本文亦可在巴西葡萄牙语中阅读。
huskyCI 是一个开源工具，负责编排安全测试，并将所有结果集中到一个数据库中，以便进行进一步的分析和指标统计。它可以对 Python（[Bandit][Bandit] 和 [Safety][Safety]）、Ruby（[Brakeman][Brakeman]）、JavaScript（[Npm Audit][NpmAudit] 和 [Yarn Audit][YarnAudit]）、Golang（[Gosec][Gosec]）、Java（[SpotBugs][SpotBugs] 与 [Find Sec Bugs][FindSec]）以及 HCL（[TFSec][TFSec]）进行静态安全分析。它还可以使用 [GitLeaks][Gitleaks] 审计仓库中是否存在诸如 AWS 密钥、私钥 SSH 密钥等机密信息。
开发者可以在其 CI 流水线中新增一个阶段来检查漏洞：
如果代码中发现安全问题，则会显示严重级别、置信度、文件、行号以及许多其他有用的信息，如下例所示：
[HUSKYCI][*] poc-python-bandit -> https://github.com/globocom/huskyCI.git
[HUSKYCI][*] huskyCI analysis started! yDS9tb9mdt4QnnyvOBp3eVAXE1nWpTRQ
[HUSKYCI][!] Title: Use of exec detected.
[HUSKYCI][!] Language: Python
[HUSKYCI][!] Tool: Bandit
[HUSKYCI][!] Severity: MEDIUM
[HUSKYCI][!] Confidence: HIGH
[HUSKYCI][!] Details: Use of exec detected.
[HUSKYCI][!] File: ./main.py
[HUSKYCI][!] Line: 7
[HUSKYCI][!] Code:
6
7 exec(command)
8
[HUSKYCI][!] Title: Possible hardcoded password: 'password123!'
[HUSKYCI][!] Language: Python
[HUSKYCI][!] Tool: Bandit
[HUSKYCI][!] Severity: LOW
[HUSKYCI][!] Confidence: MEDIUM
[HUSKYCI][!] Details: Possible hardcoded password: 'password123!'
[HUSKYCI][!] File: ./main.py
[HUSKYCI][!] Line: 1
[HUSKYCI][!] Code:
1 secret = 'password123!'
2
3 password = 'thisisnotapassword' #nohusky
4
[HUSKYCI][SUMMARY] Python -> huskyci/bandit:1.6.2
[HUSKYCI][SUMMARY] High: 0
[HUSKYCI][SUMMARY] Medium: 1
[HUSKYCI][SUMMARY] Low: 1
[HUSKYCI][SUMMARY] NoSecHusky: 1
[HUSKYCI][SUMMARY] Total
[HUSKYCI][SUMMARY] High: 0
[HUSKYCI][SUMMARY] Medium: 1
[HUSKYCI][SUMMARY] Low: 1
[HUSKYCI][SUMMARY] NoSecHusky: 1
[HUSKYCI][*] The following securityTests were executed and no blocking vulnerabilities were found:
[HUSKYCI][*] [huskyci/gitleaks:2.1.0]
[HUSKYCI][*] Some HIGH/MEDIUM issues were found in these securityTests:
[HUSKYCI][*] [huskyci/bandit:1.6.2]
ERROR: Job failed: exit code 190
您可以按照本指南使用 Docker Compose 搭建本地环境来尝试 huskyCI。
所有指南和完整文档可在官方文档页面找到。
阅读我们的贡献指南以了解我们的开发流程、如何提出错误修复和改进建议，以及如何构建和测试您对 huskyCI 的更改。
我们有多个联系方式，欢迎随时通过以下渠道与我们联系：