DevSecOps — pipeline-এ নিরাপত্তা, OIDC আর SLSA

// Security gate: score each finding, then decide. All weights are our assumption.
const WARN_AT = 30, BLOCK_AT = 70;   // change these two and run again
const TODAY = "2026-11-01";          // simulated clock
const SEV = { critical: 50, high: 30, medium: 12, low: 3 };
function score(f) {
  let s = SEV[f.sev];
  s += f.reachable ? 20 : -15;       // does our code really reach it?
  if (f.exploited) s += 30;          // known to be exploited in the wild
  if (f.internet) s += 10;           // service faces the internet
  if (!f.fixAvailable) s -= 10;      // nothing to upgrade to yet
  return Math.max(0, Math.min(100, s));
}
function decide(f) {
  if (f.verifiedSecret) return ["BLOCK", 100, "live secret, score ignored"];
  if (f.waiverUntil && f.waiverUntil >= TODAY) return ["WAIVED", 0, "until " + f.waiverUntil];
  if (f.existing) return ["WARN", score(f), "old finding, tracked, not this PR"];
  const s = score(f);
  return [s >= BLOCK_AT ? "BLOCK" : s >= WARN_AT ? "WARN" : "INFO", s, "new finding"];
}
const findings = [
  { id: "secret-scan: cloud key", verifiedSecret: true },
  { id: "CVE in web framework", sev: "critical", reachable: true, exploited: true, internet: true, fixAvailable: true },
  { id: "CVE in test-only tool", sev: "critical", reachable: false, fixAvailable: true },
  { id: "SAST: weak hash", sev: "medium", reachable: true, internet: true, fixAvailable: true },
  { id: "old CVE in base image", sev: "high", reachable: true, fixAvailable: true, existing: true },
  { id: "CVE, no fix yet", sev: "high", reachable: true, internet: true, fixAvailable: false, waiverUntil: "2026-11-20" },
  { id: "CVE, waiver expired", sev: "high", reachable: true, internet: true, fixAvailable: true, waiverUntil: "2026-10-01" },
];
let blocked = 0;
for (const f of findings) {
  const [verdict, s, why] = decide(f);
  blocked += verdict === "BLOCK";
  console.log(verdict.padEnd(7), String(s).padStart(3), f.id + " (" + why + ")");
}
console.log(blocked ? "PR status: FAILED, " + blocked + " blocking" : "PR status: PASSED");

# Valid YAML, parsed but not run on a real repository.
name: test
on:
  pull_request:
permissions:
  contents: read          # default for every job: read only
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      # checked with git ls-remote in October 2026
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - run: npm ci
      - run: npm test

// SHA-pinning checker over sample workflow text. Every SHA here is fake.
const workflow = `
      - uses: actions/checkout@1111111111111111111111111111111111111111  # v7.0.1
      - uses: example-org/lint-action@v3
      - uses: example-org/scan-action@v2.4.1
      - uses: example-org/report-action@main
      - uses: example-org/cache-action@abc1234
      - uses: ./.github/actions/deploy
      - uses: docker://example.com/tool:latest
      - uses: docker://example.com/tool@sha256:${"a".repeat(64)}
`;

function classify(ref) {
  if (ref.startsWith("./")) return ["OK  ", "local, reviewed in this repository"];
  if (ref.startsWith("docker://"))
    return /@sha256:[0-9a-f]{64}$/.test(ref)
      ? ["OK  ", "image pinned by digest"]
      : ["FAIL", "image tag can move"];
  const rev = ref.split("@")[1] || "";
  if (/^[0-9a-f]{40}$/.test(rev)) return ["OK  ", "full commit SHA"];
  if (/^[0-9a-f]{7,39}$/.test(rev)) return ["FAIL", "short SHA is not a full pin"];
  if (/^v?\d/.test(rev)) return ["FAIL", "tag can move"];
  return ["FAIL", "branch moves on every push"];
}

let ok = 0, total = 0;
for (const line of workflow.split("\n")) {
  const m = line.match(/uses:\s*(\S+)/);
  if (!m) continue;
  const [status, why] = classify(m[1]);
  total++;
  if (status === "OK  ") ok++;
  console.log(status, m[1].slice(0, 40).padEnd(40), why);
}
console.log("pinned " + ok + " of " + total + " = " + Math.round(100 * ok / total) + "%");

# Audit a sample workflow for unpinned actions and broad permissions.
set -euo pipefail
cat > ci.yml <<'YAML'
on:
  pull_request_target:
permissions: write-all
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: example-org/lint-action@main
      - uses: example-org/scan-action@1111111111111111111111111111111111111111
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: ./.github/actions/deploy
YAML
awk '
/^  [a-z_-]+:$/ { job = $1 }
/^ *- uses:/ {
  if ($3 ~ /^\.\//) next
  split($3, part, "@")
  if (length(part[2]) != 40 || part[2] ~ /[^0-9a-f]/) {
    print "line " NR ": unpinned action: " $3; bad++
  }
}
/permissions: *write-all/ { print "line " NR ": broad token: write-all"; bad++ }
/^ *(pull_request_target|workflow_run):/ { print "line " NR ": review trigger: " $1; bad++ }
/id-token: *write/ { print "line " NR ": note: OIDC allowed in job " job }
END { print "findings: " bad + 0 }
' ci.yml

name: deploy
on:
  push:
    branches: [main]
permissions:
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write     # may request the OIDC token
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
      - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd  # v6.3.0
        with:
          role-to-assume: arn:aws:iam::123456789012:role/shop-api-deploy
          aws-region: ap-south-1
          role-duration-seconds: 900
      - run: ./deploy.sh

