<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: devsecops
description: >-
  DevSecOps pipeline security including SAST/DAST/SCA integration, container image
  scanning in CI/CD, infrastructure-as-code security scanning, secrets detection in
  code, dependency vulnerability management, supply chain security (SLSA/SBOM),
  GitOps security, and shift-left security culture. Covers GitHub Actions, GitLab CI,
  Jenkins, and cloud-native CI/CD security.
domain: cybersecurity
subdomain: devsecops
tags:
  - devsecops
  - sast
  - dast
  - sca
  - ci-cd
  - supply-chain
  - sbom
  - slsa
  - secrets-detection
  - shift-left
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1195.002", "T1059", "T1552.001"]
  nist-csf: ["PR.DS-6", "PR.IP-1", "PR.IP-12", "DE.CM-4"]
  frameworks: ["SLSA v1.0", "OWASP DevSecOps Guideline", "NIST SSDF"]
---

# DevSecOps

## When to Use

Activate when the operator asks about CI/CD security, SAST/DAST/SCA tools,
secrets scanning, pipeline hardening, SBOM generation, SLSA compliance,
dependency management, or shift-left security integration.

Mode: `[MODE: ARCHITECT]` for pipeline design; `[MODE: BLUE]` for scanning configuration.

## Quick Reference

| Tool Category | Tools | Pipeline Stage |
|--------------|-------|----------------|
| SAST | Semgrep, CodeQL, SonarQube, Bandit (Python) | Pre-commit / PR |
| DAST | OWASP ZAP, Nuclei, Burp Suite CI | Post-deploy (staging) |
| SCA | Snyk, Dependabot, OSV-Scanner, Trivy | PR / Daily |
| Secrets | Gitleaks, TruffleHog, detect-secrets | Pre-commit / PR |
| IaC | Checkov, tfsec, KICS, Terrascan | PR |
| Container | Trivy, Grype, Snyk Container | Build |
| SBOM | Syft, CycloneDX, SPDX | Build / Release |
| License | FOSSA, ScanCode, license-checker | PR |

## Workflow

### 1. Pipeline Security Architecture

```
┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐
│ Pre-     │    │ Build    │    │ Test     │    │ Release  │    │ Deploy   │
│ commit   │───▶│ Stage    │───▶│ Stage    │───▶│ Stage    │───▶│ Stage    │
└──────────┘    └──────────┘    └──────────┘    └──────────┘    └──────────┘
│ Secrets  │    │ SAST     │    │ DAST     │    │ SBOM     │    │ Runtime  │
│ Linting  │    │ SCA      │    │ Pentest  │    │ Signing  │    │ Monitor  │
│ IaC scan │    │ Container│    │ Fuzz     │    │ SLSA     │    │ WAF      │
│          │    │ scan     │    │          │    │ Attest   │    │ RASP     │
```

### 2. GitHub Actions Security Pipeline

```yaml
name: Security Pipeline
on: [pull_request]

jobs:
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            p/cwe-top-25

  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run OSV-Scanner
        uses: google/osv-scanner-action/osv-scanner-action@v1
        with:
          scan-args: |-
            --recursive .

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t app:${{ github.sha }} .
      - name: Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'app:${{ github.sha }}'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'

  iac-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
```

### 3. Secrets Detection

```bash
# Pre-commit hook (gitleaks)
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

# Scan entire repository history
gitleaks detect --source . --verbose --report-format json --report-path gitleaks-report.json

# TruffleHog (finds verified secrets)
trufflehog git file://. --only-verified --json

# Remediation when secrets found:
# 1. Rotate the exposed credential IMMEDIATELY
# 2. Remove from git history: git filter-branch or BFG Repo-Cleaner
# 3. Add to .gitignore / gitleaks.toml allowlist (after rotation)
# 4. Never hardcode secrets — use env vars, vault, or sealed secrets
```

### 4. SBOM & Supply Chain (SLSA)

```bash
# Generate SBOM with Syft
syft packages dir:. -o spdx-json > sbom.spdx.json
syft packages docker:app:latest -o cyclonedx-json > sbom.cdx.json

# Verify SBOM against known vulnerabilities
grype sbom:sbom.spdx.json --only-fixed

# SLSA provenance generation (GitHub Actions)
# Uses SLSA GitHub Generator
- uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
  with:
    base64-subjects: "${{ needs.build.outputs.digest }}"

# Sigstore signing (container images)
cosign sign --key cosign.key app:latest
cosign verify --key cosign.pub app:latest

# SLSA levels:
# Level 1: Provenance exists (automated build)
# Level 2: Hosted build platform, signed provenance
# Level 3: Hardened build platform, non-falsifiable provenance
# Level 4: Two-person review, hermetic/reproducible build
```

### 5. Quality Gates

```
Gate definitions (fail pipeline if any gate fails):

SAST Gate:
  - Zero critical/high findings
  - No SQL injection, command injection, or path traversal
  - Custom rules for project-specific patterns

SCA Gate:
  - Zero critical CVEs in direct dependencies
  - Zero high CVEs without accepted risk ticket
  - No dependencies with known malicious packages
  - License compliance (no GPL in proprietary projects)

Secrets Gate:
  - Zero detected secrets (no exceptions)

Container Gate:
  - Zero critical CVEs in base image
  - Non-root user in Dockerfile
  - No secrets in environment variables or layers

IaC Gate:
  - No public S3 buckets, security groups with 0.0.0.0/0
  - Encryption at rest enabled for all storage
  - Logging enabled for all services
```

## Verification

- [ ] Pre-commit hooks installed (secrets, linting)
- [ ] SAST running on every PR (Semgrep/CodeQL)
- [ ] SCA scanning with automatic PR creation for CVEs
- [ ] Container images scanned before registry push
- [ ] IaC templates scanned before apply
- [ ] SBOM generated for every release
- [ ] Quality gates defined and enforced (pipeline fails on violations)
- [ ] Secrets detection scanning full git history
