Secure by Default: Building an AI-Augmented, OSS-Powered Reusable CI/CD Pipeline
Talkat Open Source Summit India 2026 · on Wednesday, 2026-06-17· at 12:00· Lotus Ballroom 3 (Level 3)·
summary
Reusable GitHub Actions/GitLab CI pipeline that 150+ repositories adopt with zero extra config, enforcing GitLeaks secret scanning, OSV Scanner for new vulnerable deps (blocks new but allows legacy with audit), CycloneDX → Dependency-Track BOM inventory, Trivy image scans, and SonarQube Community quality gates. An AI layer of three agents (debug, Sonar auto‑heal, version control) inspects failures, makes commits on the same PR, reruns tests, bumps semantic versions, signs artifacts with cosign, and posts a summary comment — demo shows actual auto‑fix commits and pipeline gating.
AI-written summary · about
chapters (10)
- 0:00Secure CI/CD pipelines
- 3:57Motivation for reusable pipelines
- 8:57Demo setup and flow
- 10:14Demo with failed test
- 14:14Demo with SonarQube issue
- 19:10AI agent architecture
- 23:01Open source security tools
- 30:25Software bill of materials with CycloneDX
- 34:18Release pipeline with semantic versioning
- 38:20Key takeaways
related talks
37mA Secure Continuous Delivery Pipeline
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack
23mBuilding Secure Package Pipelines
42mHow To Have Visibility And Security OF A CICD Pipeline
32mBuilding a Secure By-Design Pipeline with an Open Source Stack- 32mBuilding a Secure By-Design Pipeline with an Open Source Stack
17mShift-Left Security in Practice with Gitlab
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows