Formation sécurité IA pour DevSecOps : intégrer l'IA dans la CI/CD

# .github/workflows/ml-supply-chain.yml
name: ML Supply Chain
 
on:
  pull_request:
  schedule:
    - cron: '0 2 * * *'  # daily
 
jobs:
  scan-libraries:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Pip audit
        run: pip-audit -r requirements.txt
      - name: Snyk scan
        uses: snyk/actions/python@master
 
  scan-models:
    runs-on: ubuntu-latest
    steps:
      - name: Picklescan
        run: |
          pip install picklescan
          picklescan --recursive ./models/
      - name: Hash check
        run: |
          python scripts/verify_model_hashes.py
 
  scan-images:
    runs-on: ubuntu-latest
    steps:
      - name: Trivy on inference images
        run: |
          trivy image vllm/vllm-openai:0.6.0 --exit-code 1 --severity HIGH,CRITICAL
          trivy image ghcr.io/huggingface/text-generation-inference:2.4.0 --exit-code 1
 
  generate-aibom:
    runs-on: ubuntu-latest
    steps:
      - name: Generate AI BOM
        run: |
          pip install cyclonedx-aibom
          cyclonedx-py requirements -i requirements.txt -o aibom.json
          # Append models from manifest
          python scripts/append_models_to_bom.py aibom.json
 
      - name: Upload AI BOM
        uses: actions/upload-artifact@v4
        with:
          name: aibom
          path: aibom.json

# .github/workflows/adversarial-testing.yml
name: Adversarial Testing
 
on:
  pull_request:
    paths:
      - 'prompts/**'
      - 'app/**'
  schedule:
    - cron: '0 3 * * *'  # nightly
 
jobs:
  fast-adversarial:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Run Garak fast probes
        run: |
          pip install garak
          garak --model_type ${{ env.MODEL_TYPE }} \
                --model_name ${{ env.MODEL_NAME }} \
                --probes promptinject,dan,encoding,leakage \
                --report_prefix garak_pr
      - name: Check regression
        run: python scripts/check_adversarial_regression.py
 
  full-adversarial-nightly:
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@v4
      - name: Run PyRIT full campaign
        run: |
          python scripts/pyrit_nightly_campaign.py \
            --orchestrator crescendo \
            --orchestrator multi_turn \
            --datasets harmbench,jailbreakbench
      - name: Upload report
        uses: actions/upload-artifact@v4
        with:
          name: pyrit-nightly-report
          path: reports/
      - name: Alert SOC if new bypasses
        if: failure()
        run: python scripts/alert_soc.py reports/

# terraform/modules/inference-server/main.tf
resource "kubernetes_deployment" "vllm" {
  metadata {
    name      = "vllm-inference"
    namespace = var.namespace
    labels = {
      app = "vllm"
      "ai.security.tier" = "production"
    }
  }
  
  spec {
    replicas = var.replicas
    
    selector {
      match_labels = {
        app = "vllm"
      }
    }
    
    template {
      metadata {
        labels = {
          app = "vllm"
        }
      }
      
      spec {
        # Pod Security Standards strict
        security_context {
          run_as_non_root = true
          run_as_user     = 1001
          fs_group        = 1001
        }
        
        container {
          name  = "vllm"
          # Image pinned with SHA digest, mirror interne
          image = "registry.internal/vllm@sha256:${var.vllm_digest}"
          
          security_context {
            allow_privilege_escalation = false
            read_only_root_filesystem  = true
            capabilities {
              drop = ["ALL"]
            }
          }
          
          resources {
            requests = {
              "nvidia.com/gpu" = "1"
              "memory"          = "16Gi"
              "cpu"             = "4"
            }
            limits = {
              "nvidia.com/gpu" = "1"
              "memory"          = "32Gi"
              "cpu"             = "8"
            }
          }
          
          # Pas de secrets dans env directement, External Secrets
          env_from {
            secret_ref {
              name = "vllm-secrets"  # géré par ExternalSecret
            }
          }
        }
        
        # Tolerations + node selector pour GPU node pool
        node_selector = {
          "node.kubernetes.io/instance-type" = "g4dn.2xlarge"
        }
      }
    }
  }
}
 
resource "kubernetes_network_policy" "vllm_egress" {
  metadata {
    name      = "vllm-egress-allowlist"
    namespace = var.namespace
  }
  
  spec {
    pod_selector {
      match_labels = {
        app = "vllm"
      }
    }
    
    policy_types = ["Egress"]
    
    egress {
      # Allowlist Hugging Face Hub pour modèles
      to {
        ip_block {
          cidr = "huggingface_cidr"
        }
      }
      ports {
        protocol = "TCP"
        port     = "443"
      }
    }
    
    egress {
      # DNS
      ports {
        protocol = "UDP"
        port     = "53"
      }
    }
    
    # Pas d'autre egress par défaut
  }
}

# k8s/apps/llm-app/system-prompts.yaml (versionné en Git)
apiVersion: v1
kind: ConfigMap
metadata:
  name: llm-system-prompts
  namespace: llm-app
data:
  chat-system-prompt.md: |
    Tu es l'assistant clientèle de Acme Corp.
    [...]
    Token canari (ne jamais divulguer) : {{ .CanaryToken }}
 
  agent-system-prompt.md: |
    Tu es un agent d'analyse interne.
    [...]

