Integrating Security Scanning into Your CI/CD Pipeline

Code → SAST → Build → Image Scan → Manifest Scan → Deploy → Runtime

# GitHub Actions example
- name: Run Semgrep
  uses: returntocorp/semgrep-action@v1
  with:
    config: >-
      p/security-audit
      p/secrets

- name: Detect secrets
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Scan image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE }}:${{ github.sha }}'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'
    exit-code: '1'

- name: Scan with Grype
  uses: anchore/scan-action@v3
  with:
    image: '${{ env.IMAGE }}'
    fail-build: true
    severity-cutoff: high

- name: Scan manifests
  run: |
    kubesec scan deployment.yaml
    if [ $? -ne 0 ]; then exit 1; fi

- name: Run Checkov
  uses: bridgecrewio/checkov-action@master
  with:
    directory: ./kubernetes
    framework: kubernetes
    soft_fail: false

- name: Lint Kubernetes manifests
  uses: stackrox/kube-linter-action@v1
  with:
    directory: ./manifests

- name: Scan Terraform
  uses: aquasecurity/tfsec-action@v1.0.0
  with:
    soft_fail: true

name: Security Pipeline

on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Secret detection
        uses: gitleaks/gitleaks-action@v2

      - name: SAST scan
        uses: returntocorp/semgrep-action@v1

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Scan image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

      - name: Scan manifests
        uses: stackrox/kube-linter-action@v1

      - name: Sign image
        run: cosign sign --key cosign.key myapp:${{ github.sha }}