<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-security-pipeline-orchestration
description: >-
  Orchestrate multi-tool security scanning in CI/CD pipelines with parallel execution, result aggregation, policy gates, and failure triage.
domain: cybersecurity
subdomain: devsecops
tags:
  - ci-cd
  - pipeline-security
  - sast
  - sca
  - secrets-detection
  - policy-gates
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.001", "T1072"]
  nist-csf: ["ID.SC-4", "PR.DS-6"]
---

# Implementing Security Pipeline Orchestration

## Overview

Security pipeline orchestration coordinates SAST, SCA, secrets detection, container scanning, and IaC analysis into a coherent CI/CD gate. The goal is catching security issues at commit time with minimal developer friction — fast feedback, clear signal, hard blocks only on exploitable findings.

Mode: `[MODE: BUILD]` — DevSecOps. Shift left without breaking build velocity.

## Tool Matrix

| Scan Type | Tools | Trigger | Block Condition |
|---|---|---|---|
| SAST (code analysis) | Semgrep, CodeQL, Bandit | Every PR | Critical or High severity |
| SCA (dependencies) | Trivy, Snyk, OWASP DC | Every PR | CVSS >8.9 exploitable |
| Secrets detection | Gitleaks, TruffleHog | Pre-commit + PR | Any confirmed secret |
| Container scanning | Trivy, Grype | On Dockerfile change | Critical CVE in base image |
| IaC scanning | Checkov, tfsec, KICS | On IaC file change | High severity misconfiguration |
| DAST (runtime) | OWASP ZAP, Nuclei | On deploy to staging | Critical finding |

## Pipeline Stages

| Stage | Order | Parallel? | Timeout | On Failure |
|---|---|---|---|---|
| Pre-commit hooks | 0 (local) | No | 30s | Block commit |
| Secrets scan | 1 | No | 60s | Block + alert |
| SAST | 2 | Yes | 5 min | Block on threshold |
| SCA | 2 | Yes | 5 min | Block on threshold |
| IaC scan | 2 | Yes | 3 min | Block on threshold |
| Container scan | 3 | Yes | 5 min | Block on threshold |
| SARIF aggregation | 4 | No | 30s | Never block |
| Policy gate | 5 | No | 30s | Block on violation |
| DAST (staging only) | 6 | No | 15 min | Alert, not block |

## Policy Gate Configuration

```yaml
# .security/policy.yaml
gates:
  secrets:
    severity_threshold: any
    action: block
  sast:
    severity_threshold: critical
    action: block
    max_new_findings: 0
  sca:
    cvss_threshold: 8.9
    exploitable_only: true
    action: block
  container:
    severity_threshold: critical
    fixable_only: true
    action: block
  iac:
    severity_threshold: high
    action: block
```

## Result Aggregation

Normalize all scanner outputs to SARIF 2.1.0, merge into a single report, and post a consolidated PR comment:

```
Security Scan Results
---------------------
✅ SAST: 0 new findings (Semgrep + CodeQL)
⚠️  SCA: 2 medium CVEs (below block threshold)
✅ Secrets: Clean
✅ Container: No critical CVEs
✅ IaC: 1 info finding (non-blocking)

Gate: PASSED — ready to merge
```

## Triage Workflow

| Finding Type | First Action | Escalation Path |
|---|---|---|
| Confirmed secret in code | Rotate secret immediately, then fix code | Security team notification within 1h |
| Exploitable CVSS >8.9 dep | Pin to patched version or accept risk with approval | 72h SLA for critical |
| SAST false positive | Add `nosec` or suppression with justification comment | Peer review required |
| IaC misconfiguration | Fix before merge or document exception | Architecture review for exceptions |

## Verification

- [ ] All scanner tools version-pinned in pipeline config
- [ ] Policy gate blocks on correct severity thresholds
- [ ] SARIF results uploaded to GitHub/GitLab security tab
- [ ] Developers receive PR comment with findings summary
- [ ] Suppression workflow requires justification and peer review
- [ ] Pipeline runtime <10 min for SAST+SCA on average PR

## Related Techniques

- [Implementing CI/CD Security Gates](../securing-ci-cd-pipeline-infrastructure/SKILL.md)
- [Performing DevSecOps Maturity Assessment](../building-devsecops-metrics-dashboard/SKILL.md)
