{"id":51862632,"url":"https://github.com/basel5001/devsecops-pipeline","last_synced_at":"2026-07-24T10:01:46.948Z","repository":{"id":372128462,"uuid":"1285381120","full_name":"basel5001/devsecops-pipeline","owner":"basel5001","description":"Complete DevSecOps scanning platform: SAST, SCA, IaC, secrets + AI risk analysis (AWS Bedrock)","archived":false,"fork":false,"pushed_at":"2026-07-19T02:03:26.000Z","size":59,"stargazers_count":0,"open_issues_count":8,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-19T04:06:53.201Z","etag":null,"topics":["aws-bedrock","checkov","devsecops","github-action","gitleaks","sast","security-scanning","semgrep","trivy"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/basel5001.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-30T18:43:16.000Z","updated_at":"2026-07-19T02:00:47.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/basel5001/devsecops-pipeline","commit_stats":null,"previous_names":["basel5001/devsecops-pipeline"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/basel5001/devsecops-pipeline","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fdevsecops-pipeline","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fdevsecops-pipeline/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fdevsecops-pipeline/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fdevsecops-pipeline/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/basel5001","download_url":"https://codeload.github.com/basel5001/devsecops-pipeline/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/basel5001%2Fdevsecops-pipeline/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35837268,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-24T02:00:07.870Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-bedrock","checkov","devsecops","github-action","gitleaks","sast","security-scanning","semgrep","trivy"],"created_at":"2026-07-24T10:01:46.877Z","updated_at":"2026-07-24T10:01:46.940Z","avatar_url":"https://github.com/basel5001.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DevSecOps Security Scanning Pipeline\n\n![CI](https://github.com/basel5001/devsecops-pipeline/actions/workflows/ci.yml/badge.svg)\n![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)\n![Trivy](https://img.shields.io/badge/Trivy-1904DA?style=flat-square\u0026logo=aquasecurity\u0026logoColor=white)\n![Semgrep](https://img.shields.io/badge/Semgrep-4B11A8?style=flat-square\u0026logo=semgrep\u0026logoColor=white)\n![Checkov](https://img.shields.io/badge/Checkov-5C4EE5?style=flat-square\u0026logo=paloaltonetworks\u0026logoColor=white)\n![Gitleaks](https://img.shields.io/badge/Gitleaks-E44D26?style=flat-square\u0026logo=git\u0026logoColor=white)\n![AWS Bedrock](https://img.shields.io/badge/AWS_Bedrock-FF9900?style=flat-square\u0026logo=amazonaws\u0026logoColor=white)\n\nComprehensive security scanning platform that orchestrates SAST, dependency scanning, container scanning, IaC scanning, and secrets detection. Includes AI-powered risk analysis via AWS Bedrock and a self-contained HTML results dashboard.\n\n## Architecture\n\n```\ndevsecops-pipeline/\n├── src/\n│   ├── scanners/\n│   │   └── orchestrator.py    # Main orchestrator - runs all scanners\n│   ├── ai/\n│   │   └── analyzer.py        # AWS Bedrock AI analysis\n│   └── dashboard/\n│       └── index.html          # Self-contained HTML dashboard\n├── terraform/                  # AWS deployment (Lambda + S3 + SNS)\n├── tests/                      # Unit tests\n├── .github/\n│   └── workflows/\n│       ├── ci.yml              # CI pipeline (lint, test, docker)\n│       └── security.yml        # Security scan workflow\n├── action.yml                  # Reusable GitHub Action\n├── Dockerfile                  # Container with all scanners\n└── docker-compose.yml          # Local scan + dashboard generation\n```\n\n## Scanners\n\n| Scanner | Type | What it detects |\n|---------|------|-----------------|\n| **Gitleaks** | Secrets | API keys, tokens, passwords in code |\n| **Trivy** | Dependencies | CVEs in packages and container images |\n| **Semgrep** | SAST | Code security issues, injection flaws |\n| **Checkov** | IaC | Terraform/CloudFormation misconfigurations |\n| **Grype** | Container | CVEs in container image packages (Anchore) |\n| **TruffleHog** | Secrets | Verified secrets across git history and filesystems |\n\n### Grype \u0026 TruffleHog (scanning/)\n\nStandalone scripts for additional scanning coverage:\n\n```bash\n# Scan a container image with Grype\n./scanning/grype-scan.sh myapp:latest --fail-on high\n\n# Scan repo for verified secrets with TruffleHog\n./scanning/trufflehog-scan.sh . --only-verified\n```\n\nThese are also integrated into the CI security workflow (`.github/workflows/security.yml`).