Tweet
Tweet

Slide 1

Slide 1 text

GitHub ActionsͰ DevSecOpsͬ͜͝ June 13, 2022 ୈ5ճLTձ Akira Moroo (@retrage)

Slide 2

Slide 2 text

GitHub Actions (GHA) • GitHubʹ౷߹͞Ε͍ͯΔ • ઃఆϑΝΠϧΛ഑ஔ͢Δ͚ͩ • ߏ଄Խ͞Ε͍ͯΔ • ࠷খ୯Ґ: step • ίϚϯυ࣮ߦ or action࣮ߦ • action͸ࣗ࡞Մೳ CI/CDαʔϏεͷ1ͭ Job Work f low Step

Slide 3

Slide 3 text

actionͷ࡞Γํ • GitHubϦϙδτϦ௚Լʹ action.yamlΛ഑ஔ • action.yaml: actionΛఆٛ • ೖྗ (■) • ग़ྗ (■) • ࣮ߦޙͷstepͰࢀরՄೳ • ࣮ߦํ๏ (■) Yamlϙϯஔ͖Ͱ؆୯

Slide 4

Slide 4 text

actionͷछྨ ࣮ߦํ๏ʹΑͬͯ3छྨʹ෼͚ΒΕΔ • JavaScript action: JavaScriptͷΈͰهड़ • Docker container action: ίϯςφΛ࣮ߦ • Composite action: ࠶ར༻ՄೳͳGHA work f low (stepͷू·Γ) • Docker container action͕Ұ൪ࣗ༝౓͕ߴ͍: • 👉 ؀ڥΛด͡ࠐΊͯ͋͛Ε͹͓खܰʹDevSecOpsͬ͜͝Ͱ͖ͦ͏

Slide 5

Slide 5 text

Actionࣗ࡞ͯ͠Έͨ • ࣗ࡞UEFI SMM੩తղੳGhidraϓ ϥάΠϯΛར༻ • non-GUI GhidraΛ࣮ߦ • ೖྗ (■): ղੳର৅ͷόΠφϦ • ग़ྗ (■): ղੳ݁Ռ • ࣮ߦํ๏ (■): Docker container

Slide 6

Slide 6 text

Actionࣗ࡞ͯ͠Έͨ • ೖྗ (■) ͸όΠφϦ͚ͩ • ϓϩϓϥͰ΋OK • ग़ྗ (■) ͸JUnit XML format • ղੳ݁Ռͷ࠶ར༻ੑ޲্ • ӈͷྫͰ͸ղੳ݁ՌΛطଘ ͷactionʹ౉͍ͯ͠Δ (■) ޻෉ϙΠϯτ

Slide 7

Slide 7 text

Actionࣗ࡞ͯ͠Έͨ: ղੳ݁Ռྫ ղੳ݁ՌͷJUnit XML formatग़ྗ ݕग़ͨ݁͠ՌΛΤϥʔͱͯ͠ใࠂ

Slide 8

Slide 8 text

Actionࣗ࡞ͯ͠Έͨ: ղੳ݁Ռྫ JUnit XML formatͰग़ྗ͢Δ͜ͱͰۤ࿑ͤͣʹղੳ݁ՌΛCIʹ૊ΈࠐΊͨ

Slide 9

Slide 9 text

Actionࣗ࡞ͯ͠Έͨ: վળ఺ • ݡ͘ղੳ݁ՌΛग़ྗ͍ͨ͠ • ࠓճ͸ղੳϩάΛPythonͰύʔεͯ͠ແཧ΍ΓJUnit XML formatʹม׵ • ϓϥάΠϯ͕௚઀JSON/XMLΛग़ྗ͢Δ΂͖ • ·ͱ΋ͳόΠφϦͷղੳ݁Ռදࣔػೳ͕΄͍͠ • JUnit XML format΋GHA΋ίʔυͷߦͱྻϨϕϧͷΞϊςʔγϣϯͷΈ • ؤுͬͯΤϥʔʹٯΞηϯϒϧ݁ՌΛදࣔ͢Δ͔͠ͳ͍

Slide 10

Slide 10 text

·ͱΊ • GitHub Actions͸GitHubʹ౷߹͞ΕͨCI/CDαʔϏε • GHAͷaction͸؆୯ʹࣗ࡞Մೳ • Action͸3छྨ͋Δ͕ɺDocker container action͕Ұ൪ࣗ༝౓͕ߴ͍ • ࣗ࡞UEFI SMM੩తղੳGhidraϓϥάΠϯͷactionΛ࡞ͬͯΈͨ • JUnit XML formatͰग़ྗ͢Δ͜ͱͰղੳ݁Ռͷ࠶ར༻ੑ͕ߴ͘ͳͬͨ • ݱঢ়Ͱ͸όΠφϦͷղੳ݁Ռදࣔ͸޻෉͕ඞཁ