AI代码工程化保障体系：从规范到上线的完整工具链

1

npm i -D @microsoft/eslint-plugin-sdl eslint-plugin-no-unsanitized

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

module.exports = {
  env: {
    browser: true,
    es2021: true,
    node: true
  },
  parserOptions: {
    ecmaVersion: "latest",
    sourceType: "module"
  },
  // TypeScript项目需额外引入 @typescript-eslint/parser
  // parser: "@typescript-eslint/parser",
  extends: [
    "plugin:@microsoft/sdl/recommended",      // 微软SDL安全规范
    "plugin:no-unsanitized/recommended"       // Mozilla XSS防护规范
  ],
  plugins: [
    "@microsoft/sdl",
    "no-unsanitized"
  ],
  rules: {
    // 高危DOM操作强制拦截
    "no-unsanitized/method": "error",
    "no-unsanitized/property": "error",
    // 禁止动态代码执行
    "no-eval": "error",
    "no-implied-eval": "error",
    // 禁止危险脚本协议
    "no-script-url": "error"
  }
};

1
2
3
4
5
6
7

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.30.1  # 替换为最新稳定版
    hooks:
      - id: gitleaks
        args: ["--verbose", "--redact"]  # 脱敏输出，避免日志二次泄露

1
2
3
4

# 安装pre-commit框架
pip install pre-commit
# 安装钩子到本地git
pre-commit install

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# .github/workflows/gitleaks.yml
name: Gitleaks Secret Scan
on: [pull_request, push]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 全量历史扫描必须开启
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

1
2
3
4
5

# 全局安装
npm install -g gentleman-guardian-angel

# 配合husky加入pre-commit
npx husky add .husky/pre-commit "gga review --staged"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

# .github/workflows/gito-review.yml
name: Gito AI Code Review
on: [pull_request]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Gito AI Code Review
        uses: gitopio/code-review-action@v3
        env:
          GITO_AI_KEY: ${{ secrets.GITO_AI_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

1
2
3
4
5

# 安装
pip install semgrep

# 加载OWASP Top10 + 通用安全规则集，执行扫描
semgrep scan --config=p/owasp-top-ten --config=p/security

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# .github/workflows/semgrep.yml
name: Semgrep Security Scan
on: [push, pull_request]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        run: |
          pip install semgrep
          semgrep scan --config=p/owasp-top-ten --config=p/security --error

1
2
3
4
5

# Homebrew安装
brew install opensca

# 扫描项目并输出SBOM报告
opensca-cli -path ./ -out sbom-report.json

1
2

# 仅检测生产依赖的高危漏洞
npm audit --production

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

┌─────────────────────────────────────────────────────────────────────┐
│  📝 编码阶段（IDE实时防御）
│  @microsoft/eslint-plugin-sdl + eslint-plugin-no-unsanitized
│  + VSCode 保存自动修复
│  → 漏洞编写即报错，零成本拦截基础风险
└─────────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────────┐
│  🚫 提交阶段（Pre-commit强制卡点）
│  Gitleaks（密钥扫描）+ ESLint（规范校验）+ GGA/Prism（AI预审）
│  → 任一不达标直接阻断Commit，坏账代码零入库
└─────────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────────┐
│  🔒 PR阶段（CI/CD质量门禁）
│  Gito（AI自动审PR）+ Semgrep（SAST漏洞扫描）+ OpenSCA（依赖风控）
│  + SonarQube（代码质量门禁）
│  → 全维度拦截风险，不达标PR无法合并
└─────────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────────┐
│  🚀 发布阶段（生产防护）
│  灰度放量 + 运行时监控 + 异常告警 + 版本一键回滚
└─────────────────────────────────────────────────────────────────────┘