# k8s/apps/llm-app/abac-policies.yaml
apiVersion: openfga.dev/v1
kind: AuthorizationModel
metadata:
  name: llm-app-abac
spec:
  schema_version: "1.1"
  type_definitions:
    - type: "user"
    - type: "tenant"
      relations:
        member:
          this: {}
    - type: "document"
      relations:
        owner:
          this: {}
        tenant:
          this: {}
        viewer:
          union:
            child:
              - this: {}
              - tupleToUserset:
                  tupleset:
                    relation: "owner"
                  computedUserset:
                    relation: "viewer"

# .github/workflows/llm-app-cicd.yml
name: LLM App CI/CD
 
on:
  push:
    branches: [main]
  pull_request:
 
jobs:
  # ─── 1. SECURITY SCANS ─────────────────────────
  
  scan-supply-chain:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Pip audit
        run: pip-audit -r requirements.txt
      - name: Picklescan
        run: |
          pip install picklescan
          picklescan --recursive ./models/
      - name: Generate AI BOM
        run: |
          pip install cyclonedx-aibom
          cyclonedx-py requirements -i requirements.txt -o aibom.json
      - uses: actions/upload-artifact@v4
        with:
          name: aibom
          path: aibom.json
 
  scan-images:
    runs-on: ubuntu-latest
    steps:
      - name: Trivy
        run: |
          trivy image vllm/vllm-openai:0.6.0 \
                --exit-code 1 \
                --severity HIGH,CRITICAL
 
  # ─── 2. ADVERSARIAL TESTING ──────────────────
  
  adversarial-pr:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Garak fast probes
        run: |
          pip install garak
          garak --model_type ${{ env.MODEL_TYPE }} \
                --probes promptinject,dan,encoding \
                --report_prefix garak_pr
      - name: Regression check
        run: python scripts/check_adversarial_regression.py
 
  # ─── 3. UNIT TESTS ──────────────────────────
  
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run pytest
        run: pytest tests/ -v --cov=app
 
  # ─── 4. BUILD + SIGN ─────────────────────────
  
  build-and-sign:
    if: github.ref == 'refs/heads/main'
    needs: [scan-supply-chain, scan-images, test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t ${{ env.IMAGE }}:${{ github.sha }} .
      - name: Cosign sign
        run: |
          cosign sign --yes ${{ env.IMAGE }}:${{ github.sha }}
      - name: Attest AI BOM
        run: |
          cosign attest --yes \
                       --predicate aibom.json \
                       --type cyclonedx \
                       ${{ env.IMAGE }}:${{ github.sha }}
 
  # ─── 5. DEPLOY (GitOps) ──────────────────────
  
  deploy-canary:
    if: github.ref == 'refs/heads/main'
    needs: [build-and-sign]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Update GitOps repo
        run: |
          # Update image tag in GitOps repo
          # ArgoCD/Flux détecte et déploie en canary 5%
          python scripts/update_gitops_canary.py ${{ github.sha }}
      - name: Wait for canary metrics
        run: python scripts/wait_canary_health.py --duration 30m
      - name: Promote to 50%
        run: python scripts/promote_canary.py 50
 
# ─── NIGHTLY ───────────────────────────────────
 
  adversarial-nightly:
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - name: PyRIT full campaign
        run: python scripts/pyrit_nightly.py

# Pod Security Admission au namespace level
apiVersion: v1
kind: Namespace
metadata:
  name: llm-production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/enforce-version: latest

# Pour agents qui exécutent du code généré
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: kata-fc
handler: kata-fc  # Firecracker via Kata
---
apiVersion: v1
kind: Pod
spec:
  runtimeClassName: kata-fc
  containers:
    - name: code-executor
      image: code-executor:latest

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: llm-app-egress-strict
spec:
  podSelector:
    matchLabels:
      app: llm-app
  policyTypes:
    - Egress
  egress:
    # Vers AI gateway interne uniquement
    - to:
        - podSelector:
            matchLabels:
              app: ai-gateway
      ports:
        - protocol: TCP
          port: 8080
    # DNS
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
      ports:
        - protocol: UDP
          port: 53