How to Add Security Checks to a CI/CD Pipeline (Secrets, SAST, Dependencies, Images)

Step by step

1. Scan for secrets

   Gitleaks finds API keys, passwords and tokens in code and Git history.

   gitleaks detect --source . --redact -v
   

2. Run static analysis (SAST)

   Semgrep checks code for common security bugs such as injection and unsafe deserialisation.

   semgrep scan --config auto --error
   

3. Check dependencies and IaC

   Trivy scans dependencies, Dockerfiles, Terraform and Kubernetes files.

   trivy fs --scanners vuln,misconfig --severity HIGH,CRITICAL --exit-code 1 .
   

4. Scan the built image

   After docker build, scan the exact image you are going to deploy.

   trivy image --ignore-unfixed --severity CRITICAL --exit-code 1 registry.example.com/app:${GIT_SHA}
   

5. Put it together in CI

   Example GitHub Actions job (similar for other CI systems):

   jobs:
     security:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v4
           with: { fetch-depth: 0 }
         - run: docker run --rm -v $PWD:/repo zricethezav/gitleaks:latest detect --source /repo --redact
         - run: docker run --rm -v $PWD:/src semgrep/semgrep semgrep scan --config auto --error /src
         - run: docker run --rm -v $PWD:/src aquasec/trivy:latest fs --exit-code 1 --severity HIGH,CRITICAL /src
   

6. Protect the main branch

   Require the security job to pass and a code review before merging. Nobody pushes directly to main.

7. Handle findings

   Fix real issues, mark false positives with a comment, and track accepted risks with an owner and expiry date.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.