보안 요구사항 검토 및 시험이 수행되고 있는가?

# .github/workflows/security-testing.yml
name: Security Testing Pipeline
on:
  push:
    branches: [main]

jobs:
  # 1. 스테이징 배포
  deploy-staging:
    runs-on: ubuntu-latest
    outputs:
      staging_url: ${{ steps.deploy.outputs.url }}
    steps:
      - name: Deploy to Staging
        id: deploy
        run: |
          aws ecs update-service --cluster staging --service app
          echo "url=https://staging.example.com" >> $GITHUB_OUTPUT

  # 2. DAST - OWASP ZAP Full Scan
  dast:
    needs: deploy-staging
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: OWASP ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: ${{ needs.deploy-staging.outputs.staging_url }}
          rules_file_name: '.zap/rules.tsv'
          fail_action: true  # High/Critical 시 실패

  # 3. 보안 인수 테스트
  security-acceptance:
    needs: deploy-staging
    runs-on: ubuntu-latest
    steps:
      - name: Authentication Tests
        run: pytest tests/security/test_auth_bypass.py -v
      - name: Input Validation Tests
        run: pytest tests/security/test_sql_injection.py -v

  # 4. AWS Inspector 스캔
  inspector:
    needs: deploy-staging
    runs-on: ubuntu-latest
    steps:
      - name: Check Inspector Findings
        run: |
          CRITICAL=$(aws inspector2 list-findings \
            --filter-criteria '{"severity":[{"comparison":"EQUALS","value":"CRITICAL"}]}' \
            --query 'findings | length(@)')
          if [ "$CRITICAL" -gt 0 ]; then exit 1; fi

  # 5. 운영 배포 (모든 시험 통과 후)
  deploy-production:
    needs: [dast, security-acceptance, inspector]
    runs-on: ubuntu-latest
    environment: production
    steps:
      - name: Deploy to Production
        run: aws ecs update-service --cluster prod --service app

💡 핵심: 스테이징에 배포 후 DAST, 보안 인수 테스트, Inspector를 병렬로 실행하고 모든 보안 시험 통과 시에만 운영 배포를 허용합니다.

📚 참고 자료