Secure CI/CD Pipeline Security Gates

Description

You are a DevSecOps engineer. Build security gates for CI/CD pipelines.

## Configuration
- **CI/CD Platform**: [PLATFORM e.g. GitHub Actions / GitLab CI / Jenkins / Azure DevOps]
- **Language Stack**: [STACK e.g. Python+TypeScript / Java+Kotlin / C#+Angular / Go]
- **Container**: [CONTAINER e.g. yes with Docker / no]
- **Cloud Deploy**: [CLOUD e.g. AWS / Azure / GCP / Kubernetes]
- **Compliance**: [COMPLIANCE e.g. SOC2 / PCI-DSS / HIPAA / none]

## Security Gates

### Gate 1: Pre-Commit (Developer Machine)
- Pre-commit hooks configuration:
  - Secret scanning with detect-secrets/gitleaks
  - Lint security rules (bandit for Python, ESLint security plugin)
  - Dependency lock file validation
  - Large file prevention

### Gate 2: Static Analysis (PR Pipeline)
- **SAST**: Semgrep/CodeQL/SonarQube scan
  - Language-specific rules for [STACK]
  - Custom rules for organization patterns
  - Severity threshold: block on High+Critical
  - SARIF output for GitHub Security tab
- **Secret Scanning**: TruffleHog/GitLeaks across full diff
  - Custom regex patterns for internal secret formats
  - Allow-list for false positives
- **License Compliance**: Check dependency licenses against policy

### Gate 3: Dependency Analysis (Build Pipeline)
- **SCA**: npm audit / pip-audit / OWASP Dependency-Check
  - CVSS threshold: fail on >= 7.0
  - Known Exploited Vulnerabilities (KEV) catalog check
  - Automatic PR for dependency updates (Dependabot/Renovate config)
- **SBOM generation**: CycloneDX format for each build

### Gate 4: Container Security (Build Pipeline)
- Dockerfile linting with Hadolint
- Image scanning with Trivy/Grype
- Base image version enforcement
- No root user validation
- SBOM for container layers

### Gate 5: Dynamic Testing (Staging Deploy)
- **DAST**: OWASP ZAP baseline scan
  - API scan using OpenAPI spec
  - Authentication-aware scanning
  - Custom scan policy for [COMPLIANCE]
- **Infrastructure scanning**: tfsec/checkov for IaC

### Gate 6: Deployment Verification (Production)
- Security header validation
- TLS configuration check
- Runtime security policy enforcement
- Smoke tests for auth and access control
- Rollback trigger on security check failure

## Pipeline Configuration
- [PLATFORM] workflow/pipeline files
- Parallel execution where possible
- Caching for scan databases
- Failure notification to security channel
- Dashboard aggregating all scan results
- Exception workflow for accepted risks

Generate all pipeline configs, tool configurations, and integration scripts.

Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.

Usage Instructions

Tags

Compatible AI Models

Version History

Related Prompts