Initial commit - 611 cybersecurity skills across all subdomains

2026-08-06 10:50:19 +03:00 · 2026-02-25 10:47:44 +01:00
commit 22a7ab1462
1765 changed files with 280648 additions and 0 deletions
@@ -0,0 +1,216 @@
+# SAST Pipeline Configuration Templates
+
+## GitHub Actions: Combined CodeQL + Semgrep Workflow
+
+```yaml
+# .github/workflows/sast-pipeline.yml
+name: "SAST Security Pipeline"
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 3 * * 1'
+
+concurrency:
+  group: sast-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # ─────────────── CodeQL Analysis ───────────────
+  codeql:
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript', 'python']
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+          config-file: .github/codeql/codeql-config.yml
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
+
+  # ─────────────── Semgrep Scan ───────────────
+  semgrep:
+    name: Semgrep Scan
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    container:
+      image: semgrep/semgrep:latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Semgrep
+        run: |
+          semgrep ci \
+            --config auto \
+            --config p/owasp-top-ten \
+            --config p/cwe-top-25 \
+            --config .semgrep/ \
+            --sarif --output semgrep.sarif \
+            --severity ERROR \
+            --error
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+
+      - name: Upload SARIF
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep
+
+  # ─────────────── Quality Gate ───────────────
+  security-gate:
+    name: Security Quality Gate
+    needs: [codeql, semgrep]
+    runs-on: ubuntu-latest
+    if: always()
+    steps:
+      - name: Check SAST Results
+        run: |
+          if [ "${{ needs.codeql.result }}" == "failure" ] || [ "${{ needs.semgrep.result }}" == "failure" ]; then
+            echo "::error::SAST security gate failed. Review findings in the Security tab."
+            exit 1
+          fi
+          echo "Security gate passed."
+```
+
+## CodeQL Custom Configuration
+
+```yaml
+# .github/codeql/codeql-config.yml
+name: "Organization CodeQL Config"
+
+queries:
+  - uses: security-extended
+  - uses: security-and-quality
+
+paths-ignore:
+  - '**/test/**'
+  - '**/tests/**'
+  - '**/spec/**'
+  - '**/vendor/**'
+  - '**/node_modules/**'
+  - '**/__mocks__/**'
+  - '**/*.test.js'
+  - '**/*.test.ts'
+  - '**/*.spec.py'
+  - '**/migrations/**'
+
+query-filters:
+  - exclude:
+      id: js/unused-local-variable
+  - exclude:
+      id: py/unused-import
+```
+
+## Semgrep Ignore File
+
+```
+# .semgrepignore
+# Test files
+*_test.go
+*_test.py
+*.test.js
+*.test.ts
+*.spec.js
+*.spec.ts
+test/
+tests/
+__tests__/
+spec/
+
+# Generated code
+*_generated.go
+*.pb.go
+**/generated/**
+
+# Vendored dependencies
+vendor/
+node_modules/
+third_party/
+
+# Build artifacts
+dist/
+build/
+out/
+```
+
+## Branch Protection Configuration (Terraform)
+
+```hcl
+# branch-protection.tf
+resource "github_branch_protection" "main" {
+  repository_id = github_repository.app.node_id
+  pattern       = "main"
+
+  required_status_checks {
+    strict   = true
+    contexts = [
+      "CodeQL (javascript)",
+      "CodeQL (python)",
+      "Semgrep Scan",
+      "Security Quality Gate"
+    ]
+  }
+
+  required_pull_request_reviews {
+    required_approving_review_count = 1
+    dismiss_stale_reviews           = true
+  }
+
+  enforce_admins = true
+
+  allows_deletions    = false
+  allows_force_pushes = false
+}
+```
+
+## SARIF Report Aggregation Script
+
+```bash
+#!/bin/bash
+# aggregate-sarif.sh - Merge multiple SARIF files for unified upload
+set -euo pipefail
+
+OUTPUT="merged-results.sarif"
+SARIF_FILES=($(find . -name "*.sarif" -type f))
+
+if [ ${#SARIF_FILES[@]} -eq 0 ]; then
+  echo "No SARIF files found"
+  exit 0
+fi
+
+# Use jq to merge SARIF runs
+jq -s '{
+  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [.[].runs[]]
+}' "${SARIF_FILES[@]}" > "$OUTPUT"
+
+echo "Merged ${#SARIF_FILES[@]} SARIF files into $OUTPUT"
+TOTAL=$(jq '[.runs[].results | length] | add' "$OUTPUT")
+echo "Total findings: $TOTAL"
+```