How girish1818/devsecops-project1 works
This repository combines a documented GitHub Actions security pipeline with a vulnerable Flask demonstration app and Kubernetes runtime-security/SOAR components. The principal workflow scans code, dependencies, secrets, and infrastructure; gates deployment; then builds and pushes an image to ECR. At runtime, the app obtains its secret and serves requests, while Falco alert handling can isolate pods and notify responders. Pipeline details are documented in the README, but the workflow source was not sampled; runtime links are included only where supported by sampled code or explicit documentation.
Main entry points: security-pipeline.yml GitHub Actions · deployment.yaml Kubernetes deployment · soar_falco_playbook.py Falco SOAR webhook · app.py Flask app
Components 26
CI security pipeline
- GitHub Actions
.github/workflows/security-pipeline.yml - Deploy gate
.github/workflows/security-pipeline.yml - Image build
Dockerfile - AWS ECR
Security scanning
- Semgrep SAST
rules/custom.yaml - Trivy scan
trivy-check.py - Gitleaks
.gitleaks.toml - Checkov IaC
terraform/main.tf
Demo application
- Flask app
app/app.py - SQLite user data
app/app.py - Secret sources
app/app.py - Vault-injected secret
- AWS Secrets Manager
Runtime security
- Kubernetes deployment
k8s/deployment.yaml - Falco rules
k8s/falco/custom-rules.yaml - Admission policies
k8s/gatekeeper/approved-registries-constraint.yaml - Network policies
k8s/network-policy-isolate.yaml - Kubernetes API
Ingestion and response
- Semgrep ingestion
splunk/ingest_semgrep.py - Trivy ingestion
splunk/ingest_trivy.py - Splunk HEC
- Falco SOAR webhook
splunk/soar_falco_playbook.py - CVE SOAR
splunk/soar_playbook.py - Splunk On-Call
- GitHub Issues
Other components
- Developer
Connections 27
- Developer → GitHub Actions: pushes code
- GitHub Actions → Semgrep SAST: runs SAST
- GitHub Actions → Trivy scan: runs SCA
- GitHub Actions → Gitleaks: scans secrets
- GitHub Actions → Checkov IaC: scans IaC
- Semgrep SAST → Deploy gate: reports findings
- Trivy scan → Deploy gate: blocks criticals
- Gitleaks → Deploy gate: reports status
- Checkov IaC → Deploy gate: reports status
- Deploy gate → Image build: permits build
- Image build → AWS ECR: pushes image
- GitHub Actions → Kubernetes deployment: deploys image
- Kubernetes deployment → Flask app: runs
- Flask app → SQLite user data: queries users
- Flask app → Secret sources: loads secret
- Secret sources → Vault-injected secret: reads file
- Secret sources → AWS Secrets Manager: fetches fallback
- Falco rules → Kubernetes deployment: monitors runtime
- Admission policies → Kubernetes deployment: constrains admission
- Falco SOAR webhook → Kubernetes API: patches pod
- Kubernetes API → Network policies: applies quarantine
- Falco SOAR webhook → Splunk On-Call: pages alert
- Falco SOAR webhook → GitHub Issues: creates incident
- Semgrep ingestion → Splunk HEC: sends findings
- Trivy ingestion → Splunk HEC: sends vulnerabilities
- CVE SOAR → Splunk On-Call: pages CVE
- CVE SOAR → GitHub Issues: creates issue