Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for requests involving DevSecOps pipeline setup, automated security scanning in CI/CD, SAST/DAST/SCA integration, or shift-left security implementation.
Instrucciones de origen · Vista previa de solo lectura
name
implementing-devsecops-security-scanning
description
Integrates Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA) into CI/CD pipelines using open-source tools. Covers Semgrep for SAST, Trivy for SCA and container scanning, OWASP ZAP for DAST, and Gitleaks for secrets detection. Activates for requests involving DevSecOps pipeline setup, automated security scanning in CI/CD, SAST/DAST/SCA integration, or shift-left security implementation.
Setting up automated security scanning in a new or existing CI/CD pipeline
Shifting security left by catching vulnerabilities before code reaches production
Meeting compliance requirements (SOC 2, PCI-DSS, ISO 27001) that mandate automated security testing
Integrating SAST, DAST, and SCA together to achieve comprehensive application security coverage
Establishing security gates that block deployments containing critical or high-severity vulnerabilities
Do not use as a replacement for manual penetration testing. Automated scanning catches common vulnerability patterns but cannot replace human-driven security assessments for business logic flaws and complex attack chains.
Prerequisites
CI/CD platform: GitHub Actions, GitLab CI, Jenkins, or Azure DevOps
Container runtime (Docker) for running scanning tools
A staging environment URL for DAST scanning (DAST cannot test static code)
Repository access with permissions to modify CI/CD workflow files
Tool-specific requirements:
Semgrep: free for open-source rulesets (p/security-audit, p/owasp-top-ten)
Trivy: free, no account required
OWASP ZAP: free, Docker image available
Gitleaks: free, no account required
Workflow
Step 1: Add Secrets Detection with Gitleaks
Secrets detection runs first because leaked credentials are the highest-priority finding. Add to .github/workflows/security.yml:
For custom rules, create .semgrep/custom-rules.yml:
rules:-id:no-exec-user-inputpatterns:-pattern:exec($INPUT)-pattern-not:exec("...")message:>
User input passed to exec(). This is a command injection vulnerability.
severity:ERRORlanguages: [python]
metadata:cwe:"CWE-78: OS Command Injection"owasp:"A03:2021 - Injection"-id:no-raw-sql-queriespatterns:-pattern:cursor.execute(f"...")-pattern:cursor.execute("..."+...)message:>
SQL query built with string concatenation or f-strings. Use parameterized queries.
severity:ERRORlanguages: [python]
metadata:cwe:"CWE-89: SQL Injection"owasp:"A03:2021 - Injection"
Step 3: Add SCA Scanning with Trivy
Trivy scans dependencies, container images, IaC files, and generates SBOM:
sca-scan:name:SCA&ContainerScan(Trivy)runs-on:ubuntu-lateststeps:-uses:actions/checkout@v4-name:RunTrivyfilesystemscan(dependencies)uses:aquasecurity/trivy-action@0.28.0with:scan-type:'fs'scan-ref:'.'severity:'CRITICAL,HIGH'exit-code:'1'format:'json'output:'trivy-fs-results.json'-name:RunTrivyIaCscan(Terraform,CloudFormation)uses:aquasecurity/trivy-action@0.28.0with:scan-type:'config'scan-ref:'.'severity:'CRITICAL,HIGH'exit-code:'1'format:'json'output:'trivy-iac-results.json'-name:UploadSCAresultsif:always()uses:actions/upload-artifact@v4with:name:trivy-resultspath:trivy-*.jsoncontainer-scan:name:ContainerImageScan(Trivy)runs-on:ubuntu-latestneeds: [sast-scan] # Build image only after SAST passessteps:-uses:actions/checkout@v4-name:BuildDockerimagerun:dockerbuild-tapp:${{github.sha}}.-name:Scancontainerimageuses:aquasecurity/trivy-action@0.28.0with:image-ref:'app:${{ github.sha }}'severity:'CRITICAL,HIGH'exit-code:'1'format:'json'output:'trivy-image-results.json'-name:GenerateSBOMuses:aquasecurity/trivy-action@0.28.0with:image-ref:'app:${{ github.sha }}'format:'cyclonedx'output:'sbom.json'-name:UploadSBOMuses:actions/upload-artifact@v4with:name:sbompath:sbom.json
Step 4: Add DAST Scanning with OWASP ZAP
DAST runs against a deployed staging environment. It is slower than SAST/SCA and should run asynchronously or on a schedule:
dast-scan:name:DAST(OWASPZAP)runs-on:ubuntu-latestneeds: [deploy-staging] # Must run after app is deployed to stagingsteps:-uses:actions/checkout@v4-name:RunZAPBaselineScan(fast,suitableforCI)uses:zaproxy/action-baseline@v0.14.0with:target:${{vars.STAGING_URL}}rules_file_name:'.zap/rules.tsv'cmd_options:'-a -j'# For nightly full scans, use action-full-scan instead:# - name: Run ZAP Full Scan (comprehensive, 30-60 min)# uses: zaproxy/action-full-scan@v0.12.0# with:# target: ${{ vars.STAGING_URL }}
Create .zap/rules.tsv to configure alert thresholds:
10010 IGNORE (Cookie No HttpOnly Flag - acceptable for non-sensitive cookies)
10011 IGNORE (Cookie Without Secure Flag - staging uses HTTP)
90033 WARN (Loosely Scoped Cookie)
10038 FAIL (Content Security Policy Header Not Set)
40012 FAIL (Cross Site Scripting - Reflected)
40014 FAIL (Cross Site Scripting - Persistent)
40018 FAIL (SQL Injection)
90019 FAIL (Server Side Code Injection)
90020 FAIL (Remote OS Command Injection)
Step 5: Aggregate Results and Enforce Security Gates
Create a summary job that aggregates all scan results and enforces pass/fail gates:
security-gate:name:SecurityGateruns-on:ubuntu-latestneeds: [secrets-scan, sast-scan, sca-scan, container-scan]
if:always()steps:-name:Checkscanresultsrun:|
echo "Checking security scan results..."
# Fail the pipeline if any upstream job failedif [[ "${{ needs.secrets-scan.result }}"=="failure" ]];thenecho"BLOCKED: Secrets detected in repository"exit1fiif [[ "${{ needs.sast-scan.result }}"=="failure" ]];thenecho"BLOCKED: SAST found critical/high vulnerabilities"exit1fiif [[ "${{ needs.sca-scan.result }}"=="failure" ]];thenecho"BLOCKED: SCA found critical/high vulnerable dependencies"exit1fiif [[ "${{ needs.container-scan.result }}"=="failure" ]];thenecho"BLOCKED: Container image has critical/high vulnerabilities"exit1fiecho"All security gates passed"
Step 6: Configure Branch Protection Rules
Enforce the security pipeline as a required status check:
GitHub Repository > Settings > Branches > Branch Protection Rules
Branch name pattern: main
Require status checks to pass before merging: Enabled
Required status checks:
- Secrets Detection (Gitleaks)
- SAST (Semgrep)
- SCA & Container Scan (Trivy)
- Security Gate
Require branches to be up to date before merging: Enabled
Step 7: Set Up Developer Feedback Loop
Configure pre-commit hooks so developers catch issues before pushing:
