skills.rest
Probably-Group
Probably-GroupOFFICIAL
Explore all skills by this author →
Website𝕏@problynotingGitHub

devsecops-expert

Embed secret scanning, SAST, SCA, SBOM, and image signing into CI/CD pipelines.

3|1|Updated Dec 3, 2025
Search Tags:#ci/cd#security scanning#devsecops#supply chain security#policy as code#sbom#kubernetes security
One-click install
npx skills add https://github.com/Probably-Group/Dev-AID --skill devsecops-expert-probably-group
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: devsecops-expert
Source: https://github.com/Probably-Group/Dev-AID/tree/main/.dev-aid/skills/expert/devsecops-expert
Command: npx skills add https://github.com/Probably-Group/Dev-AID --skill devsecops-expert-probably-group

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents insecure software from advancing by embedding DevSecOps security controls—scanning, supply-chain verification, secrets hygiene, and policy enforcement—directly into your CI/CD workflow.

Core Features & Use Cases

  • Shift-left CI/CD security: Enforces secret scanning, SAST, and dependency vulnerability checks on every PR with fail-fast merge gates.
  • Supply chain & artifact integrity: Requires SBOM generation, dependency verification, and signed container images (e.g., cosign), with attestation-aware policy.
  • Runtime & infrastructure security: Hardens Kubernetes workloads with least privilege (non-root, dropped capabilities), defense-in-depth (default-deny network policies), and compliance as code (OPA/Kyverno-style policies).
  • Use Cases: Secure your pipeline stages for GitHub Actions/GitLab CI, implement SBOM + image signing, enforce security policies for Kubernetes manifests, and add DAST gates (OWASP ZAP) after staging deployment.

Quick Start

Use the devsecops-expert Skill to design a CI/CD security gate pipeline that fails builds on high-severity SAST/SCA findings, generates an SBOM, signs images, and deploys only after policy-enforced approval.

Frequently Asked Questions about devsecops-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add security scanning to my CI/CD pipeline?▼

Adding security scanning to CI/CD pipelines involves embedding secret scanning, SAST, and SCA checks directly into your workflow to fail builds on high-severity findings before deployment.

How do I generate an SBOM and sign container images in GitHub Actions?▼

To generate an SBOM and sign container images, you enforce supply-chain integrity checks within your pipeline stages by requiring dependency verification and using tools like cosign for signed attestations.

What is shift-left security and how does it enforce fail-fast merge gates?▼

Shift-left security enforces fail-fast merge gates by running vulnerability checks on every pull request, stopping insecure or unverified code changes from advancing to deployment stages.

Can I use policy as code to enforce Kubernetes workload hardening?▼

Yes, you can use policy as code to enforce Kubernetes hardening by applying least-privilege rules, non-root constraints, dropped capabilities, and default-deny network policies using OPA or Kyverno-style policies.

Does this DevSecOps approach support DAST gates after staging deployment?▼

Yes, this DevSecOps approach supports optional post-deploy DAST gates, allowing you to integrate OWASP ZAP scanning after staging deployment to verify runtime application security.

Related Skills

Explore More Software Engineering Skills→
drgaciwdrgaciw

gitlab-ci-patterns

Generate GitLab CI/CD pipeline configurations for testing, building, and deployment.

Community
Intermediate
devkenidevkeni
1

container-security

Scan Docker images, audit Kubernetes clusters, and monitor container runtimes for security weaknesses.

Community
Advanced
asanexampleasanexample
1

supply-chain-onboarding

Automate container image signing and verification in GitHub Actions with Kyverno cosign.

Official
Intermediate
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced