Secure CI/CD pipeline
A CI/CD pipeline with dependency, container and secret scanning built in as gates, not as an afterthought.
The problem
Bolting security scanning onto a pipeline after it already exists usually means noisy, ignored results. This lab builds scanning in from the start, with clear gates for what blocks a release and what just gets tracked.
Architecture
- Dependency and static analysis scanning on every pull request
- Container image scanning and SBOM generation at build time
- Policy-as-code checks against infrastructure changes before apply
- A clear severity threshold that blocks merge, versus findings that are tracked but non-blocking
Technologies
Design decisions
Only high and critical findings block merge; everything else is tracked
Blocking on every finding trains engineers to ignore the pipeline. A calibrated threshold keeps the gate meaningful.
SBOM generation on every build, not just release builds
Makes it possible to answer 'were we affected by this CVE' for any build, not just tagged releases.
Lessons learned
- A security gate that blocks everything gets bypassed; one calibrated to real risk gets respected
- SBOMs are only useful if they're actually queried during an incident — that requires practicing the query, not just generating the file
Working through something similar?
This lab reflects our own reference work, not a client engagement — but the approach transfers directly.
Start a technical conversation