ci-security-patterns

CI Security Patterns

Reference patterns for integrating security scanning into GitHub Actions, GitLab CI, and Jenkins pipelines with real workflow syntax and production-ready configurations.

Knowledge Base

Pipeline Security Stage Ordering

Security scans should be ordered by speed and cost. Fast checks run first so slow checks only run on code that passes basic hygiene.

Pre-commit (local) --> Secrets + Lint
     |
Commit/PR (CI) --> Secrets --> SAST --> SCA --> License
     |
Build (CI) --> Container Scan --> SBOM --> Sign
     |
Test (CI) --> DAST (baseline) --> API Scan
     |
Deploy (CI) --> IaC Scan --> Artifact Verification
     |
Runtime (CD) --> Monitoring --> Runtime Protection

Key Design Decisions

Scan-on-PR vs. Scan-on-Push: Run fast scans (SAST, secrets, SCA) on every PR. Run slower scans (DAST, full container scan) on merge to main or on a schedule.

Incremental vs. Full Scan: On PRs, scan only changed files (incremental) for speed. On main branch, run full scans. This is critical for SAST where full-project scans can take minutes.

Fail-open vs. Fail-closed on tool error: If the scanner itself crashes (not a finding, but the tool failing), should the pipeline pass or fail? Default: fail-open on PR (do not block development due to tool issues), fail-closed on deploy to production.

Patterns

Pattern 1: GitHub Actions -- Comprehensive Security Pipeline

name: Security Pipeline
on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]
  schedule:
    - cron: '0 4 * * 1'  # Full scan weekly

permissions:
  contents: read
  security-events: write  # Required for SARIF upload
  pull-requests: write     # Required for PR comments

jobs:
  # Stage 1: Fast checks (< 1 minute)
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for gitleaks
      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # Stage 2: SAST (1-5 minutes)
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        uses: semgrep/semgrep-action@v1
        with:
          config: >-
            p/default
            p/owasp-top-ten
            p/r2c-security-audit
          generateSarif: "1"
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

  # Stage 3: SCA (1-3 minutes)
  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run osv-scanner
        uses: google/osv-scanner-action/osv-scanner-action@v1
        with:
          scan-args: |-
            --recursive
            --format=sarif
            --output=osv-results.sarif
            .
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: osv-results.sarif

  # Stage 4: Container scan (if Dockerfile exists)
  container-scan:
    runs-on: ubuntu-latest
    if: hashFiles('**/Dockerfile') != ''
    needs: [secrets-scan, sast]  # Only if earlier stages pass
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t ${{ github.repository }}:${{ github.sha }} .
      - name: Run Trivy
        uses: aquasecurity/[email protected]
        with:
          image-ref: ${{ github.repository }}:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1  # Fail on critical/high
      - name: Upload SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

  # Stage 5: IaC scan (if terraform/cloudformation present)
  iac-scan:
    runs-on: ubuntu-latest
    if: hashFiles('**/*.tf') != '' || hashFiles('**/cloudformation/**') != ''
    steps:
      - uses: actions/checkout@v4
      - name: Run Checkov
        uses: bridgecrewio/checkov-action@v12
        with:
          output_format: sarif
          output_file_path: checkov-results.sarif
          soft_fail: false
          framework: terraform,cloudformation

  # Stage 6: SBOM generation (on main branch only)
  sbom:
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    needs: [sast, dependency-scan]
    steps:
      - uses: actions/checkout@v4
      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          output-file: sbom.cdx.json
      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.cdx.json