skills.rest
kalshamsi
kalshamsiCOMMUNITY
Explore all skills by this author →
GitHub

devsecops-pipeline

Generate a multi-stage GitHub Actions security pipeline with SAST, SCA, secrets, and container scanning.

1|Updated Mar 25, 2026
Search Tags:#sast#devsecops#github-actions#ci-cd#gitleaks#sca
One-click install
npx skills add https://github.com/kalshamsi/claude-security-skills --skill devsecops-pipeline-kalshamsi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: devsecops-pipeline
Source: https://github.com/kalshamsi/claude-security-skills/tree/main/skills/devsecops-pipeline
Command: npx skills add https://github.com/kalshamsi/claude-security-skills --skill devsecops-pipeline-kalshamsi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates the setup of security scanning in CI/CD by generating a complete GitHub Actions workflow that wires SAST, SCA, secrets detection, container scanning, and an optional DAST stage into a single, ready-to-commit pipeline.

Core Features & Use Cases

  • Auto-generates a complete .github/workflows/security.yml with multi-stage security checks configured for the detected project ecosystem.
  • Detects the project ecosystem (Node.js, Python, Go, etc.) and selects appropriate tools and rule sets for SAST, SCA, and secrets scanning.
  • Requires no local tool installation; uses GitHub-hosted actions and outputs SARIF for Security tab integration.
  • Supports optional DAST if a staging environment is available and a deploy step exists.

Quick Start

Provide a codebase prompt (e.g., a Node.js or Python project) and the AI will generate a ready-to-commit GitHub Actions security.yml.

Frequently Asked Questions about devsecops-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up a DevSecOps pipeline with SAST and SCA in GitHub Actions?▼

A GitHub Actions security pipeline integrates SAST, SCA, secrets detection, and container scanning into a single YAML workflow. It auto-detects your project ecosystem and outputs SARIF files for direct integration with the GitHub Security tab.

Can I generate a security workflow for a Python or Node.js project without installing local scanning tools?▼

Yes, you can auto-generate a security pipeline for Python, Node.js, or Go projects without local tool installation. The generated workflow uses GitHub-hosted actions for SAST, SCA, and secrets scanning, uploading SARIF results directly to the GitHub Security tab.

How do I add secrets detection and SCA to my CI/CD pipeline using SARIF uploads?▼

Secrets detection and SCA are added by generating a GitHub Actions workflow that runs tools like Gitleaks and uploads SARIF files. This integrates software composition analysis and secret scanning results directly into your repository's Security tab for centralized vulnerability management.

Does GitHub Actions security scanning support DAST for staging environments?▼

Yes, GitHub Actions security scanning supports an optional DAST stage if a staging environment is available and a deploy step exists in your workflow. This allows dynamic application security testing to run automatically after deployment within the same pipeline.

What is the best way to automate container scanning and SAST in a CI/CD pipeline?▼

The best way to automate container scanning and SAST is generating a single GitHub Actions security workflow that orchestrates these stages together. It detects your project ecosystem, configures the necessary scanning tools, and uploads SARIF artifacts for centralized security reporting.

Related Skills

Explore More Software Engineering Skills→
AnExiledDevAnExiledDev
9

dependency-management

Analyze project dependencies for currency, security, licensing, and usage.

Community
Advanced
arbazkhan971arbazkhan971
26

devsecops

Integrate security scanning into CI/CD pipelines with blocking gates.

Community
Advanced
HomericIntelligenceHomericIntelligence
18

verify-pr-ready

Validate GitHub Pull Requests for CI status, approvals, and merge conflicts.

Official
Intermediate
cosmixcosmix
53

ci-cd

Design and automate CI/CD pipelines for GitHub Actions, GitLab CI, and Jenkins.

Community
Advanced