Snyk

# GitHub Actions - Snyk 보안 검사 통합
name: Security Scan

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 9 * * 1'  # 매주 월요일 오전 9시

jobs:
  snyk-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      # 오픈소스 의존성 검사
      - name: Snyk Open Source Test
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

      # 코드 보안 분석 (SAST)
      - name: Snyk Code Test
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: code test

      # 컨테이너 이미지 검사
      - name: Build Docker Image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Snyk Container Test
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: myapp:${{ github.sha }}
          args: --severity-threshold=critical

      # IaC 보안 검사
      - name: Snyk IaC Test
        uses: snyk/actions/iac@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=medium

      # Snyk 모니터링 등록 (main 브랜치만)
      - name: Monitor with Snyk
        if: github.ref == 'refs/heads/main'
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: monitor

# Python - Snyk API를 활용한 취약점 관리 자동화
import requests
import json
from typing import List, Dict

class SnykClient:
    """Snyk API 클라이언트"""

    def __init__(self, token: str, org_id: str):
        self.base_url = "https://api.snyk.io/v1"
        self.headers = {
            "Authorization": f"token {token}",
            "Content-Type": "application/json"
        }
        self.org_id = org_id

    def list_projects(self) -> List[Dict]:
        """조직의 모든 프로젝트 목록 조회"""
        response = requests.get(
            f"{self.base_url}/org/{self.org_id}/projects",
            headers=self.headers
        )
        response.raise_for_status()
        return response.json()["projects"]

    def get_project_issues(self, project_id: str) -> Dict:
        """프로젝트의 취약점 상세 조회"""
        response = requests.post(
            f"{self.base_url}/org/{self.org_id}/project/{project_id}/issues",
            headers=self.headers,
            json={
                "filters": {
                    "severities": ["critical", "high"],
                    "types": ["vuln"],
                    "ignored": False,
                    "patched": False
                }
            }
        )
        response.raise_for_status()
        return response.json()

    def ignore_issue(self, project_id: str, issue_id: str, reason: str):
        """특정 이슈 무시 처리"""
        response = requests.post(
            f"{self.base_url}/org/{self.org_id}/project/{project_id}/ignore/{issue_id}",
            headers=self.headers,
            json={
                "ignorePath": "",
                "reason": reason,
                "reasonType": "not-vulnerable",
                "disregardIfFixable": False
            }
        )
        response.raise_for_status()
        return response.json()

    def generate_report(self) -> Dict:
        """조직 전체 보안 리포트 생성"""
        projects = self.list_projects()
        report = {
            "total_projects": len(projects),
            "critical_issues": 0,
            "high_issues": 0,
            "projects_with_issues": []
        }

        for project in projects:
            issues = self.get_project_issues(project["id"])
            issue_count = issues.get("issues", {})

            critical = len([i for i in issue_count.get("vulnerabilities", [])
                           if i["severity"] == "critical"])
            high = len([i for i in issue_count.get("vulnerabilities", [])
                       if i["severity"] == "high"])

            if critical > 0 or high > 0:
                report["critical_issues"] += critical
                report["high_issues"] += high
                report["projects_with_issues"].append({
                    "name": project["name"],
                    "critical": critical,
                    "high": high
                })

        return report


# 사용 예시
if __name__ == "__main__":
    client = SnykClient(
        token="your-snyk-api-token",
        org_id="your-org-id"
    )

    # 보안 리포트 생성
    report = client.generate_report()
    print(f"전체 프로젝트: {report['total_projects']}")
    print(f"Critical 취약점: {report['critical_issues']}")
    print(f"High 취약점: {report['high_issues']}")

    # Slack/Teams 알림 연동 가능
    for project in report["projects_with_issues"]:
        print(f"  - {project['name']}: C:{project['critical']} H:{project['high']}")