Building a DevSecOps Pipeline in Practice: Integrating Security Automation into CI/CD

What Is DevSecOps?

DevSecOps is a methodology that integrates Development (Dev), Security (Sec), and Operations (Ops) so security is built into every stage of software delivery. It is also known as "Shift Left Security."

CI/CD Pipeline Security Integration Architecture

 → SAST → SCA → → → DAST → →

Step 1: SAST (Static Analysis)

name: Security Scan
on: [push, pull_request]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        uses: semgrep/semgrep-action@v1
        with:
          config: p/owasp-top-ten
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript, python
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

Step 2: SCA (Software Composition Analysis)

  sca:
    steps:
      - name: Snyk Security Scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

Step 3: Container Image Scanning

 - name: Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: my-app:${{ github.sha }}
          exit-code: '1'
          severity: 'HIGH,CRITICAL'

Step 4: Secrets Detection

      - name: TruffleHog Secrets Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}

Step 5: DAST (Dynamic Analysis)

      - name: OWASP ZAP Full Scan
        uses: zaproxy/action-full-scan@v0.10.0
        with:
          target: 'https://staging.myapp.com'
          fail_action: true

Security Gate Policy

DevSecOps is a culture, not a toolchain. If you only stand up a pipeline without collaboration between development and security, you end up with checkbox security.

Scan Infrastructure as Code (IaC), Not Just Application Code

A large share of incidents today come not from application code but from misconfigured infrastructure (public S3 buckets, overly open security groups). Add IaC scanning to the pipeline.

      - name: Checkov IaC Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: ./terraform
          framework: terraform

tfsec and Terrascan are alternatives that serve the same purpose.

Extend to the Supply Chain: Trust Your Build Artifacts

SAST/SCA is not the end of the story. Generate an SBOM (software bill of materials) on every build and sign artifacts (cosign) so you can verify that what you deploy has not been tampered with.

Running Security Gates in Practice

If you turn every gate to "block" from day one, developers will find workarounds. Gradual rollout is how this actually sticks.

When Security Gates Block Builds: Triage and Exceptions

For the first weeks after introducing gates, build failures spike. Instead of switching gates off, you need a procedure that classifies and handles failures.

Classify the cause

• Real vulnerability: SQL injection or hardcoded secrets in new code
• Existing debt: vulnerable dependencies that predate the gate
• False positive: dummy keys in tests, unreachable code paths

Reproduce and confirm

# reproduce the CI scans locally
semgrep ci --config auto               # SAST
trivy fs --severity HIGH,CRITICAL .    # dependencies and config
gitleaks detect --source . --redact    # secrets
# is the flagged dependency actually used?
npm ls <package>    # or pip show <package>

Handling rules

• Real vulnerability in new code: fix before merge (gate stays)
• Existing debt: register as a baseline and block only new findings; track debt in separate tickets with deadlines
• False positive: add to the tool's ignore file (.semgrepignore, .trivyignore, .gitleaksignore) with a reason and expiry date in a comment, via review

Prevention

• Require security owner approval (CODEOWNERS) for changes to ignore files.
• Periodically find expired exceptions so they don't become permanent.

FAQ

Q. If you could only pick one of SAST, SCA, or DAST? Dependency vulnerabilities account for a large share of incidents, so many teams start with SCA. That said, the three cover different surfaces (code / dependencies / runtime) and complement each other.

Q. Scans are making builds too slow. Run full scans overnight or at merge time, and keep PR checks to fast, incremental scans of the diff. That way you protect velocity.

Editor's Note — From the Field

If you turn security gates to "block all Critical" from day one, the development team will find a workaround within two weeks. What actually worked was the opposite: start by blocking only new findings and reporting existing ones, so you get visibility without stopping builds, then tighten the gates once the team is used to them. In DevSecOps, the real risk is not the vulnerability—it is a process that makes people want to bypass security.

References

• OWASP Top 10 (Web Application Security Risks)