# jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline architecture

> Architecture diagram of the GitHub repository jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-26). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline
- Repository: https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline

## Overview

This repository is a DevSecOps supply-chain security pipeline for a containerized FastAPI service. A developer push or pull request starts the workflow, which gates release on secret scanning, SAST, and container vulnerability scanning; passing builds are published, inventoried with an SPDX SBOM, and keylessly signed. The service itself exposes health and data endpoints. Workflow details are summarized from the README; the workflow source was not sampled, so tool wiring and gates reflect documented behavior rather than inspected implementation.

Main entry points: [`.github/workflows/devsecops-pipeline.yml`](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml) (CI Workflow), [`Dockerfile`](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/Dockerfile) (Container Image), [`.gitleaks.toml`](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.gitleaks.toml) (Gitleaks), [`.semgrep.yml`](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.semgrep.yml) (Semgrep Rules)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_pipeline["Security Pipeline"]
  node_workflow["CI Workflow"]
  node_secrets["Secret Scan"]
  node_gitleaks["Gitleaks<br/>[.gitleaks.toml]"]
  node_sast["Static Analysis"]
  node_semgrep["Semgrep Rules<br/>[.semgrep.yml]"]
  node_vuln["Vulnerability Gate"]
  node_trivy["Trivy"]
end

subgraph group_artifact["Artifact Lifecycle"]
  node_build["Container Build"]
  node_image["Container Image"]
  node_registry[("GHCR")]
  node_sbom["SPDX SBOM"]
  node_syft["Syft"]
  node_signing["Image Signing"]
  node_cosign["Cosign"]
end

subgraph group_service["API Service"]
  node_api["FastAPI Service<br/>[main.py]"]
end

node_developer(("Developer"))
node_oidc["GitHub OIDC"]
node_rekor[("Rekor Log")]
node_consumer(("API Consumer"))

node_developer -->|"pushes changes"| node_workflow
node_workflow -->|"runs gate"| node_secrets
node_secrets -->|"scans history"| node_gitleaks
node_secrets -->|"pass enables"| node_sast
node_sast -->|"applies rules"| node_semgrep
node_sast -->|"pass enables"| node_build
node_workflow -->|"builds image"| node_build
node_build -->|"produces"| node_image
node_workflow -->|"runs gate"| node_vuln
node_vuln -->|"scans image"| node_trivy
node_image -->|"is scanned"| node_trivy
node_vuln -->|"pass releases"| node_registry
node_image -->|"published as"| node_registry
node_workflow -->|"generates inventory"| node_syft
node_image -->|"is inventoried"| node_syft
node_syft -->|"exports SPDX"| node_sbom
node_workflow -->|"requests signing"| node_cosign
node_cosign -->|"gets identity"| node_oidc
node_cosign -->|"signs artifact"| node_registry
node_cosign -->|"records signature"| node_rekor
node_registry -->|"distributes image"| node_consumer
node_consumer -->|"requests endpoints"| node_api

click node_workflow "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_secrets "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_gitleaks "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.gitleaks.toml"
click node_sast "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_semgrep "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.semgrep.yml"
click node_build "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/Dockerfile"
click node_vuln "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_trivy "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_image "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/Dockerfile"
click node_sbom "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_syft "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_signing "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_cosign "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml"
click node_api "https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/app/main.py"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_workflow,node_secrets,node_gitleaks,node_sast,node_semgrep,node_vuln,node_trivy toneBlue
class node_build,node_image,node_registry,node_sbom,node_syft,node_signing,node_cosign,node_rekor toneAmber
class node_api,node_consumer toneMint
class node_developer,node_oidc toneIndigo
```

## Components

### Security Pipeline

- [CI Workflow](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`
- [Secret Scan](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`
- [Gitleaks](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.gitleaks.toml): `.gitleaks.toml`
- [Static Analysis](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`
- [Semgrep Rules](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.semgrep.yml): `.semgrep.yml`
- [Vulnerability Gate](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`
- [Trivy](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`

### Artifact Lifecycle

- [Container Build](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/Dockerfile): `Dockerfile`
- [Container Image](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/Dockerfile): `Dockerfile`
- **GHCR**
- [SPDX SBOM](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`
- [Syft](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`
- [Image Signing](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`
- [Cosign](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/.github/workflows/devsecops-pipeline.yml): `.github/workflows/devsecops-pipeline.yml`

### API Service

- [FastAPI Service](https://github.com/jacksonitoro/shift-left-devsecops-supply-chain-security-pipeline/blob/main/app/main.py): `app/main.py`

### Other components

- **Developer**
- **GitHub OIDC**
- **Rekor Log**
- **API Consumer**

## Connections

- Developer → CI Workflow: pushes changes
- CI Workflow → Secret Scan: runs gate
- Secret Scan → Gitleaks: scans history
- Secret Scan → Static Analysis: pass enables
- Static Analysis → Semgrep Rules: applies rules
- Static Analysis → Container Build: pass enables
- CI Workflow → Container Build: builds image
- Container Build → Container Image: produces
- CI Workflow → Vulnerability Gate: runs gate
- Vulnerability Gate → Trivy: scans image
- Container Image → Trivy: is scanned
- Vulnerability Gate → GHCR: pass releases
- Container Image → GHCR: published as
- CI Workflow → Syft: generates inventory
- Container Image → Syft: is inventoried
- Syft → SPDX SBOM: exports SPDX
- CI Workflow → Cosign: requests signing
- Cosign → GitHub OIDC: gets identity
- Cosign → GHCR: signs artifact
- Cosign → Rekor Log: records signature
- GHCR → API Consumer: distributes image
- API Consumer → FastAPI Service: requests endpoints