# DevSecOps CI/CD Pipeline
A production-grade DevSecOps pipeline implementing "shift-left" security —
every vulnerability is caught before it reaches production.
## Pipeline Stages
| Stage | Tool | Purpose |
|-------|------|---------|
| SAST | Bandit + Semgrep | Python code security analysis |
| SCA | Safety | Dependency vulnerability scanning |
| IaC Scan | Checkov | Terraform + K8s manifest security |
| Container Scan | Trivy | Image CVE scanning (CRITICAL = block) |
| SBOM | Syft | Software Bill of Materials (SPDX + CycloneDX) |
| Policy | OPA | Kubernetes manifest policy enforcement |
| Admission Control | Gatekeeper | Runtime policy enforcement on cluster |
## Security Gates
- CRITICAL CVEs in container image → **pipeline fails**
- Privileged containers → **OPA policy blocks deployment**
- Missing resource limits → **OPA policy blocks deployment**
- Hardcoded secrets → **Trivy FS scan catches them**
- Insecure IaC → **Checkov reports to GitHub Security tab**
## Quick Start
```bash
git clone https://github.com/ravishekharg/devsecops-pipeline
cd devsecops-pipeline
# Run OPA policy check locally
opa eval --data opa/policies/ \
--input kubernetes/deployment.yaml \
"data.kubernetes.deny"
# Run Trivy locally
trivy fs . --severity HIGH,CRITICAL
# Run Bandit locally
pip install bandit && bandit -r app/
# Generate SBOM locally
syft app/ --output tableSecurity is enforced at every layer:
- Code — SAST with Bandit catches insecure patterns
- Dependencies — Safety blocks known vulnerable packages
- Infrastructure — Checkov ensures IaC follows CIS benchmarks
- Container — Trivy blocks CRITICAL CVEs before push
- Manifest — OPA validates K8s YAMLs before apply
- Runtime — Gatekeeper enforces policies on the live cluster
---
## How to Use This Repo
```bash
# 1. Create and push the repo
git init devsecops-pipeline
cd devsecops-pipeline
# copy all files above into correct paths
git add .
git commit -m "feat: complete DevSecOps pipeline with Trivy, OPA, Gatekeeper, SBOM"
git push -u origin main
# 2. GitHub Actions runs automatically on push
# Check: Actions tab → DevSecOps Pipeline
# 3. Security findings appear in:
# Security tab → Code scanning → Trivy / Checkov alerts
# 4. SBOM artifacts downloadable from Actions → Artifacts