DEVSECOPS
Automated Security Gate Pipeline
Overview
What this project is.
End-to-end GitHub Actions CI/CD pipeline with four parallel security scanning stages — SAST via Semgrep with custom rule packs, container image SCA via Trivy, infrastructure-as-code validation via Checkov against CIS benchmarks, and DAST baseline scan via OWASP ZAP. PRs with CRITICAL or HIGH findings are automatically blocked.
Problem
Why this matters.
Vulnerabilities found in production are 10x more expensive to fix. This pipeline catches them at commit time.
Architecture
How it's built.
- GitHub Actions workflow with 4 parallel security scan stages
- SAST: Semgrep with custom rule packs for OWASP Top 10
- SCA: Trivy for container image and dependency vulnerabilities
- IaC: Checkov against CIS benchmarks
- DAST: OWASP ZAP baseline scan against running application
- Quality gate: PR blocked on CRITICAL or HIGH findings
Tools
Tech stack.
GitHub ActionsSemgrepTrivyCheckovOWASP ZAP
Impact
Results.
Shift-left security — vulnerabilities caught at commit, not in production
Presentation
How to showcase this.
Show pipeline diagram. Include screenshot of blocked PR. Link to GitHub Actions YAML.