Keamanan CI/CD Pipeline

CI/CD pipeline adalah jalur otomatis dari kode ke production. Jika pipeline di-compromise, penyerang bisa menyisipkan kode berbahaya yang otomatis di-deploy. Pipeline security sering diabaikan padahal sangat kritis.

Ancaman pada CI/CD

• Secret exposure — Credentials yang terekspos di build logs
• Code injection — Menyisipkan kode berbahaya melalui PR
• Supply chain — Dependency atau action yang di-compromise
• Insufficient permissions — Pipeline dengan akses terlalu luas
• Artifact tampering — Build artifacts dimodifikasi sebelum deploy

GitHub Actions Security

1. Pin Action Versions

# BURUK: menggunakan tag yang bisa berubah
- uses: actions/checkout@v4

# BAIK: pin ke commit SHA
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

2. Secret Management

# BURUK: secret di workflow file
env:
  API_KEY: sk_live_abc123  # JANGAN hardcode!

# BAIK: gunakan GitHub Secrets
env:
  API_KEY: ${{ secrets.API_KEY }}

# BAIK: gunakan Environments untuk approval
jobs:
  deploy:
    environment: production  # Memerlukan approval
    steps:
      - run: deploy.sh
        env:
          API_KEY: ${{ secrets.PROD_API_KEY }}

3. Permissions Minimal

# Set permissions minimal di top level
permissions:
  contents: read
  pull-requests: write

# Atau per job
jobs:
  test:
    permissions:
      contents: read
  deploy:
    permissions:
      contents: read
      deployments: write

4. Security Scanning di Pipeline

name: Security Checks
on: [push, pull_request]
jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Dependency scanning
      - run: npm audit --audit-level=high

      # Secret scanning
      - uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

      # SAST (Static Application Security Testing)
      - uses: github/codeql-action/analyze@v3

Best Practices CI/CD Security

• Pin dependencies dan action versions ke SHA
• Gunakan minimal permissions (principle of least privilege)
• Jangan echo secrets di logs
• Aktifkan branch protection dan require reviews
• Jalankan security scanning di setiap PR
• Gunakan environments dengan approval untuk production
• Audit workflow runs secara berkala
• Rotate secrets secara berkala