Copilot instructions

1---
2applyTo: "**/.github/workflows/**, **/security/**, **/Dockerfile*, **/docker-compose*.yml"
3description: "DevSecOps CI/CD security gate sequence, SBOM generation, container scanning, secrets detection, OPA policy enforcement, and supply chain security standards."
4---
5 
6# DevSecOps — Copilot Instructions
7 
8> Applied automatically when working with CI/CD workflows, Dockerfiles, docker-compose files, and security configuration. Loaded alongside copilot-instructions.md.
9 
10---
11 
12## Security Gate Sequence
13 
14Every CI/CD pipeline must enforce security gates in this order. A failure at any gate **blocks the pipeline** — gates are not advisory.
15 
16```
17[ Build ] → [ SAST ] → [ Dependency Check ] → [ Container Scan ] → [ Secrets Scan ] → [ DAST ] → [ SBOM ] → [ OPA Policy ] → [ Deploy ]
18```
19 
20| Gate | Tool | Failure Threshold | Stage |
21|------|------|------------------|-------|
22| SAST | Semgrep (rules: p/java, p/python, p/secrets) | Any CRITICAL or HIGH finding | Pre-merge |
23| Dependency check | OWASP Dependency-Check 9.x, `mvn dependency-check:check` | CVSS ≥ 7.0 (HIGH) | Pre-merge |
24| Container image scan | Trivy 0.50+ | CRITICAL = fail, HIGH = warning | Pre-merge |
25| Secrets scan | Gitleaks 8.x | Any secret detected | Pre-commit + pre-merge |
26| DAST | OWASP ZAP 2.14 (baseline scan) | Any CRITICAL or HIGH alert | Post-deploy to staging |
27| SBOM generation | CycloneDX (Maven) / Syft (containers) | Missing SBOM = fail deploy | Pre-deploy |
28| OPA policy | OPA 0.60 + Rego policies in `security/opa/policies/` | Any deny rule fires | Pre-deploy |
29 
30---
31 
32## SAST — Semgrep Configuration
33 
34`.semgrep.yml` at repo root:
35 
36```yaml
37rules:
38  - id: no-sql-injection
39    pattern: $STMT.execute($INPUT + ...)
40    message: "SQL injection risk — use parameterized queries"
41    severity: ERROR
42    languages: [java]
43 
44# Run in CI:
45# semgrep --config=p/java --config=p/python --config=p/secrets \
46#   --error --json --output=semgrep-results.json .
47# Fail on exit code 1 (findings present)
48```
49 
50GitHub Actions step:
51 
52```yaml
53- name: SAST — Semgrep
54  uses: returntocorp/semgrep-action@v1
55  with:
56    config: >-
57      p/java
58      p/python
59      p/secrets
60      p/owasp-top-ten
61  env:
62    SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
63```
64 
65---
66 
67## Dependency Vulnerability Check
68 
69### Maven (Java)
70 
71```xml
72<!-- pom.xml — add to build/plugins -->
73<plugin>
74  <groupId>org.owasp</groupId>
75  <artifactId>dependency-check-maven</artifactId>
76  <version>9.0.9</version>
77  <configuration>
78    <failBuildOnCVSS>7</failBuildOnCVSS>
79    <suppressionFiles>
80      <suppressionFile>security/dependency-check-suppression.xml</suppressionFile>
81    </suppressionFiles>
82    <format>JSON</format>
83    <outputDirectory>${project.build.directory}/security</outputDirectory>
84  </configuration>
85  <executions>
86    <execution>
87      <goals><goal>check</goal></goals>
88    </execution>
89  </executions>
90</plugin>
91```
92 
93### Python
94 
95```bash
96# pip-audit: audits against PyPA Advisory Database
97pip-audit --requirement requirements.txt --format json --output audit-results.json
98# Fail on CVSS >= 7.0
99pip-audit --requirement requirements.txt --vulnerability-service pypa --fail-on MEDIUM
100```
101 
102### Suppression Process
103 
104CVE suppressions in `security/dependency-check-suppression.xml` must include:
105- The CVE ID
106- Justification: why the vulnerability is not exploitable in this context
107- Expiry date (max 90 days)
108- Approver name
109 
110---
111 
112## Container Scanning — Trivy
113 
114```bash
115# Scan image — fail on CRITICAL, warn on HIGH
116trivy image \
117  --severity CRITICAL,HIGH \
118  --exit-code 1 \
119  --format sarif \
120  --output trivy-results.sarif \
121  --ignore-unfixed \
122  myregistry.azurecr.io/myservice:${GIT_SHA}
123 
124# Scan Dockerfile for misconfigurations
125trivy config \
126  --severity HIGH,CRITICAL \
127  --exit-code 1 \
128  Dockerfile
129```
130 
131### Severity Thresholds
132 
133| Severity | Pipeline Action |
134|----------|----------------|
135| CRITICAL | Build fails — must be patched before merge |
136| HIGH | Build warning — must be resolved within 7 days; tracked in security backlog |
137| MEDIUM | Logged only — review quarterly |
138| LOW/NEGLIGIBLE | Suppressed |
139 
140### Dockerfile Security Standards
141 
142```dockerfile
143# REQUIRED: Use a specific digest, not a floating tag
144FROM eclipse-temurin:21.0.4_7-jre-jammy@sha256:abc123def456...
