Pipeline Security Gates

Pipeline Security Gates — CI/CD Security Gate Design Guide

A reference of scan tool selection, gate placement, and threshold configuration used by the security-scanner agent when designing pipeline security.

Target Agent

security-scanner — Directly applies the security gate patterns and tool selection from this skill to pipeline security design.

Security Scan Types & Tool Matrix

Scan Type Overview

Tool Selection Guide

SAST (Static Analysis)

SCA (Dependency Analysis)

Secret Detection

Container Scanning

IaC Scanning

Gate Placement Strategy

Security Gates by Pipeline Stage

[1. Pre-Commit]
  ├── Secret Detection (Gitleaks pre-commit)
  └── Lint Security Rules

[2. PR/Commit]
  ├── SAST (Semgrep/CodeQL)
  ├── SCA (Dependabot/Snyk)
  ├── Secret Detection (full scan)
  ├── License Check
  └── IaC Scan (if applicable)

[3. Build]
  ├── Container Image Scan (Trivy)
  └── SBOM Generation (Software Bill of Materials)

[4. Staging]
  ├── DAST (optional)
  └── Integration Security Tests

[5. Production Deployment]
  └── Final Approval Gate (security report review)

Gate Block/Warn Policy

Vulnerability Severity Classification

CVSS v3.1 Based

Exception Handling (Suppression)

# .trivyignore or .semgrepignore example
# Reason and expiry date required

CVE-2024-12345  # No impact (unused feature). Expires: 2025-06-30
RULE-001        # False positive. Reviewer: @security-team

GitHub Actions Security Gate YAML Patterns

Semgrep (SAST)

semgrep:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: returntocorp/semgrep-action@v1
      with:
        config: >-
          p/owasp-top-ten
          p/r2c-security-audit

Trivy (Container + SCA)

trivy:
  runs-on: ubuntu-latest
  steps:
    - uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'image'
        image-ref: '${{ env.IMAGE }}'
        severity: 'CRITICAL,HIGH'
        exit-code: '1'

Gitleaks (Secret)

gitleaks:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - uses: gitleaks/gitleaks-action@v2

SBOM (Software Bill of Materials)

SBOM Generation Tools

SBOM Required Information

• Package name, version, license
• Dependency tree (direct/transitive)
• Hash values (integrity verification)
• Supplier information