DevSecOps Tutorial | CI Pipeline with GitHub Actions & Docker Scout

1. Konsep DevSecOps (Shift Left Security)

Pada alur DevOps tradisional, pengujian keamanan sering dilakukan di akhir sebelum release. Jika ditemukan kerentanan, perbaikan akan memakan waktu sangat mahal.

DevSecOps (Shift Left) memindahkan audit keamanan langsung ke dalam alur CI/CD pipeline setiap kali terjadi kode commit:

• SAST (Static Application Security Testing): Memindai kelemahan keamanan di kode sumber (misal dengan CodeQL atau SonarQube).
• SCA (Software Composition Analysis): Memindai kerentanan pada dependency/library open-source (misal npm audit atau Snyk).
• Container Image Scanning: Memindai kerentanan (CVE) pada layer image Docker (misal dengan Docker Scout atau Trivy).

2. Integrasi Docker Scout di GitHub Actions

name: DevSecOps Vulnerability Scan

on: [push]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Build Docker Image locally
        run: docker build -t myapp:test .

      - name: Docker Scout Vulnerability Scan
        uses: docker/scout-action@v1
        with:
          command: cves
          image: myapp:test
          only-severities: critical,high
          exit-code: true # Fail pipeline jika ada vulnerability Critical/High!