GitOps与CI/CD管道安全取证深度分析

代码提交 ──→ Workflow 触发 ──→ 依赖解析 ──→ 构建编译 ──→ 制品签名 ──→ 制品分发 ──→ 部署编排
  │              │               │            │             │            │             │
  │              │               │            │             │            │             │
  ▼              ▼               ▼            ▼             ▼            ▼             ▼
Git签名伪造   Workflow注入    依赖投毒     缓存投毒     签名伪造     中间人攻击    Manifest篡改
Webhook劫持   Script注入     Typosquatting 镜像篡改     证书伪造     标签覆盖      RBAC绕过
分支保护绕过   Secret泄露     Dependency    构建工具链    Rekor        分发通道劫持   Drift投毒
              OIDC滥用       Confusion     篡改         日志篡改                  HPA操纵

name: Vulnerable Workflow
on:
  issues:
    types: [opened]

jobs:
  greet:
    runs-on: ubuntu-latest
    steps:
      - name: Comment on issue
        run: echo "Hello ${{ github.event.issue.title }}"

test

name: Secure Workflow
on:
  issues:
    types: [opened]

jobs:
  greet:
    runs-on: ubuntu-latest
    steps:
      - name: Comment on issue
        env:
          ISSUE_TITLE: ${{ github.event.issue.title }}
        run: echo "Hello ${{ env.ISSUE_TITLE }}"

name: 'Vulnerable Composite Action'
description: 'A vulnerable composite action'
inputs:
  label-name:
    description: 'Label name'
    required: true
runs:
  using: 'composite'
  steps:
    - shell: bash
      run: gh issue edit ${{ github.event.issue.number }} --add-label "${{ inputs.label-name }}"

name: 'Secure Composite Action'
description: 'A secure composite action'
inputs:
  label-name:
    description: 'Label name'
    required: true
runs:
  using: 'composite'
  steps:
    - shell: bash
      env:
        LABEL_NAME: ${{ inputs.label-name }}
        ISSUE_NUMBER: ${{ github.event.issue.number }}
      run: gh issue edit "$ISSUE_NUMBER" --add-label "$LABEL_NAME"

name: Caller Workflow
on:
  workflow_dispatch:

jobs:
  call-reusable:
    uses: target-org/target-repo/.github/workflows/build.yml@main
    secrets:
      inherit

stages:
  - test

test_job:
  stage: test
  script:
    - echo "Testing branch: $CI_COMMIT_BRANCH"
    - curl -s "https://example.com/api?repo=$CI_PROJECT_NAME"

deploy_job:
  stage: deploy
  script:
    - echo "$DEPLOY_TOKEN" | base64 -d > /tmp/token.txt
    - ./deploy.sh --token-file /tmp/token.txt

pipeline {
    agent any
    parameters {
        string(name: 'BRANCH', defaultValue: 'main', description: 'Branch to build')
    }
    stages {
        stage('Build') {
            steps {
                sh "git checkout ${params.BRANCH}"
            }
        }
    }
}

env | grep -i secret
env | grep -i token
env | grep -i password
env | grep -i api_key
printenv | sort

npm ls --all --parseable | while read pkg; do
  if echo "$pkg" | grep -q "node_modules/"; then
    name=$(echo "$pkg" | sed 's|.*/node_modules/||')
    version=$(npm ls "$name" --json 2>/dev/null | jq -r ".dependencies.\"$name\".version // \"unknown\"")
    resolved=$(npm ls "$name" --json 2>/dev/null | jq -r ".dependencies.\"$name\".resolved // \"N/A\"")
    if echo "$resolved" | grep -q "registry.npmjs.org" && echo "$name" | grep -q "@private/"; then
      echo "[ALERT] Potentially confused dependency: $name@$version from $resolved"
    fi
  fi
done

name: Cache Poisoning Example
on: push

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Restore cache
        uses: actions/cache@v4
        with:
          path: ~/.npm
          key: npm-${{ runner.os }}-${{ hashFiles('**/package-lock.json') }}
          restore-keys: |
            npm-${{ runner.os }}-
      - run: npm ci
      - run: npm run build

gh api repos/{owner}/{repo}/actions/caches --jq '.actions_caches[] | {
  id: .id,
  key: .key,
  ref: .ref,
  created_at: .created_at,
  size_in_bytes: .size_in_bytes,
  version: .version
}' | jq 'sort_by(.created_at) | reverse'

