CI Security Gates
Add SAST, image scanning and SBOM to a pipeline.
0 of 6 steps
What you will end up with
Automated security scanning
A generated SBOM
Failing gates on critical issues
Build steps
0/6Add a step that runs a static analysis tool against your source code on every push. SAST reads your code like a proofreader looking for known bad patterns, without ever actually running it.
Add a step that checks your lockfile’s package versions against a known vulnerability database. This checks every ingredient’s label against a recall list before it ever goes in the pot.
After building the Docker image, scan it directly for vulnerable OS packages and layers. Now you are checking the finished, packaged product, not just the recipe that made it.
Run a tool against the image to produce a file listing every package inside it. An SBOM is the ingredients label stuck on the box, so anyone can see exactly what is in there later.
Set the scanner’s severity threshold so the CI job fails outright when a critical issue is found. This is the bouncer refusing entry, not just writing a note about who showed up.
Upload the scan’s output as a CI artifact or into your repo’s security tab so the team can see trends over time. File the inspection report where everyone can find it later, not in a drawer nobody opens.
Before you start