From Security Testing To Deployment In a Single PR
Talkat KubeCon + CloudNativeCon North America 2022 · on Friday, 2022-10-28· at 11:55· Ambassador Ballroom (Room 360)·
summary
Automates build, image build, dependency and IaC scans from one PR using GitHub Actions and a single YAML that triggers tfsec and Trivy plus CodeQL and Dependabot; branch protection blocks merges if scans exceed configured thresholds (set to fail on high/critical). Demo on the Stork repo shows a SQL injection and a dependency Denial‑of‑Service flagged in-PR, an Ubuntu base image introducing 15 alerts, and failing PRs prevented from merging — all working end-to-end.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:34Motivation
- 6:28Types of Security Scanning
- 7:38Typical Workflow
- 9:19Improved Workflow
- 10:31Demo Project: Stork
- 27:21Takeaways
related talks
35mFrom Builds & CI to Security Testing in a Single PR
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
01h 00mSecurely deploying Infrastructure as Code
20mA Practical Guide to CI/CD Security Gating
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
37mA Secure Continuous Delivery Pipeline
59mDevOps for the Discouraged