: grün ($$t)"; fi
|
||||
|
||||
check: secrets lint test sast audit ## Alles: Secrets, Lint, Tests, SAST, Audit (vor Deploy, bei Werkzeug-Änderung)
|
||||
check: ## Alles: Secrets, Lint, Tests, SAST, Audit (vor Deploy, bei Werkzeug-Änderung)
|
||||
@$(STAMP) begin check
|
||||
@$(MAKE) --no-print-directory secrets lint test sast audit
|
||||
@$(STAMP) record check
|
||||
@echo "make check: alles grün"
|
||||
|
||||
RELEASE_CHECKS = check $(if $(wildcard $(MUTATIONS)),mutation) $(if $(IMAGE),container=$(IMAGE))
|
||||
release-checks: ## Vor Deploy: check, mutation, container (IMAGE=) nur, wenn für den Commit kein gültiger Stempel da ist
|
||||
@$(STAMP) clean || (echo "release-checks: Arbeitsbaum nicht sauber, erst committen" && exit 1)
|
||||
@$(STAMP) status check >/dev/null || $(MAKE) --no-print-directory check
|
||||
@if [ -f "$(MUTATIONS)" ]; then $(STAMP) status mutation >/dev/null || $(MAKE) --no-print-directory mutation; fi
|
||||
@if [ -n "$(IMAGE)" ]; then $(STAMP) status "container=$(IMAGE)" >/dev/null || $(MAKE) --no-print-directory container IMAGE="$(IMAGE)"; fi
|
||||
@$(STAMP) status $(RELEASE_CHECKS)
|
||||
|
||||
release-report: ## Markdown-Tabelle der Prüfungen fürs Release-Protokoll (docs/releases/)
|
||||
@$(STAMP) report $(patsubst container=%,container,$(RELEASE_CHECKS)) zap fuzz
|
||||
|
||||
stamp: ## Stempel für den aktuellen Commit anzeigen
|
||||
@$(STAMP) status
|
||||
|
||||
weekly: ## Wochenlauf: check + Trivy, läuft nach Fehlern weiter (neue CVEs kommen ohne Code-Änderung)
|
||||
$(MAKE) -k --no-print-directory secrets lint test sast audit trivy-fs
|
||||
@echo "make weekly: alles grün"
|
||||
|
|
@ -150,21 +174,29 @@ trivy-fs: ## Trivy übers Repo: Abhängigkeiten, Secrets, Fehlkonfiguration (HIG
|
|||
|
||||
container: ## Image + Dockerfile/Compose scannen: make container IMAGE=name:tag
|
||||
@test -n "$(IMAGE)" || (echo "IMAGE=name:tag angeben" && exit 2)
|
||||
@$(STAMP) begin container
|
||||
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock $(TRIVY_IMAGE) image --severity HIGH,CRITICAL --exit-code 1 --ignore-unfixed $(IMAGE)
|
||||
$(DOCKER) $(TRIVY_IMAGE) config --severity HIGH,CRITICAL --exit-code 1 /src
|
||||
for f in $$(ls Dockerfile* 2>/dev/null); do docker run --rm -i $(HADOLINT_IMAGE) < $$f || exit 1; done
|
||||
@$(STAMP) record container $(IMAGE)
|
||||
|
||||
zap: ## ZAP-Baseline (bricht nur bei FAIL ab, ZAP_ARGS= für strikt): make zap TARGET=https://...
|
||||
@test -n "$(TARGET)" || (echo "TARGET=url angeben" && exit 2)
|
||||
mkdir -p reports
|
||||
@$(STAMP) begin zap
|
||||
docker run --rm --network host -u $(UID_GID) -v "$(CURDIR)/reports":/zap/wrk $(ZAP_IMAGE) zap-baseline.py -t $(TARGET) -r zap-baseline.html $(ZAP_ARGS)
|
||||
@$(STAMP) record zap $(TARGET)
|
||||
|
||||
fuzz: ## API-Fuzzing (5xx-Suche; FUZZ_CHECKS=all für volle Spec-Prüfung): make fuzz TARGET=http://...
|
||||
@test -n "$(TARGET)" || (echo "TARGET=url angeben" && exit 2)
|
||||
@$(STAMP) begin fuzz
|
||||
docker run --rm --network host $(SCHEMATHESIS_IMAGE) run $(TARGET)$(OPENAPI_PATH) --checks $(FUZZ_CHECKS) $(FUZZ_ARGS)
|
||||
@$(STAMP) record fuzz $(TARGET)
|
||||
|
||||
mutation: ## Sicherheits-Mutationen: jede muss einen Test rot machen
|
||||
@$(STAMP) begin mutation
|
||||
python3 $(SCRIPTS)/mutation_check.py $(MUTATIONS)
|
||||
@$(STAMP) record mutation
|
||||
|
||||
mutmut: ## Mutation-Testing des ganzen Python-Codes (langsam)
|
||||
cd $(PY_DIR) && .venv/bin/mutmut run && .venv/bin/mutmut results
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue