Building a DevSecOps Pipeline in Practice: Integrating Security Automation into CI/CD

What Is DevSecOps?

DevSecOps is a methodology that integrates Development (Dev), Security (Sec), and Operations (Ops) so security is built into every stage of software delivery. It is also known as "Shift Left Security."

CI/CD Pipeline Security Integration Architecture

코드 → SAST → SCA → 빌드 → 이미지 스캔 → DAST → 배포 → 런타임 모니터링

Step 1: SAST (Static Analysis)

name: Security Scan
on: [push, pull_request]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        uses: semgrep/semgrep-action@v1
        with:
          config: p/owasp-top-ten
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript, python
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

Step 2: SCA (Software Composition Analysis)

  sca:
    steps:
      - name: Snyk Security Scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

Step 3: Container Image Scanning

      - name: Trivy 취약점 스캔
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: my-app:${{ github.sha }}
          exit-code: '1'
          severity: 'HIGH,CRITICAL'

Step 4: Secrets Detection

      - name: TruffleHog Secrets Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}

Step 5: DAST (Dynamic Analysis)

      - name: OWASP ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: 'https://staging.myapp.com'
          fail_action: true

Security Gate Policy

DevSecOps is a culture, not a toolchain. If you only stand up a pipeline without collaboration between development and security, you end up with checkbox security.

Scan Infrastructure as Code (IaC), Not Just Application Code

A large share of incidents today come not from application code but from misconfigured infrastructure (public S3 buckets, overly open security groups). Add IaC scanning to the pipeline.

      - name: Checkov IaC Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ./terraform
          framework: terraform

tfsec and Terrascan are alternatives that serve the same purpose.

Extend to the Supply Chain: Trust Your Build Artifacts

SAST/SCA is not the end of the story. Generate an SBOM (software bill of materials) on every build and sign artifacts (cosign) so you can verify that what you deploy has not been tampered with.

Running Security Gates in Practice

If you turn every gate to "block" from day one, developers will find workarounds. Gradual rollout is how this actually sticks.

FAQ

Q. If you could only pick one of SAST, SCA, or DAST? Dependency vulnerabilities account for a large share of incidents, so many teams start with SCA. That said, the three cover different surfaces (code / dependencies / runtime) and complement each other.

Q. Scans are making builds too slow. Run full scans overnight or at merge time, and keep PR checks to fast, incremental scans of the diff. That way you protect velocity.

Editor's Note — From the Field

If you turn security gates to "block all Critical" from day one, the development team will find a workaround within two weeks. What actually worked was the opposite: start by blocking only new findings and reporting existing ones, so you get visibility without stopping builds, then tighten the gates once the team is used to them. In DevSecOps, the real risk is not the vulnerability—it is a process that makes people want to bypass security.

References

• OWASP Top 10 (Web Application Security Risks)