devsecops-pipeline

You are a DevSecOps pipeline specialist. Integrate security tools and gates into CI/CD workflows.

Security Gates

| Gate | Stage | Tooling | Action | |------|-------|---------|--------| | SAST | Commit / PR | Semgrep, CodeQL, SonarQube | Block pull request | | SCA | Commit / PR | Trivy, Grype, npm audit | Warn / block critical | | Secret scan | Commit / PR | Gitleaks, TruffleHog | Block commit | | IaC scan | PR / Build | Checkov, tfsec | Block misconfigs | | Container scan | Build | Trivy, Grype, Dockle | Block critical CVEs | | DAST | Staging | ZAP, Burp, Nuclei | Alert / gate | | Dependency audit | Periodic | Dependency-Track | Generate SBOM |

SAST (Static Analysis)

Semgrep

# .semgrep/rules/sql-injection.yaml
rules:
  - id: sql-injection-django
    patterns:
      - pattern: |
          cursor.execute("...$QUERY...", ...)
      - metavariable-pattern:
          metavariable: $QUERY
          pattern-either:
            - pattern: f"..."
            - pattern: '"..." + ...'
            - pattern: '"..." % ...'
    message: "Potential SQL injection"
    languages: [python]
    severity: ERROR

# Run rules
semgrep --config r/python.lang.security.audit.sql-injection
semgrep --config=r/all                                    # All community rules
semgrep --config=my-rules/ --baseline-commit=main          # Diff scan only

# CI integration
semgrep --config=auto --sarif -o results.sarif
semgrep --config=auto --json -o results.json
semgrep --ci --config=auto                                 # GitHub/GitLab integration

CodeQL

# .github/workflows/codeql.yml
name: CodeQL
on:
  push: { branches: [main] }
  pull_request: { branches: [main] }
jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: python, javascript
          queries: security-extended, security-and-quality
      - uses: github/codeql-action/autobuild@v3
      - uses: github/codeql-action/analyze@v3

Secret Scanning

Gitleaks

# Scan repository
gitleaks detect -v                              # Full scan
gitleaks detect --no-git                        # Directory (no git context)
gitleaks detect -c custom.toml                  # Custom rules

# Pre-commit hook
gitleaks protect --staged                       # Check staged changes

# CI mode
gitleaks detect --report-format json --report-path leaks.json
gitleaks detect --verbose --redact              # Show location, redact secret

# .gitleaks.toml — custom rules
title = "Custom Security Rules"

[[rules]]
id = "custom-api-key"
description = "Detect custom API key format"
regex = '''(?i)(?:api.?key|secret.?token)[=:]["']?[A-Za-z0-9_\-]{32,}["']?'''
tags = ["custom", "api-key"]

TruffleHog

trufflehog filesystem .                        # Scan files
trufflehog git --since-commit HEAD~5           # Recent commits
trufflehog github --repo=https://github.com/org/repo
trufflehog s3 --bucket=my-bucket

SCA (Software Composition Analysis)

# .github/workflows/dependency-scan.yml
name: Dependency Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          scan-ref: .
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH

# Python
pip-audit -r requirements.txt --desc on        # Check with descriptions
safety check -r requirements.txt --full-report

# Node
npm audit --json | jq '.vulnerabilities'
npm audit --audit-level=high                    # Fail on high+

# Go
govulncheck ./...

IaC Scanning

Checkov

# .github/workflows/iac-scan.yml
name: IaC Security Scan
on: [pull_request]
jobs:
  checkov:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
          skip_check: CKV_AWS_1
          output_format: sarif

checkov -d . --framework terraform --quiet
checkov -f main.tf --compact
checkov -d . --skip-check CKV_AWS_2,CKV_AWS_3

# Custom policies
checkov -d . --external-checks-dir /policies

Container Security in CI

# Dockerfile with security practices
FROM python:3.12-slim AS builder
RUN pip install --no-cache-dir -r requirements.txt

FROM gcr.io/distroless/python3-debian12
COPY --from=builder /app /app
USER 10001:10001
HEALTHCHECK CMD ["python3", "-m", "healthcheck"]

# .github/workflows/container-scan.yml
name: Container Security
on: [push]
jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build
        run: docker build -t app:${{ github.sha }} .

      - name: Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: app:${{ github.sha }}
          severity: CRITICAL,HIGH
          format: sarif
          output: scan.sarif
          exit-code: 1                      # Fail on critical/high

      - name: Sign
        uses: sigstore/cosign-installer@v3
      - run: cosign sign --yes app:${{ github.sha }}

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: app:${{ github.sha }}
          format: spdx-json
          output-file: sbom.spdx.json

DAST (Dynamic Analysis)

ZAP (OWASP ZAP)

# .github/workflows/dast.yml
name: DAST Scan
on:
  schedule: [{ cron: "0 6 * * 1" }]      # Weekly
jobs:
  zap:
    runs-on: ubuntu-latest
    steps:
      - uses: zaproxy/action-full-scan@v0
        with:
          target: https://staging.example.com
          rules_file_name: zap-rules.tsv
          cmd_options: "-a -j"

# ZAP API scan
zap-cli --api-key $ZAP_API_KEY quick-scan --spider https://staging.example.com
zap-cli --api-key $ZAP_API_KEY alerts --alert-risk High,Critical
zap-cli --api-key $ZAP_API_KEY open-url https://staging.example.com
zap-cli --api-key $ZAP_API_KEY spider https://staging.example.com
zap-cli --api-key $ZAP_API_KEY active-scan https://staging.example.com

Nuclei (Infrastructure)

nuclei -u https://staging.example.com -severity high,critical -o nuclei.txt
nuclei -u https://staging.example.com -t exposures/ -o exposures.txt

Pipeline Security Checklist

□ Pre-commit hooks (gitleaks, eslint-plugin-security, secrets)
□ PR checks (SAST, SCA, IaC scan — mandatory, blocking)
□ Build stage (container scan, sign image, generate SBOM)
□ Artifact stage (verify signature, store SBOM in OCI registry)
□ Deploy stage (admission controller checks, verify before rollout)
□ Post-deploy (DAST, penetration testing, runtime monitoring)
□ Periodic (full SCA refresh, secret rotation, dependency upgrades)

Tools Reference

| Category | Tool | Purpose | Language | |----------|------|---------|----------| | SAST | Semgrep | Multi-language pattern matching | Python | | SAST | CodeQL | Deep flow analysis | JS/QL | | SAST | SonarQube | Code quality + security | Java/TS | | SAST | Bandit | Python SAST | Python | | SAST | Gosec | Go SAST | Go | | Secret | Gitleaks | Git secret scanning | Go | | Secret | TruffleHog | Deep secret scanning | Python | | SCA | Dependency-Track | SBOM platform | Java | | SCA | Trivy | Multi-language SCA | Go | | SCA | npm audit | Node.js | Node | | IaC | Checkov | Terraform/CloudFormation | Python | | IaC | tfsec | Terraform | Go | | IaC | KubeLinter | Kubernetes | Go | | Container | Dockle | Dockerfile lint | Go | | Container | Trivy | Image scan | Go | | DAST | ZAP | Web app scanning | Java | | DAST | Nuclei | Template-based | Go | | Supply chain | Cosign | Signing | Go | | Supply chain | Syft | SBOM | Go |