# girish1818/devsecops-project1 architecture

> Architecture diagram of the GitHub repository girish1818/devsecops-project1, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/girish1818/devsecops-project1
- Repository: https://github.com/girish1818/devsecops-project1

## Overview

This repository combines a documented GitHub Actions security pipeline with a vulnerable Flask demonstration app and Kubernetes runtime-security/SOAR components. The principal workflow scans code, dependencies, secrets, and infrastructure; gates deployment; then builds and pushes an image to ECR. At runtime, the app obtains its secret and serves requests, while Falco alert handling can isolate pods and notify responders. Pipeline details are documented in the README, but the workflow source was not sampled; runtime links are included only where supported by sampled code or explicit documentation.

Main entry points: [`.github/workflows/security-pipeline.yml`](https://github.com/girish1818/devsecops-project1/blob/main/.github/workflows/security-pipeline.yml) (GitHub Actions), [`k8s/deployment.yaml`](https://github.com/girish1818/devsecops-project1/blob/main/k8s/deployment.yaml) (Kubernetes deployment), [`splunk/soar_falco_playbook.py`](https://github.com/girish1818/devsecops-project1/blob/main/splunk/soar_falco_playbook.py) (Falco SOAR webhook), [`app/app.py`](https://github.com/girish1818/devsecops-project1/blob/main/app/app.py) (Flask app)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_pipeline["CI security pipeline"]
  node_workflow["GitHub Actions"]
  node_deploygate{{"Deploy gate"}}
  node_docker["Image build"]
  node_ecr[("AWS ECR")]
end

subgraph group_scanning["Security scanning"]
  node_semgrep["Semgrep SAST<br/>[custom.yaml]"]
  node_trivy["Trivy scan<br/>[trivy-check.py]"]
  node_gitleaks["Gitleaks<br/>[.gitleaks.toml]"]
  node_checkov["Checkov IaC<br/>[main.tf]"]
end

subgraph group_application["Demo application"]
  node_flask["Flask app<br/>[app.py]"]
  node_sqlite[("SQLite user data<br/>[app.py]")]
  node_secretprovider["Secret sources<br/>[app.py]"]
  node_vault[("Vault-injected secret")]
  node_secretsmanager[("AWS Secrets Manager")]
end

subgraph group_runtime["Runtime security"]
  node_k8sdeploy["Kubernetes deployment<br/>[deployment.yaml]"]
  node_falco["Falco rules<br/>[custom-rules.yaml]"]
  node_gatekeeper["Admission policies"]
  node_networkpolicy["Network policies"]
  node_kubernetes["Kubernetes API"]
end

subgraph group_response["Ingestion and response"]
  node_semgrepingest["Semgrep ingestion<br/>[ingest_semgrep.py]"]
  node_trivy_ingest["Trivy ingestion<br/>[ingest_trivy.py]"]
  node_splunk[("Splunk HEC")]
  node_falco_playbook["Falco SOAR webhook"]
  node_trivy_playbook["CVE SOAR<br/>[soar_playbook.py]"]
  node_oncall["Splunk On-Call"]
  node_githubissues["GitHub Issues"]
end

node_developer(("Developer"))

node_developer -->|"pushes code"| node_workflow
node_workflow -->|"runs SAST"| node_semgrep
node_workflow -->|"runs SCA"| node_trivy
node_workflow -->|"scans secrets"| node_gitleaks
node_workflow -->|"scans IaC"| node_checkov
node_semgrep -->|"reports findings"| node_deploygate
node_trivy -->|"blocks criticals"| node_deploygate
node_gitleaks -->|"reports status"| node_deploygate
node_checkov -->|"reports status"| node_deploygate
node_deploygate -->|"permits build"| node_docker
node_docker -->|"pushes image"| node_ecr
node_workflow -.->|"deploys image"| node_k8sdeploy
node_k8sdeploy -->|"runs"| node_flask
node_flask -->|"queries users"| node_sqlite
node_flask -->|"loads secret"| node_secretprovider
node_secretprovider -->|"reads file"| node_vault
node_secretprovider -->|"fetches fallback"| node_secretsmanager
node_falco -->|"monitors runtime"| node_k8sdeploy
node_gatekeeper -->|"constrains admission"| node_k8sdeploy
node_falco_playbook -->|"patches pod"| node_kubernetes
node_kubernetes -->|"applies quarantine"| node_networkpolicy
node_falco_playbook -->|"pages alert"| node_oncall
node_falco_playbook -->|"creates incident"| node_githubissues
node_semgrepingest -->|"sends findings"| node_splunk
node_trivy_ingest -->|"sends vulnerabilities"| node_splunk
node_trivy_playbook -->|"pages CVE"| node_oncall
node_trivy_playbook -->|"creates issue"| node_githubissues

