How jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline works
This repository is a DevSecOps supply-chain security pipeline for a containerized FastAPI service. A developer push or pull request starts the workflow, which gates release on secret scanning, SAST, and container vulnerability scanning; passing builds are published, inventoried with an SPDX SBOM, and keylessly signed. The service itself exposes health and data endpoints. Workflow details are summarized from the README; the workflow source was not sampled, so tool wiring and gates reflect documented behavior rather than inspected implementation.
Main entry points: devsecops-pipeline.yml CI Workflow · Dockerfile Container Image · .gitleaks.toml Gitleaks · .semgrep.yml Semgrep Rules
Components 19
Security Pipeline
- CI Workflow
.github/workflows/devsecops-pipeline.yml - Secret Scan
.github/workflows/devsecops-pipeline.yml - Gitleaks
.gitleaks.toml - Static Analysis
.github/workflows/devsecops-pipeline.yml - Semgrep Rules
.semgrep.yml - Vulnerability Gate
.github/workflows/devsecops-pipeline.yml - Trivy
.github/workflows/devsecops-pipeline.yml
Artifact Lifecycle
- Container Build
Dockerfile - Container Image
Dockerfile - GHCR
- SPDX SBOM
.github/workflows/devsecops-pipeline.yml - Syft
.github/workflows/devsecops-pipeline.yml - Image Signing
.github/workflows/devsecops-pipeline.yml - Cosign
.github/workflows/devsecops-pipeline.yml
API Service
- FastAPI Service
app/main.py
Other components
- Developer
- GitHub OIDC
- Rekor Log
- API Consumer
Connections 22
- Developer → CI Workflow: pushes changes
- CI Workflow → Secret Scan: runs gate
- Secret Scan → Gitleaks: scans history
- Secret Scan → Static Analysis: pass enables
- Static Analysis → Semgrep Rules: applies rules
- Static Analysis → Container Build: pass enables
- CI Workflow → Container Build: builds image
- Container Build → Container Image: produces
- CI Workflow → Vulnerability Gate: runs gate
- Vulnerability Gate → Trivy: scans image
- Container Image → Trivy: is scanned
- Vulnerability Gate → GHCR: pass releases
- Container Image → GHCR: published as
- CI Workflow → Syft: generates inventory
- Container Image → Syft: is inventoried
- Syft → SPDX SBOM: exports SPDX
- CI Workflow → Cosign: requests signing
- Cosign → GitHub OIDC: gets identity
- Cosign → GHCR: signs artifact
- Cosign → Rekor Log: records signature
- GHCR → API Consumer: distributes image
- API Consumer → FastAPI Service: requests endpoints