NEXUS GitHub Security

Resumo técnico

Plugin do NEXUS que centraliza findings pós-push de scanners, SBOM, Dependency-Track, domínios e repositórios CI/CD. Os imports normalizam evidências, deduplicam ou reabrem tarefas e alimentam o Compliance Hub; o painel também correlaciona CVEs, administra perfis e workflows de scan e dispara alertas críticos.

Escopo executado

• plugin.json — v1.2.0, categoria DevSecOps, ícone lucide shield-alert, icon.svg próprio e repositório sr00t3d/nexus-github-security.
• Registros: registerTab("github-security", "GitHub Security", "shield-alert", tab.php, "Security"), registerDoc(...), registerModal("security-modals", modals.php) e registerJs("github-security", "/plugins/github-security/assets/nexus-security-scanner.js").
• 37 actions de API (plugin.php, via PluginManager::registerApiAction) — 14 imports (security_import_trivy|grype|semgrep|codeql|mobsf|qark|nuclei|wordfence|gitleaks|zap|composer|npm|sbom|dtrack), SBOM (security_sbom_list/get), DTrack (security_dtrack_sync/dashboard/save_config), CVE (security_cve_details), domínios (security_scan_domain|save_domain|get_domains|delete_domain), repos (security_save_repo|get_repos|delete_repo), profiles (security_get_scan_profiles|set_scan_profile), workflows (security_get_workflow_statuses|trigger_workflow), CI health (security_get_ci_health|inspect_repo_ci|sync_repo_workflow|install_repo_dependabot|sync_outdated_workflows), alertas (security_notify_critical).
• Persistência: sem tabelas próprias — findings viram tarefas NEXUS (security_manage_task: dedupe por título, reopen de done/cancelled, project_resolve_for_task) e evidência em plugin.compliance.ci_evidence; domínios em plugin.security.domains, repos em plugin.security.repos, SBOM em plugin.security.sbom, DTrack em plugin.security.dtrack (config do DB).
• Imports: security_process_trivy_scan, grype, semgrep, codeql, mobsf, qark, nuclei, wordfence, gitleaks, zap, composer, npm, sbom, dtrack — cada um normaliza upload/body, resolve projeto e cria/reabre tarefas.
• Compliance: security_import_with_compliance → security_finding_to_controls (mapa MITRE + NIST/ISO por scanner) → security_record_compliance_evidence (evidência no Hub; SBOM não cria tarefa por pacote).
• SBOM: security_process_sbom_scan — CycloneDX preferido/SPDX fallback, purl → ecosystem, inventário por repo em plugin.security.sbom; security_sbom_list/get (detalhe + pacotes por ?repo=owner/name).
• Dependency-Track: stack Docker local (API 127.0.0.1:9080, UI 9081; bootstrap bootstrap-api-key.sh → plugin.security.dtrack); webhook NEW_VULNERABILITY/POLICY → tarefas [DTrack] CVE — pkg; security_dtrack_sync (evidência CI); dashboard com stats/syncs/alertas/config mascarada.
• CodeQL: dupla visibilidade — codeql-action/upload-sarif@v3 envia ao GitHub Security Tab + security_import_codeql cria/atualiza tarefas [CodeQL] ….
• Mobile: workflow nexus-mobile-scan.yml (job detect com path filter — Manifest/Gradle Android/iOS/artefato) → só então MobSF/QARK (sem APK/IPA ou repo não-mobile → skipped). Docs MOBSF.md/QARK.md.
• GitHub OAuth: integração com GitHub Manager (sr00t3d) compartilhando configurações de autenticação.
• Domínios: security_audit_domain — headers/SSL/CORS; slash /trivy <domínio|IP> via fastr.json (security_scan_domain).
• Intel: security_scanner_intel_enrich (prioridade 46, tipo cve) — correlação local com tarefas/findings (sem API externa no hub).
• Alertas: security_notify_critical — notify_security_critical (e-mail, dashboard, Discord/Slack, Novu opcional); usado pelo job notify-critical.
• CI health: security_get_ci_health/inspect_repo_ci — compara workflow remoto vs template local (action pins, template version/fingerprint), sync de workflows, Dependabot, detecção de billing block.
• UI Alpine.js (tab.php): 4 sub-tabs (Domínios, Repositórios CI/CD, SBOM, Dependency-Track), seletor de import por scanner, cards de métricas e toolbar premium.

Stack e ferramentas

• Backend: PHP 8.3 (PDO Singleton, JSON APIs, fail-closed guards)
• Frontend: Alpine.js v3 + Tailwind CSS v4.3 + Lucide Icons
• Scanners: Trivy, Grype, Semgrep, CodeQL, MobSF, QARK, Nuclei, Wordfence CLI, Gitleaks, OWASP ZAP, Syft SBOM
• Integrações: Dependency-Track, Compliance Hub, Novu, Discord/Slack