# aryasundaresh1/blockchain-devsecops architecture

> Architecture diagram of the GitHub repository aryasundaresh1/blockchain-devsecops, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/aryasundaresh1/blockchain-devsecops
- Repository: https://github.com/aryasundaresh1/blockchain-devsecops

## Overview

This is an incrementally developed DevSecOps enforcement framework: its intended workflow runs a CI/CD pipeline, performs security scans, makes a severity-based decision, records an audit event, and deploys only when allowed. The current implementation includes a Flask application and a standalone decision engine; scanning integrations, blockchain logging, and deployment enforcement are largely planned. The workflow edges reflect the README’s documented design, not verified runtime wiring.

Main entry points: [`security/decision_engine.py`](https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/security/decision_engine.py) (Security decision engine), [`Jenkinsfile`](https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/Jenkinsfile) (Jenkins pipeline), [`application/app.py`](https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/application/app.py) (Flask application)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_pipeline["CI/CD pipeline"]
  node_jenkins["Jenkins pipeline"]
  node_buildtest["Build and test"]
end

subgraph group_security["Security checks"]
  node_scanning["Security scanning"]
  node_sast["SAST · Semgrep"]
  node_sca["SCA · planned"]
  node_secrets["Secret detection · Gitleaks"]
  node_configscan["Config scan · planned"]
  node_findings["Scan findings"]
  node_decision["Security decision engine<br/>[decision_engine.py]"]
end

subgraph group_outcomes["Audit and deployment"]
  node_block["Block deployment"]
  node_allow["Allow pipeline"]
  node_blockchain[("Blockchain audit · planned")]
  node_deploy["Deployment · planned"]
  node_application["Flask application<br/>[app.py]"]
end

node_github(("GitHub repository"))

node_github -->|"triggers pipeline"| node_jenkins
node_jenkins -->|"runs build and tests"| node_buildtest
node_buildtest -->|"starts after success"| node_scanning
node_scanning -->|"includes"| node_sast
node_scanning -->|"planned check"| node_sca
node_scanning -->|"includes"| node_secrets
node_scanning -->|"planned check"| node_configscan
node_scanning -->|"produces results"| node_findings
node_findings -->|"supplies results"| node_decision
node_decision -->|"blocks on high severity"| node_block
node_decision -->|"continues if clear"| node_allow
node_allow -->|"records decision"| node_blockchain
node_blockchain -->|"logs before deployment"| node_deploy
node_deploy -->|"deploys application"| node_application

click node_jenkins "https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/Jenkinsfile"
click node_buildtest "https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/Jenkinsfile"
click node_decision "https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/security/decision_engine.py"
click node_application "https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/application/app.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_jenkins,node_buildtest toneBlue
class node_scanning,node_sast,node_sca,node_secrets,node_configscan,node_findings,node_decision toneAmber
class node_block,node_allow,node_blockchain,node_deploy,node_application toneMint
class node_github toneIndigo
```

## Components

### CI/CD pipeline

- [Jenkins pipeline](https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/Jenkinsfile): `Jenkinsfile`
- [Build and test](https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/Jenkinsfile): `Jenkinsfile`

### Security checks

- **Security scanning**
- **SAST · Semgrep**
- **SCA · planned**
- **Secret detection · Gitleaks**
- **Config scan · planned**
- **Scan findings**
- [Security decision engine](https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/security/decision_engine.py): `security/decision_engine.py`

### Audit and deployment

- **Block deployment**
- **Allow pipeline**
- **Blockchain audit · planned**
- **Deployment · planned**
- [Flask application](https://github.com/aryasundaresh1/blockchain-devsecops/blob/main/application/app.py): `application/app.py`

### Other components

- **GitHub repository**

## Connections

- GitHub repository → Jenkins pipeline: triggers pipeline (evidence: `README.md`)
- Jenkins pipeline → Build and test: runs build and tests (evidence: `README.md`)
- Build and test → Security scanning: starts after success (evidence: `README.md`)
- Security scanning → SAST · Semgrep: includes (evidence: `README.md`)
- Security scanning → SCA · planned: planned check (evidence: `README.md`)
- Security scanning → Secret detection · Gitleaks: includes (evidence: `README.md`)
- Security scanning → Config scan · planned: planned check (evidence: `README.md`)
- Security scanning → Scan findings: produces results (evidence: `README.md`)
- Scan findings → Security decision engine: supplies results (evidence: `README.md`)
- Security decision engine → Block deployment: blocks on high severity (evidence: `README.md`)
- Security decision engine → Allow pipeline: continues if clear (evidence: `README.md`)
- Allow pipeline → Blockchain audit · planned: records decision (evidence: `README.md`)
- Blockchain audit · planned → Deployment · planned: logs before deployment (evidence: `README.md`)
- Deployment · planned → Flask application: deploys application (evidence: `README.md`)