docker pull registry.example.com/app:v1.2.3
cosign verify \
  --key cosign.pub \
  --certificate-identity "https://github.com/org/repo/.github/workflows/build.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  registry.example.com/app:v1.2.3

cosign verify-attestation \
  --type slsaprovenance \
  --key cosign.pub \
  registry.example.com/app:v1.2.3

cat package.json | jq '.dependencies, .devDependencies' | jq -r 'to_entries[] | .key' | while read pkg; do
  npm view "$pkg" --json 2>/dev/null | jq -r '.name // empty' | grep -q "^$" && echo "[ALERT] Package not found: $pkg"
  npm view "$pkg" --json 2>/dev/null | jq -r '.time // empty' | head -1 | while read created; do
    if [ -n "$created" ]; then
      age_days=$(( ($(date +%s) - $(date -jf "%Y-%m-%dT%H:%M:%S.%3Z" "$created" +%s 2>/dev/null || echo 0)) / 86400 ))
      if [ "$age_days" -lt 30 ]; then
        echo "[WARNING] Recently published package: $pkg (age: ${age_days} days)"
      fi
    fi
  done
done

pip install pip-audit
pip-audit --fix --dry-run --desc

cosign verify \
  --certificate-identity-regexp "https://github.com/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/owner/image@sha256:abc123def456...

cosign verify-attestation \
  --type cyclonedx \
  ghcr.io/owner/image@sha256:abc123def456...

rekor-cli search --rekor_server https://rekor.sigstore.dev \
  --public-key cosign.pub \
  --email user@example.com

rekor-cli get --rekor_server https://rekor.sigstore.dev \
  --log-index <LOG_INDEX>

cosign verify-attestation \
  --type slsaprovenance \
  --key cosign.pub \
  ghcr.io/owner/image@sha256:abc123...

syft packages dir:. -o spdx-json > sbom.spdx.json
syft packages dir:. -o cyclonedx-json > sbom.cdx.json
syft packages docker:ghcr.io/owner/image:latest -o spdx-json > image-sbom.spdx.json

grype sbom:sbom.spdx.json
grype sbom:sbom.spdx.json -o json | jq '.matches[] | {
  vulnerability: .vulnerability.id,
  severity: .vulnerability.severity,
  package: .artifact.name,
  version: .artifact.version,
  fixed_in: .vulnerability.fix.versions[0]
}'

{
  "signed": {
    "_type": "layout",
    "expires": "2027-01-01T00:00:00Z",
    "keys": {
      "keyid": "abcdef1234567890",
      "keyval": {"public": "-----BEGIN PUBLIC KEY-----\n..."}
    },
    "steps": [
      {
        "name": "build",
        "expected_materials": [["MATCH", "src/**", {"exclude": ["src/test/**"]}, ["REPO_KEY"]]],
        "expected_products": [["CREATE", "dist/**"]],
        "pubkeys": ["REPO_KEY"],
        "threshold": 1
      },
      {
        "name": "test",
        "expected_materials": [["MATCH", "dist/**", ["REPO_KEY"]]],
        "expected_products": [],
        "pubkeys": ["REPO_KEY"],
        "threshold": 1
      }
    ],
    "inspect": []
  },
  "signatures": [
    {
      "keyid": "abcdef1234567890",
      "sig": "3045022100..."
    }
  ]
}

git log --show-signature --format='%H %GN <%GE> %s' | head -50
git log --format='%H %G?' --all | while read hash status; do
  case "$status" in
    G) echo "[VALID] $hash - Good signature" ;;
    U) echo "[UNKNOWN] $hash - Unknown key" ;;
    B) echo "[BAD] $hash - Bad signature" ;;
    X) echo "[EXPIRED] $hash - Expired key" ;;
    E) echo "[ERROR] $hash - Signature error" ;;
    N) echo "[UNSIGNED] $hash - No signature" ;;
    *) echo "[?] $hash - Status: $status" ;;
  esac
done

Branch Protection 绕过场景：
├── Repository Admin 权限绕过
│   └── Admin 用户可强制推送（"Include administrators" 未启用）
├── Direct Push 绕过
│   └── 具有 Write 权限的用户可绕过 PR 审查
├── API 绕过
│   └── 使用 GitHub API 创建/合并 PR 可绕过部分检查
├── Organization 策略降级
│   └── Organization Owner 降低仓库安全级别
└── Webhook 触发绕过
    └── 通过 `repository_dispatch` 事件触发 Workflow

gh api repos/{owner}/{repo}/branches/main/protection --jq '{
  required_pull_request_reviews: .required_pull_request_reviews,
  enforce_admins: .enforce_admins,
  required_status_checks: .required_status_checks,
  restrictions: .restrictions
}'