click node_workflow "https://github.com/girish1818/devsecops-project1/blob/main/.github/workflows/security-pipeline.yml"
click node_deploygate "https://github.com/girish1818/devsecops-project1/blob/main/.github/workflows/security-pipeline.yml"
click node_docker "https://github.com/girish1818/devsecops-project1/blob/main/Dockerfile"
click node_semgrep "https://github.com/girish1818/devsecops-project1/blob/main/rules/custom.yaml"
click node_trivy "https://github.com/girish1818/devsecops-project1/blob/main/trivy-check.py"
click node_gitleaks "https://github.com/girish1818/devsecops-project1/blob/main/.gitleaks.toml"
click node_checkov "https://github.com/girish1818/devsecops-project1/blob/main/terraform/main.tf"
click node_flask "https://github.com/girish1818/devsecops-project1/blob/main/app/app.py"
click node_sqlite "https://github.com/girish1818/devsecops-project1/blob/main/app/app.py"
click node_secretprovider "https://github.com/girish1818/devsecops-project1/blob/main/app/app.py"
click node_k8sdeploy "https://github.com/girish1818/devsecops-project1/blob/main/k8s/deployment.yaml"
click node_falco "https://github.com/girish1818/devsecops-project1/blob/main/k8s/falco/custom-rules.yaml"
click node_gatekeeper "https://github.com/girish1818/devsecops-project1/blob/main/k8s/gatekeeper/approved-registries-constraint.yaml"
click node_networkpolicy "https://github.com/girish1818/devsecops-project1/blob/main/k8s/network-policy-isolate.yaml"
click node_semgrepingest "https://github.com/girish1818/devsecops-project1/blob/main/splunk/ingest_semgrep.py"
click node_trivy_ingest "https://github.com/girish1818/devsecops-project1/blob/main/splunk/ingest_trivy.py"
click node_falco_playbook "https://github.com/girish1818/devsecops-project1/blob/main/splunk/soar_falco_playbook.py"
click node_trivy_playbook "https://github.com/girish1818/devsecops-project1/blob/main/splunk/soar_playbook.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_workflow,node_deploygate,node_docker,node_ecr toneBlue
class node_semgrep,node_trivy,node_gitleaks,node_checkov toneAmber
class node_flask,node_sqlite,node_secretprovider,node_vault,node_secretsmanager toneMint
class node_k8sdeploy,node_falco,node_gatekeeper,node_networkpolicy,node_kubernetes toneRose
class node_semgrepingest,node_trivy_ingest,node_splunk,node_falco_playbook,node_trivy_playbook,node_oncall,node_githubissues,node_developer toneIndigo
```

## Components

### CI security pipeline

- [GitHub Actions](https://github.com/girish1818/devsecops-project1/blob/main/.github/workflows/security-pipeline.yml): `.github/workflows/security-pipeline.yml`
- [Deploy gate](https://github.com/girish1818/devsecops-project1/blob/main/.github/workflows/security-pipeline.yml): `.github/workflows/security-pipeline.yml`
- [Image build](https://github.com/girish1818/devsecops-project1/blob/main/Dockerfile): `Dockerfile`
- **AWS ECR**

### Security scanning

- [Semgrep SAST](https://github.com/girish1818/devsecops-project1/blob/main/rules/custom.yaml): `rules/custom.yaml`
- [Trivy scan](https://github.com/girish1818/devsecops-project1/blob/main/trivy-check.py): `trivy-check.py`
