82.5 Project 89: DevSecOps pipeline (SAST, dependency scan, image scan)
Friends, security late is expensive. Today we add SAST, a dependency scan, and an image scan to the pipeline, and fail the build on high findings.
मित्रांनो, उशिरा security महाग. आज pipeline मध्ये SAST, dependency scan, image scan, आणि high findings वर build fail.
दोस्तों, देर से security महंगा. आज pipeline में SAST, dependency scan, image scan, और high findings पर build fail.
What you will build in this project
- Add a SAST step.
- Scan dependencies.
- Scan the container image.
- Fail the job on HIGH/CRITICAL.
1. Start from a real company story
At Zoho in Chennai, a known CVE shipped in a base image and customers asked hard questions the next week.
Rough cost: about ₹35 lakh in emergency patching and reviews.
Arjun gated every merge on SAST plus Trivy image scan.
Today we build that gate.
Ravindra Bagale's Tip
Students set severity to only CRITICAL so HIGH slips through. Start with HIGH and CRITICAL. Keep that habit.
Students फक्त CRITICAL ठेवतात म्हणून HIGH निसटते. HIGH आणि CRITICAL पासून सुरू करा. सवय ठेवा.
Students सिर्फ CRITICAL रखते हैं इसलिए HIGH निकल जाता है. HIGH और CRITICAL से शुरू करें. आदत रखिए.
2. Start and prepare
Step 1: Why DevSecOps
Why: Late fixes cost more. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 1: a1
Type this:
echo 'Find issues on the pull request, not in production'
You will see:
Find issues on the pull request, not in production
What it means: Why.
Example 2: a2
Type this:
mkdir -p /tmp/sec89 && echo 'Today: SAST, deps, image, gate'
You will see:
Today: SAST, deps, image, gate
What it means: Scope.
Example 3: a3
Type this:
echo 'Three layers catch different bug classes'
You will see:
Three layers catch different bug classes
What it means: Layers.
Step 2: SAST
Why: Static rules on code. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: sast. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 4: b1
Type this:
printf '%s\n' 'Example tools: Semgrep, SonarQube, CodeQL' 'Run on every pull request' 'Block on new HIGH findings' > /tmp/sec89/SAST.txt && cat /tmp/sec89/SAST.txt
You will see:
Block on new HIGH findings
What it means: SAST.
Example 5: b2
Type this:
echo 'semgrep --config auto --error --severity-text'
You will see:
semgrep --config auto --error --severity-text
What it means: Semgrep.
Example 6: b3
Type this:
echo 'Keep a small allowlist with ticket links, not a silent skip'
You will see:
Keep a small allowlist with ticket links, not a silent skip
What it means: Allowlist.
Step 3: Dependency scan
Why: Lockfile CVEs. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: deps. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 7: c1
Type this:
printf '%s\n' 'npm audit --audit-level=high' 'pip-audit -r requirements.txt' 'mvn org.owasp:dependency-check-maven:check' > /tmp/sec89/DEPS.txt && cat /tmp/sec89/DEPS.txt
You will see:
npm audit --audit-level=high
What it means: Deps.
Example 8: c2
Type this:
echo 'Fail the job when HIGH or CRITICAL appear in direct deps first'
You will see:
Fail the job when HIGH or CRITICAL appear in direct deps first
What it means: Gate.
Example 9: c3
Type this:
echo 'Upgrade the lockfile in the same PR that fixes the finding'
You will see:
Upgrade the lockfile in the same PR that fixes the finding
What it means: Fix.
3. Build the main pieces
Step 4: Image scan
Why: Trivy. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: image. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 10: d1
Type this:
echo 'trivy image --severity HIGH,CRITICAL --exit-code 1 registry.example.com/shop/api:SHA'
You will see:
trivy image --severity HIGH,CRITICAL --exit-code 1 registry.example.com/shop/api:SHA
What it means: Trivy.
Example 11: d2
Type this:
echo 'Scan before push so bad images never land in the registry'
You will see:
Scan before push so bad images never land in the registry
What it means: Before push.
Example 12: d3
Type this:
echo 'Pin base images by digest to make scans reproducible'
You will see:
Pin base images by digest to make scans reproducible
What it means: Digest.
Step 5: Pipeline YAML
Why: Wire the gates. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: yaml. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 13: e1
Type this:
printf '%s\n' 'stages: [sast, deps, build, image-scan]' 'image_scan:' ' stage: image-scan' ' script:' ' - trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE' > /tmp/sec89/PIPE.txt && cat /tmp/sec89/PIPE.txt
You will see:
- trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE
What it means: Pipe.
Example 14: e2
Type this:
echo 'Order: SAST and deps before build; image scan after build'
You will see:
Order: SAST and deps before build; image scan after build
What it means: Order.
Example 15: e3
Type this:
printf '%s\n' 'Acceptance: a known HIGH in the demo image fails image-scan' > /tmp/sec89/ACCEPT.txt && cat /tmp/sec89/ACCEPT.txt
You will see:
Acceptance: a known HIGH in the demo image fails image-scan
What it means: Gate.
Step 6: Severity policy
Why: What fails. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: policy. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 16: f1
Type this:
printf '%s\n' 'Block: CRITICAL and HIGH' 'Warn: MEDIUM (ticket within 14 days)' 'Info: LOW' > /tmp/sec89/SEV.txt && cat /tmp/sec89/SEV.txt
You will see:
Block: CRITICAL and HIGH
What it means: Sev.