{
  "iss": "https://token.actions.githubusercontent.com",
  "aud": "sts.amazonaws.com",
  "sub": "repo:example-org/shop-api:ref:refs/heads/main",
  "repository": "example-org/shop-api",
  "ref": "refs/heads/main",
  "sha": "1111111111111111111111111111111111111111",
  "event_name": "push",
  "run_id": "1234567890",
  "iat": 1800000000,
  "exp": 1800000300
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
          "token.actions.githubusercontent.com:sub": "repo:example-org/shop-api:ref:refs/heads/main"
        }
      }
    }
  ]
}

// OIDC trust-policy matcher: a small model, not any provider's real engine.
const NOW = 1000;                    // simulated clock, in seconds
const REPO = "repo:example-org/shop-api";
const glob = p => new RegExp("^" + p.split("*").map(s =>
  s.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*") + "$");

const strict = { iss: "https://ci.example.com", aud: "sts.example.com",
                 sub: [REPO + ":ref:refs/heads/main"] };
const loose  = { iss: "https://ci.example.com", aud: "sts.example.com",
                 sub: ["repo:example-org/*"] };

function check(policy, t) {
  if (t.exp <= NOW) return "DENY  token expired";
  if (t.iss !== policy.iss) return "DENY  unknown issuer";
  if (t.aud !== policy.aud) return "DENY  wrong audience";
  if (!policy.sub.some(p => glob(p).test(t.sub))) return "DENY  subject not allowed";
  return "ALLOW short-lived credential";
}

const base = { iss: "https://ci.example.com", aud: "sts.example.com", exp: 1300 };
const tokens = [
  ["main branch", { ...base, sub: REPO + ":ref:refs/heads/main" }],
  ["feature branch", { ...base, sub: REPO + ":ref:refs/heads/feature-x" }],
  ["pull request", { ...base, sub: REPO + ":pull_request" }],
  ["other repo, same org", { ...base, sub: "repo:example-org/old-demo:ref:refs/heads/main" }],
  ["other org", { ...base, sub: "repo:someone-else/shop-api:ref:refs/heads/main" }],
  ["wrong audience", { ...base, aud: "other.example.com", sub: REPO + ":ref:refs/heads/main" }],
  ["expired", { ...base, exp: 900, sub: REPO + ":ref:refs/heads/main" }],
];
for (const [name, t] of tokens) {
  console.log(name.padEnd(21), "strict:", check(strict, t).slice(0, 5),
              " loose:", check(loose, t).slice(0, 5));
}
console.log("why feature branch failed:", check(strict, tokens[1][1]));

$ cat Dockerfile.bad
FROM alpine:3.20
ARG API_TOKEN
RUN test -n "$API_TOKEN" && echo "token received"

$ docker build --progress=plain --no-cache \
    --build-arg API_TOKEN=fake-token-abc123 -f Dockerfile.bad -t abcl-ds2-bad:1 .
…
#5 0.200 token received
…
1 warning found (use docker --debug to expand):
 - SecretsUsedInArgOrEnv: Do not use ARG or ENV instructions for sensitive data (ARG "API_TOKEN") (line 2)

$ docker inspect --format '{{json .Config.Env}}' abcl-ds2-bad:1
["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]

$ docker history --no-trunc --format '{{.CreatedBy}}' abcl-ds2-bad:1
RUN |1 API_TOKEN=fake-token-abc123 /bin/sh -c test -n "$API_TOKEN" && echo "token received" # buildkit
ARG API_TOKEN=fake-token-abc123
…

$ cat Dockerfile.good
FROM alpine:3.20
RUN --mount=type=secret,id=api_token \
    test -s /run/secrets/api_token && echo "token received"

$ docker build --progress=plain --no-cache \
    --secret id=api_token,src=token.txt -f Dockerfile.good -t abcl-ds2-good:1 .
…
#5 0.215 token received
…
$ docker history --no-trunc --format '{{.CreatedBy}}' abcl-ds2-good:1
RUN /bin/sh -c test -s /run/secrets/api_token && echo "token received" # buildkit
…

$ cat Dockerfile.user
FROM alpine:3.20
RUN adduser -D -u 10001 app
USER 10001
CMD ["id"]

$ docker run --rm --hostname demo abcl-ds2-user:1
uid=10001(app) gid=10001(app) groups=10001(app)
$ docker run --rm --hostname demo abcl-ds2-user:1 sh -c 'touch /etc/x; echo exit=$?'
touch: /etc/x: Permission denied
exit=1
$ docker run --rm --hostname demo alpine:3.20 sh -c 'id; touch /etc/x; echo exit=$?'
uid=0(root) gid=0(root) groups=0(root),0(root),1(bin),…
exit=0

# .github/dependabot.yml  (option names as of writing)
version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    groups:
      actions:
        patterns: ["*"]
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    cooldown:
      default-days: 5