devsecops-pipeline

What this skill does

Assesses the current CI/CD pipeline security maturity across 8 stages (Plan → Code → Build → Test → Release → Deploy → Operate → Monitor), identifies gaps, and produces ready-to-use GitHub Actions workflow configurations, security gate policy definitions, and a phased implementation roadmap.

When to use

• When adding security controls to an existing CI/CD pipeline
• When setting up a new pipeline that needs built-in security from the start
• When preparing for a DevSecOps maturity assessment or audit
• When standardizing security tooling across multiple teams or repositories

Prerequisites

Tools are referenced per stage; install only what applies to your stack:

• SAST: semgrep (free), CodeQL (GitHub-native), SonarQube (self-hosted or cloud)
• SCA: snyk CLI, trivy, Dependabot (GitHub-native)
• Secrets scanning: gitleaks
• IaC scanning: checkov, tfsec
• Container scanning: trivy, grype + syft
• DAST: zaproxy (OWASP ZAP), nuclei
• SBOM: syft (CycloneDX/SPDX output), cosign (artifact signing)
• Runtime: Falco (Kubernetes), CSPM tool (AWS Security Hub, GCP SCC, etc.)

# Install core tools (Debian/Ubuntu)
pip install semgrep checkov
brew install gitleaks trivy grype syft cosign nuclei  # macOS
# Or: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh

Inputs

Variable	Required	Description
SECSKILL_REPO_PATH	Required	Path to the repository root
SECSKILL_CI_PLATFORM	Optional	github or gitlab (default: github)
SECSKILL_OUTPUT_DIR	Optional	Output directory (default: ./devsecops-output)
SECSKILL_REGISTRY	Optional	Container registry URL for image scanning
SECSKILL_IMAGE_NAME	Optional	Container image name:tag to scan

Workflow

Step 1: Assess current pipeline maturity

export REPO="${SECSKILL_REPO_PATH:?Set SECSKILL_REPO_PATH}"
export CI_PLATFORM="${SECSKILL_CI_PLATFORM:-github}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./devsecops-output}"
mkdir -p "$OUTDIR"

MATURITY_FILE="$OUTDIR/maturity_assessment.txt"
echo "DevSecOps Pipeline Maturity Assessment" > "$MATURITY_FILE"
echo "Repo    : $REPO" >> "$MATURITY_FILE"
echo "Platform: $CI_PLATFORM" >> "$MATURITY_FILE"
echo "Date    : $(date -u '+%Y-%m-%dT%H:%M:%SZ')" >> "$MATURITY_FILE"
echo "" >> "$MATURITY_FILE"

echo "[*] Detecting existing pipeline files..."

# Detect CI config presence
GITHUB_WORKFLOWS="$REPO/.github/workflows"
GITLAB_CI="$REPO/.gitlab-ci.yml"
HAS_GITHUB_ACTIONS=false
HAS_GITLAB_CI=false
[ -d "$GITHUB_WORKFLOWS" ] && HAS_GITHUB_ACTIONS=true && echo "[+] GitHub Actions workflows found"
[ -f "$GITLAB_CI" ] && HAS_GITLAB_CI=true && echo "[+] GitLab CI config found"

# Detect existing security tools in CI configs
check_tool_in_ci() {
  local tool="$1"
  if [ "$HAS_GITHUB_ACTIONS" = "true" ]; then
    grep -rl "$tool" "$GITHUB_WORKFLOWS" >/dev/null 2>&1 && echo "present" || echo "absent"
  elif [ "$HAS_GITLAB_CI" = "true" ]; then
    grep -q "$tool" "$GITLAB_CI" 2>/dev/null && echo "present" || echo "absent"
  else
    echo "no-ci"
  fi
}

echo "" >> "$MATURITY_FILE"
echo "Stage Coverage:" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "Pre-commit hooks (gitleaks):" "$(check_tool_in_ci gitleaks)" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "SAST (semgrep/codeql):" "$(check_tool_in_ci semgrep; check_tool_in_ci codeql | tail -1)" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "SCA (snyk/trivy):" "$(check_tool_in_ci snyk; check_tool_in_ci trivy | tail -1)" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "IaC scanning (checkov/tfsec):" "$(check_tool_in_ci checkov; check_tool_in_ci tfsec | tail -1)" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "Container scan (trivy/grype):" "$(check_tool_in_ci grype)" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "DAST (zap/nuclei):" "$(check_tool_in_ci zap; check_tool_in_ci nuclei | tail -1)" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "SBOM generation (syft):" "$(check_tool_in_ci syft)" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "Artifact signing (cosign):" "$(check_tool_in_ci cosign)" >> "$MATURITY_FILE"
printf "  %-30s %s\n" "Runtime monitoring (falco):" "$(check_tool_in_ci falco)" >> "$MATURITY_FILE"

cat "$MATURITY_FILE"