Skip to main content

์—”ํ„ฐํ”„๋ผ์ด์ฆˆ์— ์‚ฌ์šฉ์ž ์ง€์ • ๋ณด์•ˆ ๊ตฌ์„ฑ ์ ์šฉ

์กฐ์ง ๋ฐ ์กฐ์ง์˜ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— custom security configuration์„ ์ ์šฉํ•˜์—ฌ ์—”ํ„ฐํ”„๋ผ์ด์ฆˆ์˜ ํŠน์ • ๋ณด์•ˆ ์š”๊ตฌ ์‚ฌํ•ญ์„ ์ถฉ์กฑํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๋ˆ„๊ฐ€ ์ด ๊ธฐ๋Šฅ์„ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋‚˜์š”?

๊ด€๋ฆฌ์ž ์—ญํ• ์„ ๊ฐ€์ง„ ์—”ํ„ฐํ”„๋ผ์ด์ฆˆ ์†Œ์œ ์ž

custom security configuration ์ ์šฉ ์ •๋ณด

custom security configuration์„(๋ฅผ) ๋งŒ๋“  ํ›„์—๋Š” ์—”ํ„ฐํ”„๋ผ์ด์ฆˆ์˜ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ์ด ๋ฐ์ดํ„ฐ๋ฅผ ์ ์šฉํ•˜์—ฌ ํ•ด๋‹น ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์—์„œ ๊ตฌ์„ฑ ์„ค์ •์„ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค์ •ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค.

์ฐธ๊ณ  ํ•ญ๋ชฉ

security configurations์—์„œ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค์ •๋œ ์ผ๋ถ€ ๊ธฐ๋Šฅ์„ ์‚ฌ์šฉํ•˜๋ ค๋ฉด ์ž‘์—… ์‹œ๊ฐ„(๋ถ„)์ด ํ•„์š”ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. GitHub๋Š” ๊ตฌ์„ฑ์„ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ์ ์šฉํ•  ๋•Œ ํ•ด๋‹น ์‚ฌ์‹ค์„ ์•Œ๋ ค์ค๋‹ˆ๋‹ค. GitHub Actions ์ฒญ๊ตฌ ์ •๋ณด์— ๋Œ€ํ•œ ์ž์„ธํ•œ ๋‚ด์šฉ์€ GitHub Actions ์ฒญ๊ตฌ์„(๋ฅผ) ์ฐธ์กฐํ•˜์„ธ์š”.

์—”ํ„ฐํ”„๋ผ์ด์ฆˆ์˜ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— custom security configuration ์ ์šฉ

  1. ํŽ˜์ด์ง€ ๋งจ ์œ„์— ์žˆ๋Š” ์„ค์ •์„ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค..
  2. ์™ผ์ชฝ ์‚ฌ์ด๋“œ๋ฐ”์—์„œ Advanced Security ๋ฅผ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.
  3. ์ ์šฉํ•˜๋ ค๋Š” ๊ตฌ์„ฑ์˜ ์˜ค๋ฅธ์ชฝ์—์„œ Apply to ๋“œ๋กญ๋‹ค์šด ๋ฉ”๋‰ด๋ฅผ ์„ ํƒํ•œ ๋‹ค์Œ, All repositories ๋˜๋Š” All repositories without configurations๋ฅผ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.
  1. ํ•„์š”์— ๋”ฐ๋ผ ํ™•์ธ ๋Œ€ํ™” ์ƒ์ž์—์„œ ํ‘œ์‹œ ์—ฌ๋ถ€์— ๋”ฐ๋ผ security configuration์„(๋ฅผ) ์ƒˆ๋กœ ๋งŒ๋“  ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ์ž๋™์œผ๋กœ ์ ์šฉํ•˜๋„๋ก ์„ ํƒํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. None ๋“œ๋กญ๋‹ค์šด ๋ฉ”๋‰ด๋ฅผ ์„ ํƒํ•œ ๋‹ค์Œ, Public, Private and internal ๋˜๋Š” ๋‘˜ ๋‹ค๋ฅผ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.

  2. ๋ณ€๊ฒฝ ๋‚ด์šฉ์ด GitHub Secret Protection, GitHub Code Security, or GitHub Advanced Security ๋ผ์ด์„ ์Šค ์‚ฌ์šฉ๋Ÿ‰์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์— ๋Œ€ํ•œ ์ž์„ธํ•œ ์ •๋ณด๋ฅผ ๊ฒ€ํ† ํ•ฉ๋‹ˆ๋‹ค. security configuration์„(๋ฅผ) ์ ์šฉํ•˜๋ ค๋ฉด ์ ์šฉ์„ ํด๋ฆญํ•ฉ๋‹ˆ๋‹ค.

security configuration์€(๋Š”) ์ผ๋ถ€ ๋ณด์•ˆ ๊ธฐ๋Šฅ์ด ๋ณด๊ด€๋œ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ(์˜ˆ: secret scanning)์—์„œ ์‹คํ–‰๋˜๋ฏ€๋กœ ํ™œ์„ฑ ๋ฐ ๋ณด๊ด€๋œ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ ๋ชจ๋‘์— ์ ์šฉ๋ฉ๋‹ˆ๋‹ค. ๋˜ํ•œ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ๊ฐ€ ๋‚˜์ค‘์— ๋ณด๊ด€๋˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ, ์„ ํƒํ•œ security configuration์— ์˜ํ•ด ๋ณดํ˜ธ๋œ๋‹ค๋Š” ๊ฒƒ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

security configurations๊ฐ€ ์—”ํ„ฐํ”„๋ผ์ด์ฆˆ์˜ ์ผ๋ถ€ ์กฐ์ง์— ์ ์šฉ๋˜์ง€ ์•Š์œผ๋ฉด GitHub๋Š” UI์— ๋ฐฐ๋„ˆ๋ฅผ ํ‘œ์‹œํ•˜์—ฌ ์•Œ๋ ค ์ค๋‹ˆ๋‹ค. ๋ฐฐ๋„ˆ์˜ ๋งํฌ๋ฅผ ํด๋ฆญํ•˜์—ฌ ๊ด€๋ จ๋œ ์กฐ์ง ๋ฐ ๋ฆฌํฌ์ง€ํ† ๋ฆฌ์— ๋Œ€ํ•œ ์ž์„ธํ•œ ์ •๋ณด๋ฅผ ๊ฐ€์ ธ์˜ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

๋‹ค์Œ ๋‹จ๊ณ„

custom security configuration์„ ํŽธ์ง‘ํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์•Œ์•„๋ณด๋ ค๋ฉด ์‚ฌ์šฉ์ž ์ง€์ • ๋ณด์•ˆ ๊ตฌ์„ฑ ํŽธ์ง‘์„(๋ฅผ) ์ฐธ์กฐํ•˜์„ธ์š”.