145 
146# REQUIRED: Run as non-root user
147RUN groupadd -r appuser && useradd -r -g appuser appuser
148USER appuser
149 
150# REQUIRED: No secrets in ENV or ARG
151# WRONG: ENV DATABASE_PASSWORD=secret123
152# RIGHT: Read from AWS Secrets Manager at runtime
153 
154# REQUIRED: Read-only root filesystem where possible
155# docker run --read-only ...
156 
157# REQUIRED: Drop all capabilities
158# docker run --cap-drop ALL --cap-add NET_BIND_SERVICE ...
159 
160# Minimise layers — combine RUN commands
161RUN apt-get update && apt-get install -y --no-install-recommends \
162    curl=7.88.1-* \
163    && rm -rf /var/lib/apt/lists/*
164```
165 
166---
167 
168## Secrets Detection — Gitleaks
169 
170`gitleaks.toml` at repo root:
171 
172```toml
173[extend]
174useDefault = true
175
176[[rules]]
177id = "aws-access-key"
178description = "AWS Access Key ID"
179regex = '''(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}'''
180tags = ["key", "AWS"]
181
182[[rules]]
183id = "internal-api-token"
184description = "Internal API token pattern"
185regex = '''ent_[a-zA-Z0-9]{32,}'''
186tags = ["token", "internal"]
187
188[allowlist]
189description = "Test fixtures and known safe values"
190paths = [
191  '''src/test/resources/.*''',
192  '''\.github/workflows/.*'''  # GitHub Actions uses ${{ secrets.X }} — not real values
193]
194```
195 
196Pre-commit hook (add to `.git/hooks/pre-commit`):
197 
198```bash
199#!/bin/bash
200gitleaks protect --staged --config=gitleaks.toml --redact
201if [ $? -ne 0 ]; then
202  echo &quot;ERROR: Secrets detected. Remove secrets before committing.&quot;
203  exit 1
204fi
205```
206 
207---
208 
209## SBOM — Software Bill of Materials
210 
211### CycloneDX for Maven
212 
213```xml
214<!-- pom.xml -->
215<plugin>
216  <groupId>org.cyclonedx</groupId>
217  <artifactId>cyclonedx-maven-plugin</artifactId>
218  <version>2.7.11</version>
219  <executions>
220    <execution>
221      <phase>package</phase>
222      <goals><goal>makeAggregateBom</goal></goals>
223    </execution>
224  </executions>
225  <configuration>
226    <projectType>library</projectType>
227    <schemaVersion>1.5</schemaVersion>
228    <includeBomSerialNumber>true</includeBomSerialNumber>
229    <includeCompileScope>true</includeCompileScope>
230    <includeTestScope>false</includeTestScope>
231    <outputFormat>json</outputFormat>
232    <outputName>bom</outputName>
233  </configuration>
234</plugin>
235```
236 
237### SPDX for Containers (Syft)
238 
239```bash
240# Generate SPDX SBOM from container image
241syft myregistry.azurecr.io/myservice:${GIT_SHA} \
242  --output spdx-json \
243  --file sbom-container.spdx.json
244 
245# Attach SBOM to OCI image (cosign)
246cosign attach sbom \
247  --sbom sbom-container.spdx.json \
248  --type spdx \
249  myregistry.azurecr.io/myservice:${GIT_SHA}
250```
251 
252SBOMs must be stored in S3: `s3://enterprise-sbom-store/{service-name}/{git-sha}/bom.json`.
