ํ”ผ๋“œ๋กœ ๋Œ์•„๊ฐ€๊ธฐ
๐Ÿšจ ุชู†ุจูŠู‡ ุฃู…ู†ูŠ ุนุงุฌู„ - ุซุบุฑุฉ ุญุฑุฌุฉ ููŠ tj-actions/changed-files
Dev.toDev.to
Security

23,000๊ฐœ+ ์ €์žฅ์†Œ ํƒ€๊ฒฉํ•œ tj-actions ๊ณต๊ธ‰๋ง ๊ณต๊ฒฉ ๋ฐ ๋Œ€์‘ ์ „๋žต

๐Ÿšจ ุชู†ุจูŠู‡ ุฃู…ู†ูŠ ุนุงุฌู„ - ุซุบุฑุฉ ุญุฑุฌุฉ ููŠ tj-actions/changed-files

๐ŸŽ–๏ธุงู„ู…ุญุงุฑุจ ุงู„ุฑู‚ู…ูŠ๐ŸŽ–๏ธ2026๋…„ 4์›” 28์ผ6๋ถ„intermediate

AI ์š”์•ฝ

Context

GitHub Action์œผ๋กœ ๋„๋ฆฌ ์‚ฌ์šฉ๋˜๋Š” tj-actions/changed-files ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ์˜ ์ฝ”๋“œ ๋ณ€์กฐ๋ฅผ ํ†ตํ•œ Supply Chain Attack ๋ฐœ์ƒ. GitHub Runner์˜ ๋ฉ”๋ชจ๋ฆฌ์— ์ ‘๊ทผํ•˜์—ฌ Secrets๋ฅผ ์ถ”์ถœํ•˜๊ณ  ์™ธ๋ถ€๋กœ ์œ ์ถœํ•˜๋Š” ์•…์„ฑ ์Šคํฌ๋ฆฝํŠธ๊ฐ€ ์‚ฝ์ž…๋œ ๊ตฌ์กฐ์  ์ทจ์•ฝ์  ๋…ธ์ถœ.

Technical Solution

  • GitHub Runner ๋ฉ”๋ชจ๋ฆฌ ๋คํ”„ ๋ฐ ๋Ÿฐํƒ€์ž„ Secrets ์ถ”์ถœ ๋กœ์ง์„ ํ†ตํ•œ ๋ฐ์ดํ„ฐ ํƒˆ์ทจ ํ”„๋กœ์„ธ์Šค ์ฐจ๋‹จ
  • Mutableํ•œ Tag ๊ธฐ๋ฐ˜ ๋ฒ„์ „ ์ฐธ์กฐ ๋ฐฉ์‹์—์„œ Immutableํ•œ Commit SHA Pinning ๊ตฌ์กฐ๋กœ ์ „ํ™˜ํ•˜์—ฌ ์ฝ”๋“œ ๋ณ€์กฐ ๋ฐฉ์ง€
  • GitHub API๋ฅผ ํ™œ์šฉํ•œ ์ทจ์•ฝ ๊ธฐ๊ฐ„(2025-03-14~15) ๋‚ด Workflow Run ID ์‹๋ณ„ ๋ฐ ๋…ธ์ถœ ๋กœ๊ทธ์˜ ๊ฐ•์ œ ์‚ญ์ œ ์ˆ˜ํ–‰
  • Environment Protection Rules ๋ฐ Manual Approval ๋„์ž…์„ ํ†ตํ•œ ๋ฏผ๊ฐํ•œ Secrets์˜ ๋Ÿฐํƒ€์ž„ ์ ‘๊ทผ ์ œ์–ด ๊ฐ•ํ™”
  • ์ •๊ธฐ์ ์ธ Dependency Audit ์ž๋™ํ™” ์›Œํฌํ”Œ๋กœ์šฐ ๊ตฌ์ถ•์„ ํ†ตํ•œ ์ทจ์•ฝ ๋ฒ„์ „์˜ ์กฐ๊ธฐ ๋ฐœ๊ฒฌ ๋ฐ ์ฐจ๋‹จ ์ฒด๊ณ„ ๋งˆ๋ จ

์‹ค์ฒœ ํฌ์ธํŠธ

1. ๋ชจ๋“  Third-party Action์˜ ๋ฒ„์ „์„ Tag(v45)๊ฐ€ ์•„๋‹Œ Commit SHA๋กœ ๋ณ€๊ฒฝํ–ˆ๋Š”์ง€ ํ™•์ธ

2. ์œ ์ถœ ๊ฐ€๋Šฅ์„ฑ์ด ์žˆ๋Š” GitHub Token, AWS Key, DB Password ๋“ฑ ๋ชจ๋“  Secrets์˜ ์ฆ‰์‹œ Rotate ์ˆ˜ํ–‰

3. GitHub API๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ ์‚ฌ๊ณ  ๋ฐœ์ƒ ๊ธฐ๊ฐ„ ๋‚ด ์ƒ์„ฑ๋œ Workflow Artifacts ๋ฐ Logs ์ „์ˆ˜ ์กฐ์‚ฌ

4. Production ํ™˜๊ฒฝ์˜ Secrets ์ ‘๊ทผ ์‹œ Approval ์ ˆ์ฐจ๊ฐ€ ํฌํ•จ๋œ Environment ์„ค์ • ์ ์šฉ

ํƒœ๊ทธ

#Supply Chain Attack#DevSecOps#Secrets Management#SHA Pinning#GitHub Actions
์›๋ฌธ ์ฝ๊ธฐ