devsecops-pipeline

name	devsecops-pipeline
description	Build security gates into CI/CD pipelines. Outputs SAST, DAST, dependency scanning, secret detection, and container scanning pipeline with triage workflow.
argument-hint	["language stack","CI system","deployment target","compliance requirements"]
allowed-tools	Read, Write, Bash

DevSecOps Pipeline

DevSecOps embeds security testing into every stage of the development pipeline — not as a gate before release, but as continuous feedback during development. The goal is to find and fix vulnerabilities when they're cheapest to address: at commit time, not in production.

Process

1. Pre-commit: Secret detection, code formatting, basic linting. Fast — <5 seconds.
2. Pull request: SAST, dependency vulnerability scan, licence compliance. Blocks merge on critical findings.
3. Build: Container image scanning, SBOM generation, image signing.
4. Staging deploy: DAST against the running application.
5. Production: Runtime threat detection, continuous dependency monitoring.

Pre-Commit Hooks

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks
        name: Detect secrets
        # Blocks commit if credentials found in diff

  - repo: https://github.com/trufflesecurity/trufflehog
    rev: v3.67.0
    hooks:
      - id: trufflehog
        name: Detect high-entropy secrets

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: detect-private-key
      - id: check-added-large-files
        args: ['--maxkb=500']

# Install: pre-commit install
# Run manually: pre-commit run --all-files

Full CI/CD Security Pipeline

# .github/workflows/devsecops.yml
name: DevSecOps Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:

env:
  IMAGE_NAME: ${{ github.repository }}:${{ github.sha }}

jobs:
  # ─── STAGE 1: SAST (Static Analysis) ───────────────────────────────
  sast:
    name: Static Analysis
    runs-on: ubuntu-latest
    permissions:
      security-events: write
    steps:
      - uses: actions/checkout@v4

      # CodeQL — multi-language SAST
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: python, javascript
          queries: security-and-quality

      - name: Build for CodeQL
        uses: github/codeql-action/autobuild@v3

      -   
         
        
           
           

      
         
         
        
                      
           

         
         
         
        
           

      
         
           
         
  
  
      
     
    
        

      
         
         
        
             
        
            

      
          
         
        
             
           
           
           
      
          
         
  
  
      
     
    
        
        
             

           
         
        
             
             

         
         
        
           
             
           
           

  
  
      
     
     [, , ]
    
        

         
             

          
         
        
             
           
           
           
           
           

          
         

         
         
        
             

           
           
         
              

         
         
         
  
  
      
     
     
       
    
         
             
        
           
         
           
         
        
           
           
                    
           
           

          
         
  
  
      
     
       
    
        

          
         
        
           
           
           
           

        
         
        
           
           
           

Triage Workflow

## Security Finding Triage

### Severity Classification
| CVSS Score | Finding Type | Action | SLA |
|-----------|-------------|--------|-----|
| 9.0-10.0 (Critical) | Any | Block deployment; immediate fix | 24 hours |
| 7.0-8.9 (High) | Exploitable remotely | Block PR merge | 7 days |
| 7.0-8.9 (High) | Requires auth/local | Fix in next sprint | 14 days |
| 4.0-6.9 (Medium) | Any | Fix in next quarter | 90 days |
| <4.0 (Low) | Any | Log + fix when convenient | Backlog |

### False Positive Process
1. Finding identified as false positive
2. Add to `.security-ignore` with justification + expiry date
3. Security lead approves
4. Re-evaluate on expiry

# .gitleaks.toml — allowlist for false positives
[allowlist]
  description = "Known false positives"
  paths = [
    '''tests/fixtures/test_keys.py''',  # Test fixtures only
  ]
  regexes = [
    '''EXAMPLE_API_KEY''',  # Placeholder in docs
  ]

Anti-Patterns to Avoid

Anti-Pattern	Problem	Fix
All security scans on main branch only	Finds issues too late	Run SAST on every PR; block merge
Blocking on all findings	Pipeline never passes; engineers bypass	Critical/High blocks merge; Medium/Low are warnings
No false positive management	Noise leads to alert fatigue	Formal allowlist process with expiry dates
DAST against production	Real user data; breaking changes	DAST only against staging/ephemeral environments
Security as last step	Shifts cost right; findings are expensive	Pre-commit + PR + build scanning
Separate security team reviews everything	Bottleneck; slow feedback	Automated gates; security team reviews policy, not each finding
Ignoring dependency transitive vulns	Direct deps are clean but transitive aren't	Scan the full dependency tree

10 Rules

1. Pre-commit hooks catch secrets and obvious issues before they ever reach the repo.
2. SAST runs on every PR — not just on main — so developers get immediate feedback.
3. Block merge on Critical and High severity findings with available fixes; warn on Medium.
4. Dependency scanning includes transitive dependencies — not just direct imports.
5. Container images are scanned before they are pushed, not after.
6. False positive management is a formal process with justification and expiry — not an informal override.
7. DAST targets only staging or ephemeral environments — never production.
8. SBOM generation is automatic on every build — you need to know what's in your supply chain.
9. Image signing with Cosign — only signed images deploy to production.
10. Security gates are owned by the platform team but findings are fixed by the development team.