“安全左移”（Shift-Left Security）指的是将安全检测从部署后的阶段提前到 CI/CD 流水线的早期环节。在代码提交、构建和测试阶段即发现并修复安全问题，可以大幅降低修复成本和安全风险。
DevSecOps 流水线实践
以下是一个集成了多种安全扫描的 GitHub Actions 流水线示例：
name: Secure CI Pipeline
on: [push, pull_request]
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: SAST Scan (Semgrep)
uses: semgrep/semgrep-action@v1
with:
config: p/default
- name: Dependency Vulnerability Check
uses: aquasecurity/trivy-action@master
with:
scan-type: fs
scan-ref: .
format: sarif
output: trivy-results.sarif
severity: HIGH,CRITICAL
- name: Container Image Scan
uses: aquasecurity/trivy-action@master
with:
scan-type: image
image-ref: myapp:${{ github.sha }}
format: sarif
output: trivy-image.sarif
- name: Secret Detection (Gitleaks)
uses: gitleaks/gitleaks-action@v2
with:
config-path: .gitleaks.toml
- name: License Compliance Check
uses: fossa-contrib/fossa-action@v2
yaml
name: Secure CI Pipeline
on: [push, pull_request]
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: SAST Scan (Semgrep)
uses: semgrep/semgrep-action@v1
with:
config: p/default
- name: Dependency Vulnerability Check
uses: aquasecurity/trivy-action@master
with:
scan-type: fs
scan-ref: .
format: sarif
output: trivy-results.sarif
severity: HIGH,CRITICAL
- name: Container Image Scan
uses: aquasecurity/trivy-action@master
with:
scan-type: image
image-ref: myapp:${{ github.sha }}
format: sarif
output: trivy-image.sarif
- name: Secret Detection (Gitleaks)
uses: gitleaks/gitleaks-action@v2
with:
config-path: .gitleaks.toml
- name: License Compliance Check
uses: fossa-contrib/fossa-action@v2扫描工具解析
SAST（静态应用安全测试）工具如 Semgrep 能在代码层面发现 SQL 注入、XSS 等漏洞。Trivy 对依赖和容器镜像进行全面扫描，检测已知 CVE。Gitleaks 扫描 Git 历史中的敏感信息泄露，防止密钥和令牌被误提交。
策略即代码
通过 Open Policy Agent (OPA) 或 Kubernetes Gatekeeper，将安全策略定义为代码，强制执行合规要求。例如：禁止高危漏洞的镜像部署到生产环境、强制所有容器以非 root 用户运行、要求所有 API 必须经过身份认证等。
安全左移不是一次性活动，而是需要持续改进的文化转变。通过将安全嵌入开发流程的每个环节，团队可以从"我们检查安全"转变为"我们默认安全"。