\n\n## Quick Start\n\n### Prerequisites\n\n- Python 3.11+\n- Docker (optional, for containerized scanning)\n\n### Local Setup\n\n```bash\n# Install dependencies\nmake dev\n\n# Run security scan on this repo\nmake scan\n\n# Generate HTML dashboard\nmake dashboard\n```\n\n### Docker\n\n```bash\n# Scan a local directory\nSCAN_PATH=/path/to/repo docker compose up --build\n\n# Results in ./reports/\n```\n\n### GitHub Action\n\n```yaml\n# .github/workflows/security.yml\nname: Security Scan\non: [push, pull_request]\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: your-org/devsecops-pipeline@v1\n        with:\n          path: '.'\n          fail-on-critical: 'true'\n          bedrock-enabled: 'false'\n```\n\n## Action Inputs\n\n| Input | Description | Default |\n|-------|-------------|---------|\n| `path` | Path to scan | `.` |\n| `fail-on-critical` | Fail if critical findings exist | `true` |\n| `bedrock-enabled` | Enable AI analysis via AWS Bedrock | `false` |\n| `bedrock-model-id` | Bedrock model ID | `anthropic.claude-3-haiku-20240307-v1:0` |\n| `severity-threshold` | Minimum severity to report | `MEDIUM` |\n\n## Action Outputs\n\n| Output | Description |\n|--------|-------------|\n| `risk-score` | Overall risk score (0-100) |\n| `report-path` | Path to the HTML dashboard |\n| `total-findings` | Total number of findings |\n| `critical-count` | Number of critical findings |\n\n## Risk Scoring\n\nFindings are weighted by severity to produce a 0-100 risk score:\n\n| Severity | Weight |\n|----------|--------|\n| CRITICAL | 10 |\n| HIGH | 5 |\n| MEDIUM | 2 |\n| LOW | 1 |\n| INFO | 0 |\n\nThe score caps at 100.\n\n## AI Analysis (AWS Bedrock)\n\nWhen `BEDROCK_ENABLED=true`, the pipeline sends findings to AWS Bedrock for:\n\n- **Risk Assessment** — AI-generated executive summary with severity classification\n- **Remediation Guidance** — Prioritized fix suggestions for each finding\n- **Pattern Detection** — Identification of recurring vulnerability patterns\n\nThe AI analysis gracefully degrades to a structured fallback report when Bedrock is unavailable.\n\n### Required IAM Permissions\n\n```json\n{\n  \"Effect\": \"Allow\",\n  \"Action\": [\"bedrock:InvokeModel\"],\n  \"Resource\": \"arn:aws:bedrock:*::foundation-model/anthropic.claude-3-haiku-20240307-v1:0\"\n}\n```\n\n## AWS Deployment (Terraform)\n\nDeploy as an automated scanning service:\n\n```bash\ncd terraform\nterraform init\nterraform plan -var=\"notification_emails=[\\\"security@example.com\\\"]\"\nterraform apply\n```\n\nThis creates:\n- **Lambda function** running scans on a schedule\n- **S3 bucket** for result storage (encrypted, versioned)\n- **SNS topic** for security alerts\n- **CloudWatch rule** for periodic execution\n\n## Dashboard\n\nThe HTML dashboard is self-contained (no server required) and includes:\n\n- Risk score gauge (color-coded 0-100)\n- Scanner results summary table\n- Findings table (sortable by severity)\n- Charts (findings by severity, findings by scanner)\n- AI analysis panel (when Bedrock is enabled)\n\n## Development\n\n```bash\nmake dev        # Install all dependencies\nmake lint       # Run linters (ruff, mypy)\nmake format     # Auto-format code\nmake test       # Run tests\nmake test-cov   # Tests with coverage report\n```\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbasel5001%2Fdevsecops-pipeline","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbasel5001%2Fdevsecops-pipeline","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbasel5001%2Fdevsecops-pipeline/lists"}