#!/bin/bash
SECRET="$WEBHOOK_SECRET"
SIGNATURE="$HTTP_X_HUB_SIGNATURE_256"
PAYLOAD="$REQUEST_BODY"

EXPECTED="sha256=$(echo -n "$PAYLOAD" | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $2}')"

if [ "$SIGNATURE" = "$EXPECTED" ]; then
  echo "Webhook signature verified"
else
  echo "Webhook signature MISMATCH - potential forgery"
  exit 1
fi

git reflog --all | head -100
git fsck --full --no-reflogs
git fsck --lost-found
git log --all --graph --oneline | head -50
git log --all --diff-filter=D --summary | grep "delete mode"

#!/bin/bash
TARGET_DIR="${1:-.}"
REPORT_FILE="secret_scan_report.txt"
> "$REPORT_FILE"

PATTERNS=(
  'ghp_[A-Za-z0-9]{36}'
  'gho_[A-Za-z0-9]{36}'
  'ghs_[A-Za-z0-9]{36}'
  'glpat-[A-Za-z0-9\-_]{20,}'
  'npm_[A-Za-z0-9]{36}'
  'pypi-[A-Za-z0-9\-_]{60,}'
  'AKIA[0-9A-Z]{16}'
  'xoxb-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24}'
  'sk-[A-Za-z0-9]{32,}'
  'AIza[0-9A-Za-z\-_]{35}'
)

for pattern in "${PATTERNS[@]}"; do
  results=$(grep -rnI --include="*.yml" --include="*.yaml" --include="*.json" --include="*.env" --include="*.sh" \
    -E "$pattern" "$TARGET_DIR" 2>/dev/null)
  if [ -n "$results" ]; then
    echo "=== Pattern: $pattern ===" >> "$REPORT_FILE"
    echo "$results" >> "$REPORT_FILE"
    echo "" >> "$REPORT_FILE"
  fi
done

echo "Scan complete. Report: $REPORT_FILE"
cat "$REPORT_FILE"

gh api repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs \
  --jq '.workflow_runs[] | select(.event == "workflow_dispatch" or .event == "push") | {
    id: .id,
    status: .conclusion,
    created: .created_at,
    actor: .actor.login,
    event: .event,
    head_branch: .head_branch
  }' | jq 'sort_by(.created) | reverse'

kubectl get configmap argocd-cm -n argocd -o yaml | grep -A5 "admin.enabled"
kubectl get configmap argocd-rbac-cm -n argocd -o yaml
kubectl get secret argocd-initial-admin-secret -n argocd -o jsonpath='{.data.password}' | base64 -d
kubectl get applications -n argocd -o json | jq '.items[] | {
  name: .metadata.name,
  repo: .spec.source.repoURL,
  path: .spec.source.path,
  targetRevision: .spec.source.targetRevision,
  server: .spec.destination.server
}'

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
data:
  policy.default: role:readonly
  policy.csv: |
    p, role:admin, applications, *, */*, allow
    p, role:admin, clusters, get, *, allow
    p, role:admin, repositories, *, *, allow
    p, role:admin, accounts, *, *, allow
    g, admin, role:admin
    g, oidc-group, role:readonly

kubectl get kustomizations -A -o json | jq '.items[] | {
  name: .metadata.name,
  namespace: .metadata.namespace,
  sourceRef: .spec.sourceRef,
  path: .spec.path,
  prune: .spec.prune,
  interval: .spec.interval
}'

kubectl get helmreleases -A -o json | jq '.items[] | {
  name: .metadata.name,
  namespace: .metadata.namespace,
  chart: .spec.chart.spec.chart,
  version: .spec.chart.spec.version,
  sourceRef: .spec.chart.spec.sourceRef
}'

kubectl get gitrepositories -A -o json | jq '.items[] | {
  name: .metadata.name,
  url: .spec.url,
  ref: .spec.ref,
  interval: .spec.interval
}'

