Bagian 9: Proses Exception untuk Temuan Security yang Belum Bisa Diperbaiki

 Temuan scanner di PR   │   ├─ bisa diperbaiki? ──► perbaiki. Selesai.   │   └─ belum bisa (belum ada patch / false positive)        │        ▼   PR exception: 1 entry = 1 temuan, plus baris di atasnya:   exception: owner=@user exp=YYYY-MM-DD reason="..."        │        ▼   check "exceptions" (scripts/check-exceptions.sh), wajib di ruleset     ✗ tanpa owner/alasan/tanggal      ✗ sudah kedaluwarsa     ✗ lebih dari 90 hari              ✗ nosemgrep tanpa rule-id     ✗ gitleaks:allow, .semgrepignore, .gitleaks.toml, trivy.yaml        │        ▼   merge → tercatat di Git history        │        ▼   tiap Senin: workflow "exception-expiry" → kedaluwarsa? merah   Trivy juga melapor lagi sendiri setelah exp:

# Security finding exceptions The PR gates block a merge on any finding. Sometimes a finding has to be accepted for a while: a CVEwith no fixed version yet, or a scanner false positive. This is the only allowed way to do that. ## Rules 1. **Fix first.** An exception is for a finding that cannot be fixed now, not one that is inconvenient.2. **Through a PR.** Exceptions live in the repo, so Git history records who added one, when and why.   The PR description links an issue with the details.3. **One finding per entry.** One CVE ID, one Gitleaks fingerprint, or one `nosemgrep` with a rule id.   Never a whole rule, a whole severity, or a whole path.4. **Owner, reason and expiry.** Every entry has this line directly above it:    ```   exception: owner=@github-user exp=YYYY-MM-DD reason="at least 10 characters, link to the issue"   ```    `exp` is at most **90 days** away. To keep an exception longer, renew it in a new PR with a fresh reason.5. **Real secrets are never excepted.** A Gitleaks finding that is a real credential is revoked and   rotated. Gitleaks exceptions are for false positives only. ## Per scanner | Scanner | Where | Entry || --- | --- | --- || Trivy (image, config) | `.trivyignore` | `CVE-2026-12345 exp:2026-12-31` or `DS-0002 exp:2026-12-31` || Gitleaks | `.gitleaksignore` | Fingerprint `<commit>:<file>:<rule-id>:<line>` || Semgrep | the source line | `// nosemgrep: <rule-id>`, with the exception line directly above || govulncheck | none | No suppression || dependency-review | none | No suppression | Not allowed, because they suppress findings without an owner or expiry: `.semgrepignore`, `.gitleaks.toml`,`.trivyignore.yaml`, `trivy.yaml`, a bare `nosemgrep`, and `gitleaks:allow`.

# Trivy exceptions (image CVEs and config checks). Rules: docs/exception-process.md# Each entry needs this line directly above it, and the same date as Trivy's exp:#   # exception: owner=@github-user exp=YYYY-MM-DD reason="why it is accepted, link to the issue"#   CVE-YYYY-NNNNN exp:YYYY-MM-DD

# Gitleaks exceptions, for false positives only. A real leaked secret is rotated, never ignored.# Rules: docs/exception-process.md. Each fingerprint needs this line directly above it:#   # exception: owner=@github-user exp=YYYY-MM-DD reason="why it is not a secret, link to the issue"#   <commit>:<file>:<rule-id>:<line>

