skills.rest
daemon-blockint-tech
daemon-blockint-techCOMMUNITY
Explore all skills by this author →
GitHub

devsecops

Automate SAST/SCA, SBOM generation, and policy enforcement in CI/CD pipelines.

7|1|Updated May 19, 2026
Search Tags:#sast#iac#devsecops#ci-cd#policy#sbom#sca
One-click install
npx skills add https://github.com/daemon-blockint-tech/Agentic-Enteprises-Skill --skill devsecops-daemon-blockint-tech
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: devsecops
Source: https://github.com/daemon-blockint-tech/Agentic-Enteprises-Skill/tree/main/devsecops
Command: npx skills add https://github.com/daemon-blockint-tech/Agentic-Enteprises-Skill --skill devsecops-daemon-blockint-tech

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

DevSecOps teams spend cycles hardening pipelines and embedding security postures after code is written. This skill provides a cohesive, repeatable approach to shift security earlier in the lifecycle, integrating security checks into CI/CD, IaC, and artifact governance.

Core Features & Use Cases

  • Automated SAST/SCA and secret scanning in CI/CD pipelines
  • SBOM generation and artifact signing for software supply chain integrity
  • OIDC federation and least-privilege access controls for automated deployments
  • Policy enforcement using Kyverno/OPA with SOC 2 / ISO 27001 alignment
  • Threat modeling and secure SDLC governance across releases and environments

Quick Start

Configure your CI/CD to automatically enforce SAST/SCA, SBOM generation, and policy checks on every pull request

Frequently Asked Questions about devsecops

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate SAST and SCA scanning into a CI/CD pipeline?▼

Integrate SAST and SCA scanning into CI/CD pipelines by configuring security checks to automatically gate the build and release process on every pull request. This approach shifts security left, catching vulnerabilities early in the lifecycle.

What is the best way to generate an SBOM and sign artifacts for software supply chain security?▼

Generate an SBOM and sign artifacts within your CI/CD pipeline to enforce software supply chain integrity. This automated governance ensures provenance and satisfies SOC 2 and ISO 27001 compliance requirements across releases.

Does this DevSecOps approach support policy enforcement using OPA and Kyverno?▼

Yes, policy enforcement using Kyverno and OPA is supported to gate deployments in cloud-native environments. This aligns automated governance with secure SDLC controls required for SOC 2 and ISO 27001 compliance mappings.

Can I use OIDC federation for least-privilege access controls in automated deployments?▼

Yes, OIDC federation is supported to establish least-privilege access controls for automated deployments. This secures cloud-native environments by eliminating static secrets during the release process.

When do I need automated threat modeling and compliance mappings in a release pipeline?▼

Automated threat modeling and compliance mappings are needed when enforcing secure SDLC governance across releases and environments. They satisfy SOC 2, ISO 27001, and SSDF control requirements without slowing down software delivery.

Related Skills

Explore More Software Engineering Skills→
shakhovskiya-createshakhovskiya-create

deploy-audit

Audit CI/CD pipelines and infrastructure configurations for security and reliability.

Community
Advanced
josemlopezjosemlopez
8

tm-compliance

Map threats and controls to compliance frameworks and generate audit-ready reports.

Community
Advanced
hung-phanhung-phan

vulnerability-management

Prioritize CVEs using CVSS, EPSS, KEV, and reachability analysis.

Community
Advanced
npc-chrisnpc-chris
1

cso

Audit infrastructure and code for vulnerabilities and misconfigurations.

Community
Advanced