Security Scanning in CI/CD Pipelines (DevSecOps)

DevSecOps Culture

The principle of considering security at the very beginning of the process rather than the last step is called "shift-left". Integrating tools like SonarQube, Trivy, and Snyk into your CI pipeline is the first step of this process.

Container Scanning with Trivy

stages:
  - test
  - scan

trivy_scan:
  stage: scan
  image: aquasec/trivy:latest
  script:
    - trivy image my-app-image:latest

This simple step allows you to instantly catch critical vulnerabilities in an image pushed to the repo.