- [Gitleaks](https://github.com/girish1818/devsecops-project1/blob/main/.gitleaks.toml): `.gitleaks.toml`
- [Checkov IaC](https://github.com/girish1818/devsecops-project1/blob/main/terraform/main.tf): `terraform/main.tf`

### Demo application

- [Flask app](https://github.com/girish1818/devsecops-project1/blob/main/app/app.py): `app/app.py`
- [SQLite user data](https://github.com/girish1818/devsecops-project1/blob/main/app/app.py): `app/app.py`
- [Secret sources](https://github.com/girish1818/devsecops-project1/blob/main/app/app.py): `app/app.py`
- **Vault-injected secret**
- **AWS Secrets Manager**

### Runtime security

- [Kubernetes deployment](https://github.com/girish1818/devsecops-project1/blob/main/k8s/deployment.yaml): `k8s/deployment.yaml`
- [Falco rules](https://github.com/girish1818/devsecops-project1/blob/main/k8s/falco/custom-rules.yaml): `k8s/falco/custom-rules.yaml`
- [Admission policies](https://github.com/girish1818/devsecops-project1/blob/main/k8s/gatekeeper/approved-registries-constraint.yaml): `k8s/gatekeeper/approved-registries-constraint.yaml`
- [Network policies](https://github.com/girish1818/devsecops-project1/blob/main/k8s/network-policy-isolate.yaml): `k8s/network-policy-isolate.yaml`
- **Kubernetes API**

### Ingestion and response

- [Semgrep ingestion](https://github.com/girish1818/devsecops-project1/blob/main/splunk/ingest_semgrep.py): `splunk/ingest_semgrep.py`
- [Trivy ingestion](https://github.com/girish1818/devsecops-project1/blob/main/splunk/ingest_trivy.py): `splunk/ingest_trivy.py`
- **Splunk HEC**
- [Falco SOAR webhook](https://github.com/girish1818/devsecops-project1/blob/main/splunk/soar_falco_playbook.py): `splunk/soar_falco_playbook.py`
- [CVE SOAR](https://github.com/girish1818/devsecops-project1/blob/main/splunk/soar_playbook.py): `splunk/soar_playbook.py`
- **Splunk On-Call**
- **GitHub Issues**

### Other components

- **Developer**

## Connections

- Developer → GitHub Actions: pushes code
- GitHub Actions → Semgrep SAST: runs SAST
- GitHub Actions → Trivy scan: runs SCA
- GitHub Actions → Gitleaks: scans secrets
- GitHub Actions → Checkov IaC: scans IaC
- Semgrep SAST → Deploy gate: reports findings
- Trivy scan → Deploy gate: blocks criticals
- Gitleaks → Deploy gate: reports status
- Checkov IaC → Deploy gate: reports status
- Deploy gate → Image build: permits build
- Image build → AWS ECR: pushes image
- GitHub Actions → Kubernetes deployment: deploys image
- Kubernetes deployment → Flask app: runs
- Flask app → SQLite user data: queries users
- Flask app → Secret sources: loads secret
- Secret sources → Vault-injected secret: reads file
- Secret sources → AWS Secrets Manager: fetches fallback
- Falco rules → Kubernetes deployment: monitors runtime
- Admission policies → Kubernetes deployment: constrains admission
- Falco SOAR webhook → Kubernetes API: patches pod
- Kubernetes API → Network policies: applies quarantine
- Falco SOAR webhook → Splunk On-Call: pages alert
- Falco SOAR webhook → GitHub Issues: creates incident
- Semgrep ingestion → Splunk HEC: sends findings
- Trivy ingestion → Splunk HEC: sends vulnerabilities
- CVE SOAR → Splunk On-Call: pages CVE
- CVE SOAR → GitHub Issues: creates issue