#!/usr/bin/env bash# Enforces docs/exception-process.md: every scanner suppression carries an owner, a reason and an expiry# no more than MAX_DAYS away. Run from the repo root. Exits 1 on any violation.set -euo pipefail MAX_DAYS="${MAX_DAYS:-90}"WARN_DAYS="${WARN_DAYS:-14}"TODAY="${TODAY:-$(date -u +%F)}"META_RE='exception: owner=@[A-Za-z0-9-]+ exp=([0-9]{4}-[0-9]{2}-[0-9]{2}) reason="[^"]{10,}"'NOSEM_RE='nosemgrep: ?[A-Za-z0-9_.-]+'errors=0 fail() { echo "::error file=$1,line=$2::$3"; errors=$((errors + 1)); } # GNU date on the runner, BSD date on macOS. valid_date prints nothing for an impossible date.valid_date() { date -u -d "$1" +%F 2>/dev/null || date -u -j -f %F "$1" +%F 2>/dev/null || true; }add_days() { date -u -d "$1 + $2 days" +%F 2>/dev/null || date -u -j -v+"$2"d -f %F "$1" +%F; } LIMIT="$(add_days "$TODAY" "$MAX_DAYS")"WARN_FROM="$(add_days "$TODAY" "$WARN_DAYS")" # check_meta FILE LINE TEXT: TEXT is the line directly above the suppression. Sets $exp when it is valid.check_meta() {  exp=""  if [[ ! "$3" =~ $META_RE ]]; then    fail "$1" "$2" "suppression needs 'exception: owner=@user exp=YYYY-MM-DD reason=\"...\"' on the line directly above"    return 1  fi  exp="${BASH_REMATCH[1]}"  if [ "$(valid_date "$exp")" != "$exp" ]; then    fail "$1" "$2" "exp=$exp is not a real date"    return 1  elif [[ "$exp" < "$TODAY" ]]; then    fail "$1" "$2" "exception expired on $exp: fix the finding or renew it in a new PR"    return 1  elif [[ "$exp" > "$LIMIT" ]]; then    fail "$1" "$2" "exp=$exp is more than $MAX_DAYS days away (latest allowed $LIMIT)"    return 1  elif [[ "$exp" < "$WARN_FROM" ]]; then    echo "::warning file=$1,line=$2::exception expires on $exp"  fi} # Plain ignore files: every entry needs the exception line directly above it.# shellcheck disable=SC2094 # fail only prints the file name, it never writes to the filecheck_ignore_file() {  local file="$1" n=0 prev="" line  [ -f "$file" ] || return 0  while IFS= read -r line || [ -n "$line" ]; do    n=$((n + 1))    case "$line" in      '' | '#'*) prev="$line"; continue ;;    esac    # Trivy only re-reports a finding after its own exp: date, so it must match the exception line.    if check_meta "$file" "$n" "$prev" && [ "$file" = .trivyignore ] && [[ "$line" != *" exp:$exp" ]]; then      fail "$file" "$n" "Trivy entry must end with ' exp:$exp'"    fi    prev="$line"  done < "$file"} # These files suppress findings silently, with no owner or expiry, so they are not allowed at all.for f in .semgrepignore .gitleaks.toml .trivyignore.yaml trivy.yaml; do  if [ -e "$f" ]; then    fail "$f" 1 "not allowed: use the exception process in docs/exception-process.md"  fidone check_ignore_file .trivyignorecheck_ignore_file .gitleaksignore # Inline suppressions. gitleaks:allow is banned because a .gitleaksignore fingerprint pins one finding, not a whole line.while IFS=: read -r file n text; do  if [[ "$text" == *gitleaks:allow* ]]; then    fail "$file" "$n" "gitleaks:allow is not allowed: add the finding's fingerprint to .gitleaksignore"    continue  fi  if [[ ! "$text" =~ $NOSEM_RE ]]; then    fail "$file" "$n" "nosemgrep must name the rule id (nosemgrep: <rule-id>)"    continue  fi  prev=""  [ "$n" -gt 1 ] && prev="$(sed -n "$((n - 1))p" "$file")"  check_meta "$file" "$n" "$prev" || truedone < <(git grep -n -I -E 'nosemgrep|gitleaks:allow' -- . ':!*.md' ':!scripts/check-exceptions.sh' || true) if [ "$errors" -gt 0 ]; then  echo "$errors exception problem(s). See docs/exception-process.md" >&2  exit 1fiecho "exceptions OK (today $TODAY, latest allowed exp $LIMIT)"

chmod +x scripts/check-exceptions.shgit add -Abash scripts/check-exceptions.sh

exceptions OK (today 2026-10-31, latest allowed exp 2027-01-29)

printf 'package demo\n\nconst a = "x" // nosemgrep\n' > internal/tmp_test_nosem.gogit add internal/tmp_test_nosem.gobash scripts/check-exceptions.sh; echo "exit=$?"git rm -q --cached internal/tmp_test_nosem.go && rm internal/tmp_test_nosem.go

::error file=internal/tmp_test_nosem.go,line=3::nosemgrep must name the rule id (nosemgrep: <rule-id>)1 exception problem(s). See docs/exception-process.mdexit=1

  exceptions:    runs-on: ubuntu-24.04    timeout-minutes: 5    steps:      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1        with:          persist-credentials: false      - name: Check scanner exceptions        run: bash scripts/check-exceptions.sh