flux diff kustomization <name> --path <path>

flux trace <resource> --kind <kind> --namespace <ns>

kubectl get events -n <namespace> --field-selector reason=DriftDetection

kubectl get events -A --sort-by='.lastTimestamp' -o json | \
  jq -r '.items[] | select(.reason == "Started" or .reason == "Pulled" or .reason == "Created" or .reason == "Killing") | "\(.lastTimestamp) [\(.involvedObject.namespace)/\(.involvedObject.name)] \(.reason): \(.message)"' | tail -100

kubectl logs -n argocd -l app.kubernetes.io/name=argocd-server --since=24h | grep -i "login\|sync\|create\|delete\|update"

title: Suspicious GitHub Actions Workflow Injection Pattern
id: 3f7a8b2c-1d4e-5f6a-9b0c-2d3e4f5a6b7c
status: stable
description: Detects potential Workflow Injection attacks in GitHub Actions workflow execution logs
references:
  - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
author: Security Operations Center
date: 2026-07-13
modified: 2026-07-13
tags:
  - attack.execution
  - attack.t1059
  - attack.supply_chain
  - attack.t1195.002
  - ci_cd
  - github_actions
  - workflow_injection
logsource:
  category: ci_cd_workflow
  product: github_actions
detection:
  selection_step_output:
    message|contains:
      - 'Process completed with exit code'
      - 'Error: Process completed'
  selection_suspicious_patterns:
    message|re:
      - '(curl|wget)\s+.*\s+\|(\s*(ba)?sh)'
      - 'base64\s+(-d|--decode)\s+.*\s*\|(\s*(ba)?sh)'
      - 'eval\s+\$'
      - 'python[23]?\s+-c\s+.*import\s+(os|subprocess|socket)'
      - 'nc\s+-.*-e\s+/bin/(ba)?sh'
      - '/dev/tcp/'
      - '>\s*/dev/tcp/'
      - 'exec\s+2>&1\s*&&\s*(curl|wget)'
  selection_env_extraction:
    message|contains:
      - 'env | grep -i'
      - 'printenv'
      - 'env | sort'
      - 'cat /proc/self/environ'
  selection_secret_access:
    message|contains:
      - '${{ secrets.'
      - '${{ env.'
      - 'GITHUB_TOKEN'
      - 'GH_PAT'
      - 'NPM_TOKEN'
      - 'PYPI_TOKEN'
  condition: selection_step_output and (selection_suspicious_patterns or selection_env_extraction or selection_secret_access)
falsepositives:
  - Legitimate CI scripts using curl/wget for downloading build dependencies
  - Security scanning tools that intentionally read environment variables
level: high

title: Anomalous CI/CD Workflow Trigger Activity
id: 5e8d9f3a-2b1c-4d6e-8f0a-1b2c3d4e5f6a
status: stable
description: Detects anomalous CI/CD workflow triggers that may indicate unauthorized pipeline execution
references:
  - https://owasp.org/www-project-top-10-ci-cd-security-risks/
author: Security Operations Center
date: 2026-07-13
modified: 2026-07-13
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.credential_access
  - attack.t1078.004
  - ci_cd
  - github_actions
  - gitlab_ci
  - workflow_trigger
logsource:
  category: ci_cd_audit
detection:
  selection_dispatch_trigger:
    event_type:
      - 'workflow_dispatch'
      - 'repository_dispatch'
      - 'workflow_run'
  selection_new_actor:
    actor|is_diff: true
  selection_off_hours:
    timestamp|time: 'T00:00:00/T06:00:00'
  selection_foreign_branch:
    head_branch|startswith: 'dependabot/'
    head_branch|contains:
      - 'renovate'
      - 'patch'
      - 'update'
  selection_privileged_workflow:
    workflow_name|contains:
      - 'deploy'
      - 'release'
      - 'publish'
      - 'secrets'
      - 'admin'
  condition: selection_dispatch_trigger and (selection_new_actor or (selection_off_hours and selection_privileged_workflow))
falsepositives:
  - Scheduled releases during off-hours
  - Automated dependency update bots (Dependabot, Renovate)
  - On-call engineer triggering emergency deployments
level: medium

