https://github.com/basel5001/devsecops-pipeline
Complete DevSecOps scanning platform: SAST, SCA, IaC, secrets + AI risk analysis (AWS Bedrock)
https://github.com/basel5001/devsecops-pipeline
aws-bedrock checkov devsecops github-action gitleaks sast security-scanning semgrep trivy
Last synced: 17 days ago
JSON representation
Complete DevSecOps scanning platform: SAST, SCA, IaC, secrets + AI risk analysis (AWS Bedrock)
- Host: GitHub
- URL: https://github.com/basel5001/devsecops-pipeline
- Owner: basel5001
- License: mit
- Created: 2026-06-30T18:43:16.000Z (about 1 month ago)
- Default Branch: main
- Last Pushed: 2026-07-19T02:03:26.000Z (22 days ago)
- Last Synced: 2026-07-19T04:06:53.201Z (22 days ago)
- Topics: aws-bedrock, checkov, devsecops, github-action, gitleaks, sast, security-scanning, semgrep, trivy
- Language: Python
- Size: 57.6 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 8
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
- Security: SECURITY.md
Awesome Lists containing this project
README
# DevSecOps Security Scanning Pipeline
Comprehensive security scanning platform that orchestrates SAST, dependency scanning, container scanning, IaC scanning, and secrets detection. Includes AI-powered risk analysis via AWS Bedrock and a self-contained HTML results dashboard.
## Architecture
```
devsecops-pipeline/
├── src/
│ ├── scanners/
│ │ └── orchestrator.py # Main orchestrator - runs all scanners
│ ├── ai/
│ │ └── analyzer.py # AWS Bedrock AI analysis
│ └── dashboard/
│ └── index.html # Self-contained HTML dashboard
├── terraform/ # AWS deployment (Lambda + S3 + SNS)
├── tests/ # Unit tests
├── .github/
│ └── workflows/
│ ├── ci.yml # CI pipeline (lint, test, docker)
│ └── security.yml # Security scan workflow
├── action.yml # Reusable GitHub Action
├── Dockerfile # Container with all scanners
└── docker-compose.yml # Local scan + dashboard generation
```
## Scanners
| Scanner | Type | What it detects |
|---------|------|-----------------|
| **Gitleaks** | Secrets | API keys, tokens, passwords in code |
| **Trivy** | Dependencies | CVEs in packages and container images |
| **Semgrep** | SAST | Code security issues, injection flaws |
| **Checkov** | IaC | Terraform/CloudFormation misconfigurations |
| **Grype** | Container | CVEs in container image packages (Anchore) |
| **TruffleHog** | Secrets | Verified secrets across git history and filesystems |
### Grype & TruffleHog (scanning/)
Standalone scripts for additional scanning coverage:
```bash
# Scan a container image with Grype
./scanning/grype-scan.sh myapp:latest --fail-on high
# Scan repo for verified secrets with TruffleHog
./scanning/trufflehog-scan.sh . --only-verified
```
These are also integrated into the CI security workflow (`.github/workflows/security.yml`).
## Quick Start
### Prerequisites
- Python 3.11+
- Docker (optional, for containerized scanning)
### Local Setup
```bash
# Install dependencies
make dev
# Run security scan on this repo
make scan
# Generate HTML dashboard
make dashboard
```
### Docker
```bash
# Scan a local directory
SCAN_PATH=/path/to/repo docker compose up --build
# Results in ./reports/
```
### GitHub Action
```yaml
# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: your-org/devsecops-pipeline@v1
with:
path: '.'
fail-on-critical: 'true'
bedrock-enabled: 'false'
```
## Action Inputs
| Input | Description | Default |
|-------|-------------|---------|
| `path` | Path to scan | `.` |
| `fail-on-critical` | Fail if critical findings exist | `true` |
| `bedrock-enabled` | Enable AI analysis via AWS Bedrock | `false` |
| `bedrock-model-id` | Bedrock model ID | `anthropic.claude-3-haiku-20240307-v1:0` |
| `severity-threshold` | Minimum severity to report | `MEDIUM` |
## Action Outputs
| Output | Description |
|--------|-------------|
| `risk-score` | Overall risk score (0-100) |
| `report-path` | Path to the HTML dashboard |
| `total-findings` | Total number of findings |
| `critical-count` | Number of critical findings |
## Risk Scoring
Findings are weighted by severity to produce a 0-100 risk score:
| Severity | Weight |
|----------|--------|
| CRITICAL | 10 |
| HIGH | 5 |
| MEDIUM | 2 |
| LOW | 1 |
| INFO | 0 |
The score caps at 100.
## AI Analysis (AWS Bedrock)
When `BEDROCK_ENABLED=true`, the pipeline sends findings to AWS Bedrock for:
- **Risk Assessment** — AI-generated executive summary with severity classification
- **Remediation Guidance** — Prioritized fix suggestions for each finding
- **Pattern Detection** — Identification of recurring vulnerability patterns
The AI analysis gracefully degrades to a structured fallback report when Bedrock is unavailable.
### Required IAM Permissions
```json
{
"Effect": "Allow",
"Action": ["bedrock:InvokeModel"],
"Resource": "arn:aws:bedrock:*::foundation-model/anthropic.claude-3-haiku-20240307-v1:0"
}
```
## AWS Deployment (Terraform)
Deploy as an automated scanning service:
```bash
cd terraform
terraform init
terraform plan -var="notification_emails=[\"security@example.com\"]"
terraform apply
```
This creates:
- **Lambda function** running scans on a schedule
- **S3 bucket** for result storage (encrypted, versioned)
- **SNS topic** for security alerts
- **CloudWatch rule** for periodic execution
## Dashboard
The HTML dashboard is self-contained (no server required) and includes:
- Risk score gauge (color-coded 0-100)
- Scanner results summary table
- Findings table (sortable by severity)
- Charts (findings by severity, findings by scanner)
- AI analysis panel (when Bedrock is enabled)
## Development
```bash
make dev # Install all dependencies
make lint # Run linters (ruff, mypy)
make format # Auto-format code
make test # Run tests
make test-cov # Tests with coverage report
```
## License
MIT