CI/CD Security Integration
Embed security scanning into a GitHub Actions pipeline — SAST, dependency scanning, secret detection, container scanning, and IaC validation.
01 Overview
Security is most effective when it's automated and shift-left. In this mission you'll take an existing CI/CD pipeline and transform it into a security-first workflow. You'll add static analysis with Semgrep, dependency vulnerability scanning, secret detection with Gitleaks, container image scanning with Trivy, and Infrastructure-as-Code security validation with tfsec — all gated to block insecure deployments.
02 Environment Setup
**Fork a starter repo:** Fork [github.com/juice-shop/juice-shop](https://github.com/juice-shop/juice-shop) — this is a deliberately vulnerable Node.js app perfect for practising security scanning. **Enable GitHub Actions:** In your fork, go to Actions tab and click "I understand my workflows, go ahead and enable them". **Create a workflow file:** Create `.github/workflows/security.yml` — this is where all your security tools will live. The YAML indentation must be exact.
03 Mission Tasks
Integrate Gitleaks into the pipeline. Intentionally commit a fake secret, verify it's caught, then configure allowlist rules for false positives.
Add Semgrep to scan Python/JavaScript code for injection vulnerabilities, hardcoded credentials, and insecure dependencies.
Integrate Trivy to scan the application Docker image on every PR. Configure severity thresholds and block merges on CRITICAL findings.
Add tfsec and Checkov to validate Terraform code. Identify and fix three deliberately insecure Terraform resources.
Implement a consolidated security report as a PR comment. Configure branch protection rules so all security gates must pass before merge.
04 Why This Matters
DevSecOps is the fastest-growing security discipline. Companies that have adopted DevOps need security engineers who can speak the same language as developers and automate security into pipelines.
You'll Need
- A GitHub account with a repository to work with
- Basic Git knowledge (commit, push, pull request)
- Docker installed locally
- Basic understanding of CI/CD concepts
- A simple app to work with (Node.js or Python recommended)
Tools & Tech Stack
Skills You'll Gain
- DevSecOps
- GitHub Actions
- SAST
- Container security
- IaC security
- Shift-left security
More Missions
Linux Hardening Fundamentals
Secure a fresh Ubuntu server from scratch — configure SSH, set up firewalls, manage users, and eliminate attack surface.
Docker Security Lab
Scan container images for CVEs, build minimal secure images, and enforce runtime security policies across a multi-container stack.
Cloud Security Audit with AWS
Audit a misconfigured AWS environment — find exposed S3 buckets, overly permissive IAM roles, open security groups, and missing CloudTrail.