DevSecOps Pipelines Developers Will Not Bypass

Security that slows people down gets routed around, a skipped check is worse than no check because it looks green. The trick is to make the secure path the fast path: quick, actionable, and mostly automatic.

The gates that earn their place

1. Secret scanning on every commit (fail fast, fail local)

2. Dependency and CVE scanning with a severity budget

3. SAST tuned to near-zero false positives

4. IaC and policy-as-code before anything touches the cluster

5. Signed artifacts so only what CI built can deploy

A pipeline that stays under 5 minutes

Run the cheap, high-signal checks first so feedback is instant. Everything here fails the build on real findings, not noise:

name: ci
on: [pull_request]
jobs:
 security:
 runs-on: ubuntu-latest
 permissions: { contents: read }
 steps:
 - uses: actions/checkout@b4ffde6 # pin to a SHA, not a tag
 - name: Secrets
 run: gitleaks detect --redact --exit-code 1
 - name: Dependencies (fail on High/Critical)
 run: trivy fs --severity HIGH,CRITICAL --exit-code 1 .
 - name: IaC policy
 run: trivy config --exit-code 1 ./deploy
 - name: SAST
 uses: github/codeql-action/analyze@v3

Policy as code, not policy as wiki

A wiki page nobody reads is not a control. Encode the rule so the pipeline enforces it, here, block any image that is not from our registry:

package main

deny[msg] {
 input.kind == "Deployment"
 c := input.spec.template.spec.containers[_]
 not startswith(c.image, "registry.internal/")
 msg := sprintf("image %v is not from the trusted registry", [c.image])
}

Wire it in with conftest test ./deploy as a required check. The feedback lands in the PR, in seconds, with the exact line to fix.

The human side

• Every failure prints the fix, not just the finding

• Findings are triaged with a severity budget, not a zero-tolerance tantrum

• Security owns the tooling; teams own their results

• Exceptions are time-boxed and tracked in code, never verbal

The most secure control is the one developers never feel the urge to disable.

DevSecOps is culture with a CI backbone. Make the guardrails fast and legible, and secure-by-default stops being a slogan and starts being the path of least resistance.