awesome-security-pipeline - Practical, continuously verified open-source DevSe

项目说明

Awesome Security Pipeline

![Awesome]()
![License: CC0-1.0]()
![Security Baseline]()

> The practical, continuously guide to selecting and implementing open-source security tools at every CI/CD pipeline stage.

92 metadata- repositories · 6 recipe-tested controls · catalog July 16, 2026

Start with a working pipeline, not an empty checklist. The included GitHub Actions baseline runs Gitleaks, Semgrep, OS, Trivy, Syft, and keyless Cosign against a safe demo, retains machine-readable e, and passed end to end in 2m21s on GitHub-hosted runners.

Maintenance promise: repository status is checked weekly, license and documentation e monthly, and the tested recipe after every relevant change and at least monthly. Classification rules and exceptions are public in the methodology.

Run the tested pipeline → · Choose controls for your project · Browse tools by pipeline stage · Read the methodology


Start here

| If you want to… | Start with |
|---|---|
| See a complete working implementation | 10-minute quick start |
| Understand the architecture and measured implementation findings | Technical implementation article |
| Understand every job, artifact, permission, and failure mode | Security demo guide |
| Review user- release changes and e | Changelog |
| Choose a smaller or more specialized stack | Project-type selection matrix |
| Compare GitHub Actions security tools and permissions | Open-source stack comparison |
| Choose an SBOM generator and workflow | SBOM tools comparison |
| Inspect continuously tested SBOM compatibility history | SBOM benchmark reports |
| E why these tools were selected | Reference stack decision |
| Check how projects are selected and classified | Curation and methodology |

10-minute quick start

The fastest safe trial is to run the committed demo in a fork. It requires only a GitHub account and GitHub Actions; it requires no cloud account, custom secret, registry, or deployment.

1. Fork this repository and enable GitHub Actions in the fork.
2. Open Actions → Security Baseline → Run workflow and select the default branch.
3. Confirm the Secrets, SAST, Dependencies, IaC, Build, and Package jobs pass.
4. Inspect the named scan reports, CycloneDX SBOM, exported image, and immutable digest under Artifacts.
5. To test keyless signing, push the unchanged workflow to the fork's default branch or a v* tag. Manual and pull-request runs intentionally skip signing.

To adapt the baseline in another repository, copy these paths first, then change the examples/security-demo/app scan and build paths to your application:

The default policy fails on detected secrets, configured high-confidence SAST findings, any published dependency , and fixed HIGH/CRITICAL configuration or image findings. SARIF upload requires GitHub code scanning support; all reports remain downloadable workflow artifacts. See the demo guide before changing thresholds or permissions.

Choose your baseline

Use the smallest set that covers the artifacts you actually ship. “Regulated” below is a starting architecture, not a compliance claim.

| Project type | Start with | Add when applicable | Why |
|---|---|---|---|
| Library | Gitleaks, Semgrep, OS | Syft for release SBOMs; Cosign for signed release files | Protect source and dependencies without container-only stages. |
| Web application | Gitleaks, Semgrep, OS | ZAP against a controlled test deployment | Combine source/dependency gates with explicit dynamic testing. |
| Container service | Tested baseline: Gitleaks, Semgrep, OS, Trivy, Syft, Cosign | Runtime detection such as Falco when operating the service | Co, image, SBOM, and signed-package risks. |
| Kubernetes service | Container-service baseline | Tri scanning, Kyverno or Gatekeeper admission policy, runtime detection | Separate build-time e from cluster admission and runtime controls. |
| Regulated project | Relevant baseline above with retained SARIF, SBOM, digest, and signature | Organization-specific policy, approvals, pro, and e retention | Produce re e while leaving control mapping to the applicable framework. |

Contents

---

Tool catalog

Entries below are organized by where they operate in a delivery pipeline. Status reflects repository activity, not security effecti; stars indicate adoption, not quality. Multi-purpose tools may appear in more than one category with a category-specific description.

Pre-commit & Secrets Detection

Catch secrets and credentials before they enter your repository.

SBOM Generation

Generate Software Bill of Materials for supply chain .

Artifact Signing &

Sign and container images and artifacts for supply chain security.

Supply Chain Compliance

Audit and supply chain security against industry benchmarks.

Software Composition Analysis (SCA)

Scan dependencies for known .

Static Application Security Testing (SAST)

Analyze source code for security .

Multi-language

Tools that support multiple programming languages.

Language-specific

Specialized tools for indi programming languages.

#### Python

#### Ja/Node.js

#### Go

#### Ruby

#### PHP

#### Rust

Infrastructure as Code Security

Scan infrastructure configurations for security misconfigurations.

Container Security

Secure container images and runtime en.

Image Scanning

Scan container images for before deployment.

Runtime Security

Monitor and protect containers at runtime.

Kubernetes Security

Secure Kubernetes clusters, manifests, and workloads.

Policy as Code

Define and enforce security policies as code across your infrastructure.

Secret Management

Securely manage and distribute secrets in Kubernetes and GitOps workflows.

API & Dynamic Testing (DAST)

Test running applications for .

Cloud Security

Assess and audit cloud infrastructure security posture.

Legacy and Reference Tools

These projects are retained for migration research and historical context, not recommended for new adoption. They are separated from the acti because their repositories are archived or exceed the project's unmaintained threshold. Prefer the maintained alternati beside an entry or select one from the acti above.

Pre-commit & Secrets Detection

SBOM Generation

Supply Chain Compliance

Static Application Security Testing (SAST) › Multi-language

Static Application Security Testing (SAST) › Language-specific › Python

Static Application Security Testing (SAST) › Language-specific › Ja/Node.js

Infrastructure as Code Security

Container Security › Image Scanning

Container Security › Runtime Security

Kubernetes Security

Policy as Code

API & Dynamic Testing (DAST)

Cloud Security

---

Reading the Badges

Each tool displays status and activity badges for transparency.

Maintenance Status (Updated Weekly)

Status badges are automatically updated every week by our GitHub Action to reflect current maintenance status.

| Badge | Meaning |
|-------|---------|
| !Active | Active - Updated within the last 6 months |
| !Stale | Stale - No updates in 6-12 months; use with caution |
| !Unmaintained | Unmaintained - No updates in 12+ months; consider alternatives |
| !Archived | Archived - Repository has been archived by owner |
| !Deprecated | Deprecated - Officially superseded; migration recommended |

Activity Badges

| Badge | Meaning |
|-------|---------|
| !Stars | GitHub star count - indicates community adoption |
| !Last Commit | Last commit date - shows exact update time |

> Tip: While we update status badges weekly, always the "Last Commit" badge for the most current information before adopting a tool.

Contributing

Contributions are welcome! Please read the contribution guidelines first.

Before submitting:

See CONTRIBUTING.md for full details.

License

![CC0]()

To the extent possible under law, the contributors ha all copyright and related or neighboring rights to this work.

项目信息

开发语言：Python

Star 数：20

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Practical, continuously verified open-source DevSecOps tools and a tested CI/CD security pipeline for GitHub Actions, covering SBOM, SAST, SCA, secrets, containers, and signing.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。