skills.rest
TheViziusGroup
TheViziusGroupOFFICIAL
Explore all skills by this author →
WebsiteGitHub

devsecops-pipeline

Builds GitHub Actions CI/CD pipelines with SAST, SCA, secrets, container, and IaC security gates.

1|Updated Aug 10, 2026
Search Tags:#ci/cd#github actions#sast#devsecops#iac security#security gates#container scanning
One-click install
npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill devsecops-pipeline-theviziusgroup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: devsecops-pipeline
Source: https://github.com/TheViziusGroup/vibe-engineering-skills/tree/main/plugins/devsecops-cicd/skills/devsecops-pipeline
Command: npx skills add https://github.com/TheViziusGroup/vibe-engineering-skills --skill devsecops-pipeline-theviziusgroup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Integrating security scanning into CI/CD pipelines is complex: teams must choose the right tools, configure severity thresholds, wire SARIF results into GitHub, and enforce gates before deployment. This Skill provides a complete, production-oriented DevSecOps pipeline reference covering every scanning stage. ## Core Features & Use Cases - Full 6-Job GitHub Actions Pipeline: SAST (Semgrep + CodeQL), SCA (Snyk), secrets scanning (Gitleaks), container scanning (Trivy), IaC scanning (Checkov), and a gated deploy job using OIDC Azure authentication. - Quality Gates & Exception Process: Severity thresholds per scan type, documented suppression annotations, and branch protection rules requiring all security checks before merge. - DAST & Policy as Code: OWASP ZAP baseline/full scans against staging, plus OPA/Rego policies enforced with Conftest on Kubernetes manifests. - Use Case: A team setting up a new .NET/React application repository needs security scanning from day one. Use this Skill to generate the complete workflow file, Dependabot/Renovate config, pre-commit Gitleaks hook, and branch protection Terraform in one pass. ## Quick Start Ask the AI to generate a complete DevSecOps GitHub Actions pipeline with SAST, dependency scanning, secrets scanning, container scanning, and IaC scanning for your repository.

Frequently Asked Questions about devsecops-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add security scanning to a GitHub Actions pipeline?▼

Add dedicated jobs for each scan type: Semgrep and CodeQL for SAST, Snyk for dependency scanning, Gitleaks for secrets, Trivy for containers, and Checkov for IaC. Make the deploy job depend on all scan jobs via the needs keyword so it only runs when every gate passes.

Semgrep vs CodeQL: which SAST tool should I use?▼

Use both together. Semgrep excels at custom rules and rapid rule authorship with rulesets like p/owasp-top-ten, while CodeQL provides deep semantic analysis for C# and TypeScript, catching SQL injection, XSS, and path traversal. Both upload SARIF results to GitHub's Security tab.

Why does Gitleaks need fetch-depth 0 in GitHub Actions?▼

The default checkout only fetches the latest commit, so secrets committed earlier and later deleted remain undetected. Setting fetch-depth: 0 scans the entire git history, catching credentials that still exist in old commits.

How do I scan Terraform and Bicep for security misconfigurations in CI?▼

Use the Checkov GitHub Action with the directory and framework parameters set to terraform or bicep. Set soft_fail to false so HIGH severity policy violations fail the job, and use skip-check only with documented justification for approved exceptions.

Can I deploy to Azure from GitHub Actions without storing credentials?▼

Yes, use OIDC federation with the azure/login action. Store only the client ID, tenant ID, and subscription ID as secrets; the workflow exchanges an OIDC token for access, eliminating stored passwords or client secrets entirely.

When should DAST run in a CI/CD pipeline?▼

Run DAST with OWASP ZAP against a deployed staging environment, not in the main PR pipeline, since it requires a live target. Use the baseline scan on deployments and schedule the full scan weekly to limit pipeline duration.

Related Skills

Explore More Software Engineering Skills→
alxayoalxayo
17

checkov-security-scan

Detect security misconfigurations and compliance violations in Infrastructure as Code.

Community
Advanced
tektonlabstektonlabs

remediation-log

Generate security remediation tracking documentation for vulnerability fixes and SLA compliance.

Official
Intermediate
jassicsjassics
6

k8s-workload-hardening

Review and apply Pod Security Standards to harden Kubernetes workloads.

Community
Advanced
AIDotNetAIDotNet
84

ci-cd-generator

Generate CI/CD pipeline configurations for GitHub Actions, GitLab CI, Azure DevOps, and Jenkins.

Official
Intermediate