ci: add DevSecOps security gates #13

Open

inv3ntor01 wants to merge 2 commits from inv3ntor01/feature/devsecops-pipeline into main

inv3ntor01 commented

2026-06-13 06:05:33 +00:00

(Migrated from github.com)

What this does

Adds automated security gates to catch vulnerabilities, secrets, and insecure code before they reach production.

1. gitleaks — secrets detection

Local: .pre-commit-config.yaml blocks secrets at commit time
CI: secrets-scan.yml scans every PR for leaked API keys, tokens, passwords
Catches: AWS keys, GitHub tokens, Stripe keys, database credentials, .env secrets

2. pre-commit hooks — defense in depth

Local hooks: YAML/JSON validation, gitleaks, semgrep SAST
CI: pre-commit-ci.yml runs the full pre-commit suite on GitHub for contributors who don't have hooks installed locally

3. Trivy — dependency vulnerability scanning

New: trivy-scan.yml scans Composer and npm dependencies for known CVEs
Blocks: pipeline fails on CRITICAL vulnerabilities
Tracks: HIGH severity CVEs surface in the GitHub Security tab (SARIF upload) for monitoring without blocking

Why now

LaraKube generates infrastructure that other developers run in production (Docker containers, Kubernetes manifests). Before adding more generated infrastructure, we need the security foundation in place to ensure the tool itself ships without known vulnerabilities and contributors don't accidentally leak secrets.

Files added

File	Purpose
`.pre-commit-config.yaml`	Local pre-commit hooks (gitleaks + semgrep + file hygiene)
`.github/workflows/secrets-scan.yml`	gitleaks CI workflow on every push/PR
`.github/workflows/pre-commit-ci.yml`	Pre-Commit CI runs hooks on GitHub
`.github/workflows/trivy-scan.yml`	Trivy filesystem scan of Composer/npm deps

## What this does Adds automated security gates to catch vulnerabilities, secrets, and insecure code before they reach production. ### 1. gitleaks — secrets detection - **Local:** `.pre-commit-config.yaml` blocks secrets at commit time - **CI:** `secrets-scan.yml` scans every PR for leaked API keys, tokens, passwords - Catches: AWS keys, GitHub tokens, Stripe keys, database credentials, `.env` secrets ### 2. pre-commit hooks — defense in depth - **Local hooks:** YAML/JSON validation, gitleaks, semgrep SAST - **CI:** `pre-commit-ci.yml` runs the full pre-commit suite on GitHub for contributors who don't have hooks installed locally ### 3. Trivy — dependency vulnerability scanning - **New:** `trivy-scan.yml` scans Composer and npm dependencies for known CVEs - **Blocks:** pipeline fails on CRITICAL vulnerabilities - **Tracks:** HIGH severity CVEs surface in the GitHub Security tab (SARIF upload) for monitoring without blocking ## Why now LaraKube generates infrastructure that other developers run in production (Docker containers, Kubernetes manifests). Before adding more generated infrastructure, we need the security foundation in place to ensure the tool itself ships without known vulnerabilities and contributors don't accidentally leak secrets. ## Files added | File | Purpose | |---|---| | `.pre-commit-config.yaml` | Local pre-commit hooks (gitleaks + semgrep + file hygiene) | | `.github/workflows/secrets-scan.yml` | gitleaks CI workflow on every push/PR | | `.github/workflows/pre-commit-ci.yml` | Pre-Commit CI runs hooks on GitHub | | `.github/workflows/trivy-scan.yml` | Trivy filesystem scan of Composer/npm deps |

github-advanced-security[bot] commented

2026-06-13 06:06:12 +00:00

(Migrated from github.com)

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. ### What Enabling Code Scanning Means: - The 'Security' tab will display more code scanning analysis results (e.g., for the default branch). - Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. - You will be able to see the analysis results for the pull request's branch on this [overview](/luchavez-technologies/larakube-cli/security/code-scanning?query=pr%3A13+is%3Aopen) once the scans have completed and the checks have passed. For more information about GitHub Code Scanning, check out [the documentation](https://docs.github.com/code-security/code-scanning/introduction-to-code-scanning/about-code-scanning).

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin inv3ntor01/feature/devsecops-pipeline:inv3ntor01/feature/devsecops-pipeline

git switch inv3ntor01/feature/devsecops-pipeline

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff inv3ntor01/feature/devsecops-pipeline

git switch inv3ntor01/feature/devsecops-pipeline

git rebase main

git switch main

git merge --ff-only inv3ntor01/feature/devsecops-pipeline

git switch inv3ntor01/feature/devsecops-pipeline

git rebase main

git switch main

git merge --no-ff inv3ntor01/feature/devsecops-pipeline

git switch main

git merge --squash inv3ntor01/feature/devsecops-pipeline