https://github.com/trustedoss/ai-coding-best-practice

Last synced: 2 months ago
JSON representation
Host: GitHub
URL: https://github.com/trustedoss/ai-coding-best-practice
Owner: trustedoss
Created: 2026-04-25T06:29:03.000Z (3 months ago)
Default Branch: main
Last Pushed: 2026-04-25T07:30:13.000Z (3 months ago)
Last Synced: 2026-04-25T09:13:58.943Z (3 months ago)
Language: Python
Size: 44.9 KB
Stars: 0
Watchers: 0
Forks: 0
Open Issues: 2
Metadata Files:
- Readme: README.md
Awesome Lists containing this project

README

          [🇰🇷 한국어](#한국어) | [🇺🇸 English](#english)

---



# AI 코딩 Best Practice

[![Secret Detection](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/secret-detection.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/secret-detection.yml)

[![SAST](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/sast.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/sast.yml)

[![CodeQL](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/codeql.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/codeql.yml)

[![OSS Policy](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/oss-policy.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/oss-policy.yml)

[![IaC Security](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/iac-security.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/iac-security.yml)

[![Container Security](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/container-security.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/container-security.yml)

[![DAST](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/dast.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/dast.yml)

[![AI Fuzzing](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/ai-fuzzing.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/ai-fuzzing.yml)

[Trusted OSS — AI 코딩 5단계 전략](https://trustedoss.github.io/ai-coding/strategy)을 모두 구현한 참조 저장소입니다.

fork해서 즉시 사용하거나, 설정 파일을 복사해 기존 프로젝트에 적용할 수 있습니다.

---

## 단계별 구현 현황

| 단계 | 내용 | 구현 파일 |

|------|------|-----------|

| 1단계 | 프롬프트 의존 | — (도구 불필요) |

| 2단계 | AI 규칙 내재화 | `CLAUDE.md`, `.cursorrules` |

| 3단계 | CI/CD 자동 차단 | `.github/workflows/` (전통 도구 6개) |

| 4단계 | AI 방어 레이어 | `ai-review.yml` (findings-driven), `ai-fuzzing.yml` |

| 5단계 | 지속적 모니터링·자동 교정 | `dependabot.yml`, `renovate.json`, `dast.yml` |

---

## 3단계 CI/CD 구성

| 워크플로우 | 도구 | 역할 | PR | Push/Main |

|------------|------|------|----|-----------|

| `secret-detection.yml` | Gitleaks | API 키·토큰 하드코딩 탐지 | ✅ | ✅ |

| `sast.yml` | Semgrep | SQL 인젝션·취약 패턴 탐지 | ✅ | — |

| `codeql.yml` | CodeQL | 심층 정적 분석 (주 1회 포함) | ✅ | ✅ |

| `oss-policy.yml` | syft + grype | CVE 스캔 + 라이선스 검사 | ✅ | — |

| `iac-security.yml` | Checkov | Dockerfile·K8s 보안 설정 검사 | ✅ | — |

| `container-security.yml` | Trivy | Docker 이미지 취약점 스캔 | ✅ | ✅ |

## 4단계 AI 방어 레이어

| 워크플로우 | 도구 | 역할 | 실행 조건 |

|-----------|------|------|-----------|

| `ai-review.yml` | Claude API | Semgrep·grype findings → AI 검증·해석 → PR 코멘트 | PR (ANTHROPIC_API_KEY 등록 시 자동 활성화) |

| `ai-fuzzing.yml` | Claude + requests | AI 생성 엣지케이스로 5xx 탐지 | Push to main · 주 1회 |

## 5단계 지속적 모니터링·자동 교정

| 워크플로우 / 설정 | 도구 | 역할 | 실행 주기 |

|------------------|------|------|-----------|

| `dependabot.yml` | Dependabot | 의존성 업데이트 PR 자동 생성 | 주 1회 |

| `renovate.json` | Renovate | Critical 패치 자동 병합 | 즉시·주 1회 |

| `dast.yml` | OWASP ZAP | 배포 후 동적 취약점 스캔 (Soft fail) | Push to main |

---

## 빠른 시작

### 1. Fork

GitHub에서 이 저장소를 fork한 뒤 클론합니다.

```bash

git clone https://github.com/YOUR-ORG/ai-coding-best-practice.git

cd ai-coding-best-practice

```

### 2. PR을 열어 파이프라인 확인

```bash

git checkout -b test/pipeline-check

echo "# test" >> README.md

git commit -am "test: pipeline check"

git push origin test/pipeline-check

```

GitHub에서 PR을 생성하면 3단계 워크플로우 6개가 자동 실행됩니다.

### 3. GitHub Secrets 등록

| Secret 이름 | 용도 | 필수 여부 |

|-------------|------|-----------|

| `ANTHROPIC_API_KEY` | 4단계 AI 리뷰 (`ai-review.yml`), AI 퍼징 (`ai-fuzzing.yml`) | 선택 |

`ANTHROPIC_API_KEY`를 등록하면 4단계 AI 방어 레이어가 자동으로 활성화됩니다.

별도 설정 변경 없이 다음 PR부터 findings-driven AI 리뷰가 동작합니다.

