devsecops-security-pipeline/.gitlab-ci.yml at main · alejandrochuang/devsecops-security-pipeline · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
stages:
  - security

default:
  interruptible: true

semgrep:
  stage: security
  image: semgrep/semgrep
  script:
    - semgrep scan --config auto --error --sarif --output semgrep.sarif app/ Dockerfile
  artifacts:
    when: always
    reports:
      sast: semgrep.sarif
    paths:
      - semgrep.sarif

pip-audit:
  stage: security
  image: python:3.11-slim
  script:
    - pip install --no-cache-dir pip-audit
    - pip-audit -r requirements.txt

trivy-config:
  stage: security
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  script:
    - trivy config --format sarif --output trivy-config.sarif .
  artifacts:
    when: always
    paths:
      - trivy-config.sarif
  allow_failure: true

trivy-base-image:
  stage: security
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  script:
    - trivy image --scanners vuln --pkg-types os python:3.11-slim
  allow_failure: true

socket:
  stage: security
  image: python:3.11-slim
  before_script:
    - apt-get update
    - apt-get install -y --no-install-recommends git
    - rm -rf /var/lib/apt/lists/*
  script:
    - pip install --no-cache-dir socketsecurity
    - socketcli
      --api-token "$SOCKET_SECURITY_API_KEY"
      --target-path .
      --integration gitlab