supply-chain-security

Supply Chain Security

Applicable Scenarios

• Dependency vulnerability scanning (npm / pip / Maven)
• Container image security scanning
• CI/CD pipeline security
• SBOM (Software Bill of Materials)
• Malicious package detection

Core Principles

1. 依赖 = 攻击面
   每个依赖都可能有漏洞

2. 锁定版本
   lockfile 必须提交

1. Regular scanning Not a one-time thing, but continuous

2. Minimal dependencies Don't install what you don't need

3. Images also need scanning Base images may have vulnerabilities

## 工具

| 工具 | 用途 |
|---|---|
| Snyk | 依赖 + 容器 + 代码 |
| Dependabot | GitHub 自动 PR |
| Trivy | 容器 + 文件系统 |
| npm audit | npm 依赖 |
| pip-audit | Python 依赖 |
| OWASP Dependency-Check | Java |
| Grype | 容器扫描 |
| Syft | SBOM 生成 |
| cosign | 镜像签名 |

## CI 集成

```yaml
# GitHub Actions
- name: Trivy scan
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'my-app:${{ github.sha }}'
    severity: 'CRITICAL,HIGH'
    exit-code: '1'

Supporting Templates

• templates/dependency-audit-template.md — Dependency audit report

Quality Self-Check

□ CI 集成依赖扫描
□ CI 集成镜像扫描
□ 高危漏洞阻塞合并
□ lockfile 提交
□ 定期更新依赖
□ SBOM 生成
□ 新依赖评估流程

Common Pitfalls

1. Not scanning——Known vulnerabilities enter production
2. Not locking versions——Builds are not reproducible
3. Not updating——Vulnerabilities accumulate
4. Scanning without fixing——No one looks at the scan results
5. typosquatting——Installing the wrong package name

Collaboration with other skills

上游：
  devops-engineer ci-cd-pipeline → CI 集成

下游：
  security-report → 扫描结果纳入报告
  backend/frontend → 修复