Pre-Requirements
XEIZE Token
XEIZE_TOKEN 토큰을 발급 받아야 Github Actions에 적용이 가능합니다.
GitHub Action 권한 설정
GitHub Actions을 통해 comment를 달기위해 아래와 같은 권한이 필요합니다. (예제를 참고하여 추가하시길 바랍니다.)
- checks: write
- contents: read
- pull-requests: write
XEIZE_GITHUB_API_TOKEN에는 예제와 같이 ${{ secrets.GITHUB_TOKEN }}을 전달해야 합니다.
스캔 결과 언어 설정
SAST, Secret, IaC가 Pull Request에 작성하는 취약점 결과와 댓글 언어는 job의 env에 LANG을 추가하여 설정합니다.
yaml
env:
LANG: EN
지원하는 값은 KO(한국어), EN(영어), JP(일본어)입니다. LANG을 설정하지 않으면 한국어가 기본값으로 사용됩니다.
예제
SAST 적용
yaml
name: XEIZE SAST Workflow
on:
pull_request:
jobs:
sast:
name: xez-sast
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
LANG: EN
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ SAST
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
Secret 적용
yaml
name: XEIZE SECRET Workflow
on:
pull_request:
jobs:
secret:
name: xez-secret
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
MODE: secret
LANG: EN
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ Secret
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
IaC 적용
yaml
name: XEIZE IaC Workflow
on:
pull_request:
jobs:
iac:
name: xez-iac
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
MODE: iac
LANG: EN
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ IaC
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
LEVEL 설정을 통한 Merge Block
yaml
name: XEIZE Workflow
on:
pull_request:
jobs:
sast:
name: xez-sast
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
LEVEL: high
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ SAST
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
AUDIT LEVEL 설정을 통한 취약점 필터
yaml
name: XEIZE Workflow
on:
pull_request:
jobs:
iac:
name: xez-iac
runs-on: ubuntu-latest
permissions:
checks: write
contents: read
pull-requests: write
env:
XEIZE_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
MODE: iac
AUDIT_LEVEL: low
steps:
- name: Checkout code
uses: actions/checkout@v7
- name: Run XEZ IaC
run: |
curl -L -o xez_ci "https://download.xeize.dev/ci/ci_linux_x64" -H "X-XEZ-TOKEN: $XEIZE_TOKEN" && chmod +x xez_ci
./xez_ci
PR 없는 push 워크플로
develop 브랜치 push에서 MODE=all로 SAST, Secret, IaC를 검사하고, 성공하면 빌드·배포를 실행합니다. XEIZE_TOKEN을 Actions secret에 등록하세요.
yaml
name: XEIZE push security
on:
push:
branches: [develop]
permissions:
contents: read
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
with:
fetch-depth: 0
- name: Scan pushed changes
env:
XEIZE_TOKEN: ${{ secrets.XEIZE_TOKEN }}
MODE: all
LEVEL: medium
run: |
curl -fsSL -H "X-XEZ-TOKEN: $XEIZE_TOKEN" https://download.xeize.dev/ci/ci_linux_x64 -o /tmp/xez_ci
chmod +x /tmp/xez_ci
/tmp/xez_ci
build:
needs: [security]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: ./ci/build.sh
deploy:
needs: [build]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- run: ./ci/deploy.sh
빌드·배포 명령은 프로젝트에 맞게 교체하고, security → build → deploy 의존성을 유지하세요. 검사 범위와 오류 처리 방식은 공통 설정을 참고하세요.