253 
254---
255 
256## SLSA Level 2 Requirements
257 
258All production container images must meet SLSA Level 2:
259 
260| Requirement | Implementation |
261|------------|---------------|
262| Hosted build platform | GitHub Actions (not self-hosted runners for production builds) |
263| Scripted build | No manual steps; all in `build.yml` |
264| Build provenance generated | `actions/attest-build-provenance@v1` |
265| Provenance signed | Sigstore/Cosign via GitHub OIDC |
266 
267```yaml
268# .github/workflows/build.yml
269- name: Generate SLSA provenance
270  uses: actions/attest-build-provenance@v1
271  with:
272    subject-name: myregistry.azurecr.io/myservice
273    subject-digest: ${{ steps.build.outputs.digest }}
274    push-to-registry: true
275```
276 
277Verify provenance before deploy:
278 
279```bash
280cosign verify-attestation \
281  --type slsaprovenance \
282  --certificate-identity-regexp &quot;https://github.com/enterprise-org/.*&quot; \
283  --certificate-oidc-issuer &quot;https://token.actions.githubusercontent.com&quot; \
284  myregistry.azurecr.io/myservice:${GIT_SHA}
285```
286 
287---
288 
289## DAST — OWASP ZAP
290 
291```yaml
292# .github/workflows/dast.yml — runs against staging only
293- name: OWASP ZAP Baseline Scan
294  uses: zaproxy/action-baseline@v0.12.0
295  with:
296    target: 'https://staging.internal.enterprise.com'
297    rules_file_name: 'security/zap-rules.tsv'
298    cmd_options: '-a -j'  # -a: include alpha rules; -j: use Ajax spider
299    fail_action: true      # Fail on CRITICAL/HIGH
300  env:
301    ZAP_AUTH_HEADER: ${{ secrets.ZAP_AUTH_HEADER }}
302```
303 
304ZAP rules file `security/zap-rules.tsv`:
305 
306```
307# ID	Action	Parameters	Name
30810202	FAIL		CWEID 1275 - Sensitive Cookie without SameSite Attribute
30910021	FAIL		X-Content-Type-Options Header Missing
31010038	FAIL		Content Security Policy (CSP) Header Not Set
31190022	WARN		Application Error Disclosure
312```
313 
314---
315 
316## OPA/Rego Policy Files
317 
318Policy files in `security/opa/policies/`:
319 
320```rego
321# security/opa/policies/container-policy.rego
322package enterprise.container
323 
324deny[msg] {
325  not input.spec.securityContext.runAsNonRoot
326  msg := "Containers must not run as root (runAsNonRoot: true)"
327}
328 
329deny[msg] {
330  not input.spec.containers[_].resources.limits.cpu
331  msg := "All containers must specify CPU limits"
332}
333 
334deny[msg] {
335  input.spec.containers[_].image == _
336  not regex.match(`^myregistry\.azurecr\.io/`, input.spec.containers[_].image)
337  msg := sprintf("Image must be from approved registry: %v", [input.spec.containers[_].image])
338}
339```
340 
341Evaluate in CI:
342 
343```bash
344opa eval \
345  --input k8s-deployment.json \
346  --data security/opa/policies/ \
347  --format pretty \
348  &quot;data.enterprise.container.deny&quot; | \
349  python3 -c &quot;import sys,json; findings=json.load(sys.stdin); sys.exit(1) if findings['result'][0]['expressions'][0]['value'] else sys.exit(0)&quot;
350```
351 
352---
353 
354## CVE Remediation Workflow
355 
356When a CRITICAL or HIGH CVE is identified by Trivy or OWASP Dependency-Check:
357 
3581. **Assess exploitability**: Is the vulnerable code path reachable from the application's attack surface?
3592. **Patch or suppress**:
360   - If exploitable: update the dependency; target fix within 24h (CRITICAL) or 7 days (HIGH)
361   - If not exploitable: add a suppression entry with justification and 90-day expiry
3623. **Open a Jira ticket** with label `security-vuln`, CVE ID, and CVSS score
3634. **Link to pipeline failure** in the Jira ticket for traceability
3645. **Exception process**: If patching is not possible within SLA, a formal risk acceptance must be approved by the CISO with a documented compensating control
365 
366---
367 
368## AWS Config Rules for Compliance
369 
370Ensure these AWS Config Rules are enabled in all accounts:
371 
372```bash
373# Check that all Config rules pass — fail if any non-compliant
374aws configservice describe-compliance-by-config-rule \
375  --compliance-types NON_COMPLIANT \
376  --query 'ComplianceByConfigRules[].ConfigRuleName' \
377  --output text
378 
379# Required rules:
380# - s3-bucket-ssl-requests-only
381# - encrypted-volumes
382# - rds-storage-encrypted
383# - guardduty-enabled-centralized
384# - iam-no-inline-policy-check
385# - root-mfa-enabled
386# - vpc-flow-logs-enabled
387```
388