      - name: Trivy image (gate)        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0        with:          version: v0.76.1          trivyignores: .trivyignore          scan-type: image          # ...sisanya sama seperti Bagian 5

name: exception-expiry # PR checks only run when someone opens a PR. This weekly run catches exceptions that expire in between,# and GitHub emails the failure.on:  schedule:    - cron: "0 1 * * 1" # Monday 01:00 UTC = 08:00 WIB  workflow_dispatch: permissions:  contents: read jobs:  exception-expiry:    runs-on: ubuntu-24.04    timeout-minutes: 5    steps:      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1        with:          persist-credentials: false      - name: Check scanner exceptions        run: bash scripts/check-exceptions.sh

for f in docs/rulesets/protect-development.json docs/rulesets/protect-main.json; do  jq -c '[.rules[] | select(.type=="required_status_checks").parameters.required_status_checks[].context]' "$f"done

["test","gitleaks","semgrep","govulncheck","dependency-review","trivy-config","trivy-image","exceptions"]["test","gitleaks","semgrep","govulncheck","dependency-review","trivy-config","trivy-image","exceptions","source-branch"]

git switch development && git pull --ff-onlygit switch -c demo/exception-accepted-riskEXP=$(date -v+30d +%F); echo "$EXP"    # macOS. Di Linux: date -d '+30 days' +%F

# exception: owner=@dimss113 exp=<EXP> reason="demo: root needed to bind port 80, tracked in issue"# nosemgrep: dockerfile.security.last-user-is-root.last-user-is-rootUSER root

printf '# exception: owner=@dimss113 exp=%s reason="demo: root needed to bind port 80, tracked in issue"\nDS-0002 exp:%s\n' "$EXP" "$EXP" >> .trivyignoregit add -A && bash scripts/check-exceptions.sh     # harus: exceptions OKgit commit -m "demo: accept root user with an expiring exception"git push -u origin demo/exception-accepted-riskgh pr create --base development --title "demo: accepted risk with expiry" \  --body "Demo only, not to be merged."gh pr checks --watch

gh pr view --json mergeStateStatus,mergeable

{"mergeStateStatus":"UNSTABLE","mergeable":"MERGEABLE"}

OLD=$(date -v-1d +%F)sed -i '' "s/$EXP/$OLD/g" Dockerfile .trivyignoregit commit -am "demo: let the exception expire"git pushgh pr checks --watch

gh pr close --delete-branch --comment "Demo only: exception accepted, then expired and blocked."

git switch development && git pull --ff-onlygit switch -c demo/exception-false-positivemkdir -p internal/demoV=$(openssl rand -hex 20)printf 'package demo\n\n// Demo only: a fixed test value that looks like an API key.\nconst apiKey = "%s"\n\nfunc Key() string { return apiKey }\n' "$V" > internal/demo/vector.gounset Vgit add -A && git commit -m "demo: add a fixed test value that looks like an api key"

gitleaks git . --no-banner --redact -v --log-opts="origin/development..HEAD"

RuleID:      generic-api-key...Fingerprint: <commit-sha>:internal/demo/vector.go:generic-api-key:4

FP=$(gitleaks git . --no-banner --redact --log-opts="origin/development..HEAD" \  --report-format json --report-path /tmp/gl.json >/dev/null 2>&1; jq -r '.[0].Fingerprint' /tmp/gl.json)rm /tmp/gl.json

EXP=$(date -v+30d +%F)printf '# exception: owner=@dimss113 exp=%s reason="demo: fixed test value, not a real credential"\n%s\n' "$EXP" "$FP" >> .gitleaksignore

// exception: owner=@dimss113 exp=<EXP> reason="demo: fixed test value, not a real credential"// nosemgrep: generic.secrets.security.detected-generic-api-key.detected-generic-api-keyconst apiKey = "..."

gofmt -l internal/demo      # harus kosonggit add -A && bash scripts/check-exceptions.shgit commit -m "demo: except the false positive by fingerprint"git push -u origin demo/exception-false-positivegh pr create --base development --title "demo: false positive exception" --body "Demo only, not to be merged."gh pr checks --watch