# Devsecops

> When to activate: DevSecOps, SAST, DAST, shift-left, security pipeline, container scanning, dependency audit, policy as code

- Skill: `mattakushi432/devsecops` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/devsecops`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/devsecops/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/devsecops

---

# DevSecOps Patterns

## CI Security Pipeline

```yaml
# GitHub Actions security pipeline
name: Security

on: [push, pull_request]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Semgrep SAST
      - uses: semgrep/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/python
            p/secrets

      # Bandit (Python)
      - run: pip install bandit && bandit -r src/ -ll -f json -o bandit.json
      - uses: actions/upload-artifact@v4
        with: { name: bandit-report, path: bandit.json }

  dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip-audit -r requirements.txt --format json > pip-audit.json
      - run: npm audit --json > npm-audit.json || true
      - uses: snyk/actions/python@master
        env: { SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} }

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: gitleaks/gitleaks-action@v2
        env: { GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} }

  container-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t myapp:${{ github.sha }} .
      - uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          severity: HIGH,CRITICAL
          exit-code: '1'

  dast:
    runs-on: ubuntu-latest
    needs: [sast]
    steps:
      - uses: actions/checkout@v4
      - name: Start app
        run: docker-compose up -d
      - uses: zaproxy/action-baseline@v0.10.0
        with:
          target: 'http://localhost:8000'
```

## SAST Tools Comparison

```bash
# Semgrep — fast, rule-based, language-agnostic
semgrep --config auto src/
semgrep --config p/owasp-top-ten .
semgrep --config p/secrets .

# Bandit — Python focused
bandit -r . -ll                    # medium+ severity
bandit -r . -t B101,B102,B105     # specific checks

# CodeQL — deep semantic analysis (GitHub Actions built-in)
# .github/codeql/codeql-config.yml
# queries: +security-extended,+security-and-quality

# ESLint security plugin (Node.js)
# eslint-plugin-security, eslint-plugin-no-secrets
```

## Dependency Management

```bash
# Python
pip-audit                          # audit installed packages against PyPI advisory db
safety check                       # check against Safety DB
pip install pip-audit && pip-audit -r requirements.txt

# Node.js
npm audit fix                      # auto-fix where possible
npx better-npm-audit check -l high # fail on high severity only

# Go
govulncheck ./...                  # official Go vulnerability checker

# Rust
cargo audit                        # check against RustSec Advisory DB

# Renovate / Dependabot — automated PRs for dependency updates
# .github/dependabot.yml
# package-ecosystem: pip
# schedule: interval: weekly
```

## Policy as Code (OPA/Rego)

```rego
# Deny privileged containers
package main

deny[msg] {
  input.kind == "Pod"
  container := input.spec.containers[_]
  container.securityContext.privileged == true
  msg := sprintf("Container %s must not run as privileged", [container.name])
}

# Require non-root user
deny[msg] {
  input.kind == "Deployment"
  container := input.spec.template.spec.containers[_]
  not container.securityContext.runAsNonRoot
  msg := sprintf("Container %s must set runAsNonRoot=true", [container.name])
}
```

```bash
# Conftest — test K8s manifests against OPA policies
conftest test deployment.yaml --policy policy/

# Kyverno — admission controller with policy enforcement
kubectl apply -f kyverno-policy.yaml
```

## Security Gates

```python
# Quality gate — block merge on security findings
SECURITY_THRESHOLDS = {
    "critical": 0,    # zero tolerance
    "high": 0,        # zero tolerance
    "medium": 5,      # allow up to 5
    "low": None       # no limit
}

def check_security_gate(findings: list[dict]) -> bool:
    counts = Counter(f["severity"].lower() for f in findings)
    for severity, limit in SECURITY_THRESHOLDS.items():
        if limit is not None and counts.get(severity, 0) > limit:
            print(f"FAIL: {counts[severity]} {severity} findings (limit: {limit})")
            return False
    return True
```

## Pre-commit Hooks

```yaml
# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

  - repo: https://github.com/PyCQA/bandit
    rev: 1.7.5
    hooks:
      - id: bandit
        args: ["-ll", "--skip", "B101"]

  - repo: https://github.com/Yelp/detect-secrets
    rev: v1.4.0
    hooks:
      - id: detect-secrets
        args: ['--baseline', '.secrets.baseline']
```