authegg/ci-security-pipeline

CI Security Pipeline

Generate CI/CD pipeline configurations with built-in security scanning stages. Supports GitHub Actions, GitLab CI, and generic pipeline patterns.

When to Use

• Creating new CI/CD pipelines for Docker-based projects
• Adding security scanning to existing pipelines
• Setting up deployment gates that block insecure images
• Generating SBOM and image signing workflows
• When the user mentions "CI security", "pipeline scanning", "deploy gate", or any CI system name

Required Pipeline Stages

Every container CI pipeline MUST include these stages in order:

Stage 1: Dockerfile Lint

Catch misconfigurations before building. Use Hadolint.

# GitHub Actions
- name: Lint Dockerfile
  uses: hadolint/[email protected]
  with:
    dockerfile: Dockerfile
    failure-threshold: warning

# Generic
hadolint Dockerfile
hadolint --failure-threshold warning Dockerfile

Stage 2: Build Image

Use BuildKit. Never cache from untrusted sources.

- name: Build
  run: |
    DOCKER_BUILDKIT=1 docker build \
      --no-cache \
      --tag $IMAGE:$SHA \
      .

Stage 3: Vulnerability Scan

Scan the built image for CVEs. Fail on CRITICAL and HIGH.

# GitHub Actions — Trivy
- name: Scan for vulnerabilities
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ${{ env.IMAGE }}
    exit-code: '1'
    severity: 'CRITICAL,HIGH'
    ignore-unfixed: true

# Generic
trivy image --severity HIGH,CRITICAL --exit-code 1 $IMAGE

Stage 4: Config and Secret Scan

Check for misconfigurations and leaked secrets in the repo.

- name: Config scan
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'config'
    scan-ref: '.'
    exit-code: '1'
    severity: 'CRITICAL,HIGH'

- name: Secret scan
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    scan-ref: '.'
    scanners: 'secret'
    exit-code: '1'

Stage 5: SBOM Generation

Generate and archive a Software Bill of Materials.

- name: Generate SBOM
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ${{ env.IMAGE }}
    format: 'cyclonedx'
    output: 'sbom.json'

- name: Archive SBOM
  uses: actions/upload-artifact@v4
  with:
    name: sbom
    path: sbom.json
    retention-days: 90

Stage 6: Security Gate

All checks must pass before deployment is allowed.

security-gate:
  needs: [lint, scan, sbom]
  runs-on: ubuntu-latest
  steps:
    - run: echo "All security checks passed. Image approved."

Complete GitHub Actions Template

See references/github-actions-template.md for the full ready-to-use workflow file.

Complete GitLab CI Template

See references/gitlab-ci-template.md for the .gitlab-ci.yml version.

Environment Variables

Always set in production CI:

DOCKER_CONTENT_TRUST=1          # Only pull signed images
DOCKER_BUILDKIT=1               # Enable BuildKit features
TRIVY_SEVERITY=CRITICAL,HIGH    # Scan threshold

Tool Installation

If not using pre-built actions:

# Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

# Hadolint
wget -O /usr/local/bin/hadolint https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64
chmod +x /usr/local/bin/hadolint

# Syft (SBOM)
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# Cosign (Image Signing)
go install github.com/sigstore/cosign/v2/cmd/cosign@latest