#!/bin/bash
set -euo pipefail

REPO="${1:-.}"
REPORT="workflow_security_report_$(date +%Y%m%d_%H%M%S).txt"
FINDINGS=0

cat > "$REPORT" <<EOF
=====================================
CI/CD Workflow Security Scan Report
=====================================
Repository: $REPO
Scan Date:  $(date -u +"%Y-%m-%d %H:%M:%S UTC")
=====================================
EOF

scan_injection_patterns() {
    local file="$1"
    local patterns=(
        '\$\{\{.*github\.event\.(issue|pull_request|comment|review|head_commit)\.'
        'run:\s*.*\$\{\{[^}]*\}\}'
        'eval\s'
        'exec\s'
        'base64\s+(-d|--decode)'
        '/dev/tcp/'
        'curl\s+.*\|\s*(ba)?sh'
        'wget\s+.*\|\s*(ba)?sh'
    )
    for pat in "${patterns[@]}"; do
        grep -nE "$pat" "$file" 2>/dev/null | while read -r line; do
            echo "[INJECTION] $file:$line" >> "$REPORT"
            FINDINGS=$((FINDINGS + 1))
        done
    done
}

scan_secret_leaks() {
    local file="$1"
    local secret_patterns=(
        'secrets\.[A-Z_]+'
        'GITHUB_TOKEN'
        'GH_PAT'
        'NPM_TOKEN'
        'PYPI_TOKEN'
        'AWS_ACCESS_KEY_ID'
        'DOCKER_PASSWORD'
    )
    for pat in "${secret_patterns[@]}"; do
        grep -nE "$pat" "$file" 2>/dev/null | grep -v "^\s*#" | while read -r line; do
            echo "[SECRET_REF] $file:$line" >> "$REPORT"
            FINDINGS=$((FINDINGS + 1))
        done
    done
}

scan_insecure_actions() {
    local file="$1"
    grep -nE 'uses:\s+\S+@[a-zA-Z0-9_-]+$' "$file" 2>/dev/null | while read -r line; do
        echo "[UNPINNED_ACTION] $file:$line" >> "$REPORT"
        FINDINGS=$((FINDINGS + 1))
    done
    grep -nE 'permissions:' "$file" 2>/dev/null | head -1 | while read -r line; do
        if grep -A5 "permissions:" "$file" 2>/dev/null | grep -qE "write-all|contents:\s*write"; then
            echo "[EXCESS_PERMS] $file:$line" >> "$REPORT"
            FINDINGS=$((FINDINGS + 1))
        fi
    done
}

echo "Scanning workflow files in: $REPO" | tee -a "$REPORT"

find "$REPO" -name "*.yml" -o -name "*.yaml" | while read -r wf; do
    if echo "$wf" | grep -qE "\.github/workflows|\.gitlab-ci"; then
        echo "Analyzing: $wf" >> "$REPORT"
        scan_injection_patterns "$wf"
        scan_secret_leaks "$wf"
        scan_insecure_actions "$wf"
    fi
done

echo "" >> "$REPORT"
echo "Total findings: $FINDINGS" >> "$REPORT"
echo "Report saved to: $REPORT"

import json
import sys
import re
from datetime import datetime, timedelta
from collections import defaultdict

SUSPICIOUS_PATTERNS = {
    "workflow_injection": [
        r"curl\s+.*\|\s*(ba)?sh",
        r"wget\s+.*\|\s*(ba)?sh",
        r"base64\s+(-d|--decode)",
        r"eval\s+\$",
        r"/dev/tcp/",
        r"python[23]?\s+-c\s+.*import\s+(os|subprocess|socket)",
    ],
    "secret_extraction": [
        r"env\s*\|\s*grep\s+-i",
        r"printenv",
        r"cat\s+/proc/self/environ",
        r"env\s*\|\s*sort",
        r"secrets\.[A-Z_]+",
    ],
    "persistence": [
        r"crontab",
        r"systemctl\s+(enable|start)",
        r"launchctl\s+(load|start)",
        r"authorized_keys",
        r"bashrc|zshrc|profile",
    ],
    "exfiltration": [
        r"nc\s+-",
        r"ncat\s+",
        r"socat\s+",
        r"ssh\s+-R\s+",
        r"tgz|tar\s+.*\|\s*(curl|wget)",
    ],
}