---

## 커스터마이징

| 파일 | 수정 포인트 |

|------|------------|

| `CLAUDE.md` | 팀 라이선스 정책, 금지 패키지 목록 |

| `.cursorrules` | 도구별 규칙 조정 |

| `.grype.yaml` | 취약점 임계값 (`high` ↔ `critical`) |

| `.gitleaks.toml` | 조직 내부 패턴 예외 처리 추가 |

| `.semgrep.yml` | 언어·프레임워크별 룰셋 추가 |

| `renovate.json` | 자동 병합 범위, 업데이트 주기 |

| `dast.yml` | 안정화 후 `fail_action: true` 로 변경해 Hard fail 전환 |

---

## 관련 가이드

- [AI 코딩 5단계 전략](https://trustedoss.github.io/ai-coding/strategy)

- [30분 완성 Quick CI/CD](https://trustedoss.github.io/ai-coding/cicd-quick)

- [AI 보안 코드 리뷰](https://trustedoss.github.io/ai-coding/ai-security-review)

- [DevSecOps — 전사 파이프라인 설계](https://trustedoss.github.io/devsecops/pipeline-design)

---



# AI Coding Best Practice

[![Secret Detection](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/secret-detection.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/secret-detection.yml)

[![SAST](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/sast.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/sast.yml)

[![CodeQL](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/codeql.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/codeql.yml)

[![OSS Policy](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/oss-policy.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/oss-policy.yml)

[![IaC Security](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/iac-security.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/iac-security.yml)

[![Container Security](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/container-security.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/container-security.yml)

[![DAST](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/dast.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/dast.yml)

[![AI Fuzzing](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/ai-fuzzing.yml/badge.svg)](https://github.com/trustedoss/ai-coding-best-practice/actions/workflows/ai-fuzzing.yml)

A reference repository implementing all 5 stages of the [Trusted OSS — AI Coding Strategy](https://trustedoss.github.io/ai-coding/strategy).

Fork it for immediate use, or copy individual config files into your existing project.

---

## Implementation Status by Stage

| Stage | Description | Implementation Files |

|-------|-------------|----------------------|

| Stage 1 | Prompt-only | — (no tools needed) |

| Stage 2 | AI rule internalization | `CLAUDE.md`, `.cursorrules` |

| Stage 3 | CI/CD auto-blocking | `.github/workflows/` (6 traditional tools) |

| Stage 4 | AI defense layer | `ai-review.yml` (findings-driven), `ai-fuzzing.yml` |

| Stage 5 | Continuous monitoring & auto-remediation | `dependabot.yml`, `renovate.json`, `dast.yml` |

---

## Stage 3: CI/CD Configuration

| Workflow | Tool | Role | PR | Push/Main |

|----------|------|------|----|-----------|

| `secret-detection.yml` | Gitleaks | Detect hardcoded API keys & tokens | ✅ | ✅ |

| `sast.yml` | Semgrep | Detect SQL injection & vulnerable patterns | ✅ | — |

| `codeql.yml` | CodeQL | Deep static analysis (includes weekly scan) | ✅ | ✅ |

| `oss-policy.yml` | syft + grype | CVE scan + license check | ✅ | — |

| `iac-security.yml` | Checkov | Dockerfile & K8s security config check | ✅ | — |

| `container-security.yml` | Trivy | Docker image vulnerability scan | ✅ | ✅ |

## Stage 4: AI Defense Layer

| Workflow | Tool | Role | Trigger |

|----------|------|------|---------|

| `ai-review.yml` | Claude API | Semgrep/grype findings → AI validation & interpretation → PR comment | PR (auto-activates when `ANTHROPIC_API_KEY` is set) |

| `ai-fuzzing.yml` | Claude + requests | AI-generated edge cases to detect 5xx errors | Push to main · weekly |

## Stage 5: Continuous Monitoring & Auto-Remediation

| Workflow / Config | Tool | Role | Schedule |

|-------------------|------|------|----------|

| `dependabot.yml` | Dependabot | Auto-generate dependency update PRs | Weekly |

| `renovate.json` | Renovate | Auto-merge critical patches | Immediately · weekly |

| `dast.yml` | OWASP ZAP | Dynamic vulnerability scan after deployment (soft fail) | Push to main |

---

## Quick Start

### 1. Fork

Fork this repository on GitHub, then clone it.

```bash

git clone https://github.com/YOUR-ORG/ai-coding-best-practice.git

cd ai-coding-best-practice

```

### 2. Open a PR to verify the pipeline

```bash

git checkout -b test/pipeline-check

echo "# test" >> README.md

git commit -am "test: pipeline check"

git push origin test/pipeline-check

```

Opening a PR on GitHub will automatically trigger all 6 Stage 3 workflows.

### 3. Register GitHub Secrets

| Secret Name | Purpose | Required |

|-------------|---------|----------|

| `ANTHROPIC_API_KEY` | Stage 4 AI review (`ai-review.yml`), AI fuzzing (`ai-fuzzing.yml`) | Optional |

Once `ANTHROPIC_API_KEY` is registered, the Stage 4 AI defense layer activates automatically.

No additional configuration needed — findings-driven AI review starts on the next PR.

---

## Customization

| File | What to Modify |

|------|----------------|

| `CLAUDE.md` | Team license policy, prohibited package list |

| `.cursorrules` | Per-tool rule adjustments |

| `.grype.yaml` | Vulnerability threshold (`high` ↔ `critical`) |

| `.gitleaks.toml` | Add organization-internal pattern exceptions |

| `.semgrep.yml` | Add language/framework-specific rulesets |

| `renovate.json` | Auto-merge scope, update schedule |

| `dast.yml` | Switch to hard fail by changing `fail_action: true` after stabilization |

---

## Related Guides

- [AI Coding 5-Stage Strategy](https://trustedoss.github.io/en/ai-coding/strategy)

- [30-Minute Quick CI/CD](https://trustedoss.github.io/en/ai-coding/cicd-quick)

- [AI Security Code Review](https://trustedoss.github.io/en/ai-coding/ai-security-review)

- [DevSecOps — Enterprise Pipeline Design](https://trustedoss.github.io/en/devsecops/pipeline-design)
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/trustedoss/ai-coding-best-practice

Awesome Lists containing this project

README
