devsecops-integration

Files (1)

• SKILL.md

SKILL.md (first lines)

<!-- Vendored from: platform-catalyst/skills/devsecops-integration/SKILL.md (BittahCriminal/platform-catalyst, BSD-3-Clause). Adapted for Catalyst: PLAN.md/CLAUDE.md/DECISIONS.md scrubbed; ADR-008->ADR-001, ADR-009->ADR-002. -->


# DevSecOps integration

## Role

You bridge security and CI/CD. You design the **gate order** that catches vulnerabilities before they reach `main`, configure the scanners with sensible severity thresholds, and provide triage guidance when findings appear. You enforce `AGENTS.md`'s "fix the code, don't disable the gate" rule and the zero-wildcard-IAM standard.

## References

### Research

- *Implementing DevSecOps Practices* (Packt) — `local/research/implementingdevsecopspractices.pdf`: shift-left strategy, scanner selection, signal-to-noise tuning, vulnerability management lifecycle, security champions model.
- *Security and Microservice Architecture on AWS* (Packt) — `local/research/securityandmicroservicearchitectureonaws.pdf`: AWS-native security services (GuardDuty, Inspector, Security Hub, Macie), service-to-service mTLS, secrets and KMS, audit logging.
- *Mastering GitHub Actions* (Packt) — `local/research/masteringgithubactions.pdf`: reusable workflows, OIDC, environment protection rules, matrix scans.

### Repo sources of truth

- `AGENTS.md` — security-critical rules: no wildcard IAM, no print, no requests, no shell=True, parameterized SQL, no eval/exec/pickle on untrusted input, no secrets in code/env/logs
- Milestone #5 issue #9 — threat-model drafting tracker for AI surface threats
- `docs/ADR/ADR-005-aws-agentic-platform-engineering.md` — current in-repo security/control baseline
- `AGENTS.md` §9 — CI workflow ordering

### Related skills

- `@checkov-cloud-image-static-analysis` — Checkov for Terraform/plan + Dockerfile; SARIF, baselines, custom checks under `infrastructure/policies/checkov/`
- `@iam-policy-craft` — generating zero-wildcard policies
- `@secrets-rotation` — Secrets Manager and SSM patterns
- `@container-hardening` — distroless + non-root + read-only rootfs
- `@github-actions-design` — gate ordering in workflows
- `@terraform-native-tests` — module-level assertions

## Challenge alignment

This skill produces evidence for both the **25% Infrastructure & Terraform quality** rubric ("security posture") and the **15% CI/CD & operational maturity** rubric ("pipeline design"). The PDF requires "least-privilege IAM principles, no wildcard policies" — DevSecOps gates enforce this at PR time, not after merge. Per "operational awareness, not checkbox coverage", scanner findings need triage workflows, not just status badges.

## Instructions

### 1. The CI gate ladder

Each PR runs scanners in cost order — cheap first, fail fast:

```
PR opened/synchronized
├── ① Format & lint (ruff, terraform fmt, prettier)              < 30s
├── ② Type check (mypy --strict)                                  < 60s
├── ③ Unit tests (pytest)                                         < 2min
├── ④ Secret scanning (gitleaks)                                  < 30s
├── ⑤ Dependency scanning (pip-audit, npm audit, govulncheck)     < 60s
├── ⑥ SAST (semgrep, bandit)                                      < 2min
├── ⑦ IaC policy (tfsec, checkov, OPA/Conftest)                   < 60s
├── ⑧ Container scan (trivy on built image)                        < 90s
├── ⑨ Terraform native tests (.tftest.hcl)                        < 3min
├── ⑩ Integration tests (moto/localstack)                         < 5min
└── ⑪ Terraform plan + post as PR comment                          < 2min
```

Each gate either **passes** or **blocks the PR**. The CI runs them in parallel where possible, but the ordering reflects what to fix first when multiple gates fail.

### 2. Scanner selection by language

| Concern | Python | TypeScript/Node | Go | Containers | Terraform |
|---------|--------|-----------------|-----|-----------|----------|
| **Secret scan** | gitleaks, trufflehog | gitleaks, trufflehog | gitleaks, trufflehog | — | gitleaks |
| **Dependency vulns** | pip-audit, safety | npm audit, snyk | govulncheck, nancy | trivy | tfsec |
| **SAST** | bandit, semgrep | semgrep, eslint-plugin-security | semgrep, gosec | — | tfsec, checkov |
| **License** | pip-licenses | license-checker | go-licenses | — | — |
| **SBOM** | cyclonedx-python | cyclonedx-node | cyclonedx-gomod | syft | — |
| **IaC policy** | — | — | — | — | tfsec, checkov, OPA/Conftest |

Catalyst is Python-first; TypeScript only in `cli/catalyst/` (Bun). Pin scanner versions in CI to avoid silent rule updates breaking builds.

### 3. Secret scanning (gitleaks)

```yaml
# .github/workflows/security.yml (excerpt)
- name: Secret scan
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  with:
    config-path: .gitleaks.toml
```

`.gitleaks.toml` allows specific known-safe patterns (e.g., the `JUDGE_LLM_API_KEY` env var name itself, but not values).

**Pre-commit hook** (per-developer):

```yaml
# .pre-commit-config.yaml
- repo: https://github.com/gitleaks/gitleaks
  rev: v8.18.0
  hooks:
    - id: gitleaks
```

### 4. Dependency scanning

**Python** (`pip-audit`):
```yaml
- name: pip-audit
  run: |
    pip install pip-audit
    pip-audit --requirement requirements.txt --strict
```

**Container** (`trivy`):
```yaml
- name: Trivy scan
  uses: aquasecurity/trivy-action@<pinned-sha>
  with:
    image-ref: ${{ needs.build.outputs.image-tag }}
    format: sarif
    output: trivy.sarif
    severity: HIGH,CRITICAL
    exit-code: 1
```

Upload SARIF to GitHub code scanning for unified findings view.

From Cloud-Byte-Consulting/Catalyst, BSD-3-Clause.

More from Cloud-Byte-Consulting/Catalyst