OFF_HOURS_START = 0
OFF_HOURS_END = 6


def parse_workflow_log(log_data):
    findings = []
    for step in log_data.get("steps", []):
        step_name = step.get("name", "unknown")
        step_output = step.get("output", "")
        for category, patterns in SUSPICIOUS_PATTERNS.items():
            for pattern in patterns:
                matches = re.finditer(pattern, step_output, re.IGNORECASE)
                for match in matches:
                    findings.append({
                        "step": step_name,
                        "category": category,
                        "pattern": pattern,
                        "match": match.group()[:100],
                        "line_context": _get_context(step_output, match.start()),
                    })
    return findings


def analyze_trigger_patterns(runs_data):
    anomalies = []
    actor_history = defaultdict(int)
    for run in runs_data:
        actor = run.get("actor", {}).get("login", "unknown")
        actor_history[actor] += 1

    for run in runs_data:
        created = datetime.fromisoformat(
            run.get("created_at", "").replace("Z", "+00:00")
        )
        actor = run.get("actor", {}).get("login", "unknown")
        event = run.get("event", "unknown")
        branch = run.get("head_branch", "unknown")

        if created.hour >= OFF_HOURS_START and created.hour < OFF_HOURS_END:
            if event in ("workflow_dispatch", "repository_dispatch"):
                anomalies.append({
                    "run_id": run.get("id"),
                    "actor": actor,
                    "time": created.isoformat(),
                    "event": event,
                    "branch": branch,
                    "reason": "off_hours_dispatch",
                    "severity": "high",
                })

        if actor_history[actor] <= 2 and event == "workflow_dispatch":
            anomalies.append({
                "run_id": run.get("id"),
                "actor": actor,
                "time": created.isoformat(),
                "event": event,
                "branch": branch,
                "reason": "rare_actor_dispatch",
                "severity": "medium",
            })

        if any(kw in branch.lower() for kw in ["dependabot", "renovate", "patch"]):
            if event == "push" and run.get("conclusion") == "success":
                anomalies.append({
                    "run_id": run.get("id"),
                    "actor": actor,
                    "time": created.isoformat(),
                    "event": event,
                    "branch": branch,
                    "reason": "dependency_update_push",
                    "severity": "low",
                })

    return anomalies


def analyze_audit_log(audit_events):
    high_risk_actions = [
        "org.add_member",
        "org.remove_member",
        "repo.destroy",
        "repo.dependency_graph.snapshots",
        "actions.secret_accessed",
        "actions.secret_deleted",
        "repo.branch_protection_rule",
        "repo.webhook_created",
        "repo.webhook_updated",
    ]
    alerts = []
    for event in audit_events:
        action = event.get("action", "")
        if action in high_risk_actions:
            severity = "critical" if "secret" in action else "high"
            alerts.append({
                "action": action,
                "actor": event.get("actor", {}).get("login", "unknown"),
                "repo": event.get("repo", {}).get("name", "unknown"),
                "time": event.get("created_at", "unknown"),
                "severity": severity,
            })
    return alerts


def _get_context(text, pos, window=80):
    start = max(0, pos - window)
    end = min(len(text), pos + window)
    return text[start:end].replace("\n", " ")


def generate_report(findings, trigger_anomalies, audit_alerts):
    report = []
    report.append("=" * 60)
    report.append("CI/CD Security Audit Report")
    report.append(f"Generated: {datetime.utcnow().isoformat()}")
    report.append("=" * 60)

    report.append(f"\n[Workflow Injection Findings]: {len(findings)}")
    for f in findings:
        report.append(f"  [{f['category'].upper()}] Step: {f['step']}")
        report.append(f"    Pattern: {f['pattern']}")
        report.append(f"    Match: {f['match']}")

    report.append(f"\n[Trigger Anomalies]: {len(trigger_anomalies)}")
    for a in trigger_anomalies:
        report.append(f"  [{a['severity'].upper()}] Run {a['run_id']}: {a['reason']}")
        report.append(f"    Actor: {a['actor']}, Time: {a['time']}, Branch: {a['branch']}")

    report.append(f"\n[Audit Log Alerts]: {len(audit_alerts)}")
    for a in audit_alerts:
        report.append(f"  [{a['severity'].upper()}] {a['action']}")
        report.append(f"    Actor: {a['actor']}, Repo: {a['repo']}, Time: {a['time']}")

    total = len(findings) + len(trigger_anomalies) + len(audit_alerts)
    report.append(f"\nTotal Findings: {total}")
    return "\n".join(report)


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <audit_log.json> [workflow_runs.json]")
        sys.exit(1)

    with open(sys.argv[1]) as f:
        audit_data = json.load(f)

    workflow_runs = []
    if len(sys.argv) > 2:
        with open(sys.argv[2]) as f:
            workflow_runs = json.load(f)

    wf_findings = []
    for run in workflow_runs:
        if "steps" in run:
            wf_findings.extend(parse_workflow_log(run))

    trigger_anomalies = analyze_trigger_patterns(workflow_runs)
    audit_alerts = analyze_audit_log(audit_data)

    report = generate_report(wf_findings, trigger_anomalies, audit_alerts)
    print(report)

