From Builds & CI to Security Testing in a Single PR
Talkat Open Source in Finance Forum New York 2022 · on Thursday, 2022-12-08· at 11:55· HUB 2, New York, NY, USA·
summary
Shows how a GitHub Actions pipeline builds containers, runs Trivy image scans, uses CodeQL for data‑flow code analysis, runs tfsec on Terraform, and triggers a dependency review and Dependabot PRs, with branch protection requiring those checks. Merges block on high/critical findings; demo PRs are prevented from merging until SQL injection, outdated Swagger, and vulnerable base image are fixed. Result: security scans and builds run per PR and surface actionable fixes immediately.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:28Motivation
- 4:00Goals
- 5:41Types of Security
- 7:06Typical workflow
- 8:44Improved workflow
- 23:14Takeaways
related talks
38mFrom Security Testing To Deployment In a Single PR
40mSecure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
01h 21mFirst Steps to Full Lifecycle Security with Open Source Tools
20mA Practical Guide to CI/CD Security Gating
37mA Secure Continuous Delivery Pipeline
22mIntegrating Security in the Build Pipeline
17mShift-Left Security in Practice with Gitlab
41mBake Security into your workflow with GitHub Advanced Security and AI