Example 17: f2
Type this:
echo 'Waivers need an owner, expiry date, and ticket id'
You will see:
Waivers need an owner, expiry date, and ticket id
What it means: Waiver.
Example 18: f3
Type this:
echo 'Never set exit-code 0 permanently to silence noise'
You will see:
Never set exit-code 0 permanently to silence noise
What it means: No mute.
4. Automate and verify
Step 7: Fix loop
Why: Developer path. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: fix. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 19: g1
Type this:
printf '%s\n' '1. Read the finding URL' '2. Upgrade or rewrite' '3. Re-run the job' '4. Merge when green' > /tmp/sec89/FIX.txt && cat /tmp/sec89/FIX.txt
You will see:
4. Merge when green
What it means: Fix.
Example 20: g2
Type this:
echo 'Security champions help teams triage false positives'
You will see:
Security champions help teams triage false positives
What it means: Champions.
Example 21: g3
Type this:
echo 'Track mean time to remediate HIGH findings'
You will see:
Track mean time to remediate HIGH findings
What it means: Metric.
Step 8: Secrets scan
Why: Bonus gate. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: secrets. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 22: h1
Type this:
echo 'Add gitleaks or trufflehog on the pull request'
You will see:
Add gitleaks or trufflehog on the pull request
What it means: Secrets.
Example 23: h2
Type this:
echo 'Block commits that contain AWS keys or private keys'
You will see:
Block commits that contain AWS keys or private keys
What it means: Block.
Example 24: h3
Type this:
echo 'Rotate any secret that ever touched git history'
You will see:
Rotate any secret that ever touched git history
What it means: Rotate.
Step 9: Report
Why: Show evidence. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: report. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 25: i1
Type this:
printf '%s\n' 'Publish SARIF or HTML reports as job artifacts' 'Link the report in the PR check summary' > /tmp/sec89/REPORT.txt && cat /tmp/sec89/REPORT.txt
You will see:
Publish SARIF or HTML reports as job artifacts
What it means: Report.
Example 26: i2
Type this:
echo 'Keep 30 days of scan artifacts for audits'
You will see:
Keep 30 days of scan artifacts for audits
What it means: Retain.
Example 27: i3
Type this:
echo 'Dashboard: open HIGH count by service'
You will see:
Dashboard: open HIGH count by service
What it means: Dash.
5. Harden and accept
Step 10: Story Zoho
Why: CVE in base image. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 28: j1
Type this:
printf '%s\n' 'At Zoho in Chennai, a known CVE shipped in a base image.' 'Arjun gated every merge on SAST plus Trivy.' > /tmp/sec89/STORY.txt && wc -l /tmp/sec89/STORY.txt
You will see:
2 /tmp/sec89/STORY.txt
What it means: Story.
Example 29: j2
Type this:
echo 'Rough cost: about ₹35 lakh in emergency patching and reviews'
You will see:
Rough cost: about ₹35 lakh in emergency patching and reviews
What it means: Cost.
Example 30: j3
Type this:
echo 'Arjun: PASS'
You will see:
Arjun: PASS
What it means: Sign-off.
Step 11: Proof
Why: Files. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 31: k1
Type this:
ls /tmp/sec89
You will see:
ACCEPT.txt\nDEPS.txt\nFIX.txt\nPIPE.txt\nREPORT.txt\nSAST.txt\nSEV.txt\nSTORY.txt
What it means: Tree.
Example 32: k2
Type this:
grep exit-code /tmp/sec89/PIPE.txt
You will see:
- trivy image --exit-code 1 --severity HIGH,CRITICAL $IMAGE
What it means: Exit.
Example 33: k3
Type this:
echo 'Next: Policy as code OPA/Kyverno project 90'
You will see:
Next: Policy as code OPA/Kyverno project 90
What it means: Bridge.
Step 12: Acceptance
Why: HIGH fails the pipeline. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.
What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.
Example 34: z1
Type this:
echo 'SAST runs on PR'
You will see:
SAST runs on PR
What it means: SAST.
Example 35: z2
Type this:
echo 'Deps and image scanned'
You will see:
Deps and image scanned
What it means: Scan.
Example 36: z3
Type this:
echo 'HIGH fails the job'
You will see:
HIGH fails the job
What it means: Gate.
Check yourself
Q1. Who fixed Zoho CVE ship?
Arjun
Q2. Code scan?
SAST
Q3. Image tool?
Trivy
Q4. Fail on?
HIGH
Q5. Silent ignore?
no
Q6. When?
every merge
Friends, you gated a build on security scans. Did you understand? Let us try it once more. Introduce a known HIGH finding in a demo image and prove the job fails.
मित्रांनो, तुम्ही security scans वर build gate केले. Demo image मध्ये known HIGH आणा आणि job fail होते हे सिद्ध करा.
दोस्तों, आपने security scans पर build gate किया. Demo image में known HIGH लाएं और job fail हो, यह साबित करें.
Lab: try at home
- SAST step.
- Dependency scan.
- Image scan.
- HIGH fails the job.
Recap
- Shift left.
- Three scan layers.
- Fail on HIGH.
- Fix or waive with ticket.
- No silent ignore.