攻击链时间线：
2021-01-31  攻击者入侵 Codecov Docker 构建环境
            │
            ▼
2021-01-31  篡改 codecov-bash 脚本，添加数据外传代码
            │  外传目标：https://codecov.io uploader bash
            │  外传内容：所有环境变量
            ▼
2021-02-01  被篡改的脚本发布到 CDN
            │  受影响版本：所有通过 curl | bash 方式下载的用户
            ▼
2021-04-01  安全研究员发现脚本异常并报告
            │
            ▼
2021-04-15  Codecov 公开披露事件
            │
            ▼
影响评估    约 29,000 个仓库受影响
            │  泄露的 Secrets 包括：GitHub Token、AWS Key、GCP Key
            ▼
后续响应    所有用户需要轮换 Secrets

# 原始脚本（简化）：
curl -s https://codecov.io/bash > codecov
bash codecov

# 被篡改后的外传逻辑（分析还原）：
# 在脚本中注入了以下数据收集和外传代码：
# 1. 收集所有环境变量
# 2. 将数据 base64 编码
# 3. 通过 HTTPS POST 发送到攻击者控制的服务器
# 外传目标服务器通过 DNS 隐蔽控制，使用 Cloudflare Workers 作为中继

ioc:
  malicious_url:
    - "https://codecov.io uploader bash"
    - "https://upcodecov[.]io"
    - "https://codecov[.]io/bash"
  compromised_files:
    - "codecov"  # Bash Uploader 脚本
    - "upload"
  external_ips:
    - "104.248.40.162"
    - "82.221.128.65"
  sha256_malicious:
    - "a7e12bab1d8d780e79d1db6c15f8d4a43c6d71029f75f526f11d06b3f4a8bb2e"
  affected_repos_count: 29000
  leaked_secrets:
    - "GitHub Personal Access Tokens"
    - "AWS Access Keys"
    - "GCP Service Account Keys"
    - "Heroku API Keys"
    - "DataDog API Keys"

攻击链时间线：
2018-09     攻击者（right9ctrl）通过社会工程获得 event-stream 维护权
            │  原维护者 Dominic Tarr 因不再活跃，将维护权转移
            ▼
2018-10     攻击者添加恶意依赖 flatmap-stream@0.0.2
            │  恶意代码混淆在 flatmap-stream 中
            ▼
2018-11     恶意代码被激活（event-stream@3.3.6）
            │  目标：Copay 钱包 v1.x（Bitcoin 多签名钱包）
            │  手法：窃取钱包私钥并发送到远程服务器
            ▼
2018-11-26  安全研究员 Jules Blinder 发现并报告
            │
            ▼
2018-11-27  npm 移除恶意版本
            │
            ▼
后续        flatmap-stream 从 npm 移除
            event-stream 恢复到干净版本

// 恶意代码（混淆后还原分析）：
// 1. 检测运行环境是否为 Copay 钱包
// 2. 如果是 Copay 钱包，窃取钱包配置数据
// 3. 将窃取的数据通过 HTTP POST 发送到远程服务器

// 恶意代码的关键逻辑：
// - 定位 Copay 的 localStorage
// - 提取钱包的私钥和助记词
// - 将数据加密后发送到 attacker-controlled 域名

ioc:
  malicious_packages:
    - "event-stream@3.3.6"
    - "flatmap-stream@0.0.2"
  attacker_github: "right9ctrl"
  attacker_npm: "right9ctrl"
  c2_domain:
    - "fridgerator[.]cc"
    - "airds[.]cn"
  sha256_malicious:
    - flatmap-stream: "df3538cf50e8d8212f204e4e0b9a891e6315820c"
  target_software: "Copay Bitcoin Wallet v1.x"
  leaked_data:
    - "Bitcoin wallet private keys"
    - "Wallet mnemonics (seed phrases)"
    - "Wallet configuration data"
  timeline:
    takeover: "2018-09"
    malicious_version: "2018-10"
    discovery: "2018-11-26"
    remediation: "2018-11-27"

# Issue/PR 标题 Payload（触发 Workflow Injection）：

# 反弹 Shell Payload（在 Workflow 日志中执行）：

# 数据外传 Payload（窃取 Secrets 并外传）：