{
  "id": 17773487,
  "title": "DevSecOps Pipeline from Scratch: Gates That Block Bad Code",
  "url": "https://urgent.news/2026/11/02/devsecops-pipeline-from-scratch-gates-that-block-bad-code",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T09:20:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/devopsinterview_cloud/devsecops-pipeline-from-scratch-gates-that-block-bad-code-3jkf"
  },
  "original_language": "en",
  "account": "To build a DevSecOps pipeline from scratch for a Kubernetes-based microservices stack, start by addressing security left from the developer's perspective. The first layer is secrets detection, implemented via a pre-commit hook that scans for keys, tokens and passwords in commits. This step is enforced in CI using gitleaks, a tool that can be skipped if needed, but should be required for production changes. The second layer is static application security testing (SAST), which examines the code and how it calls libraries for injection flaws and insecure patterns. Implement SAST with every pull request using a job called pr-security. The third layer is software composition analysis (SCA), which identifies known CVEs in direct and transitive dependencies. SCA also runs on every pull request and checks for vulnerable libraries. The fourth layer is image scanning and signing, performed after the build. This step checks the OS packages and application dependencies inside the container image for CVEs. The build fails if vulnerabilities are found, and only passing images are signed. The final layer is admission control at the Kubernetes API server. Unsigned images, privileged or root pods are rejected by the API server, blocking changes that have bypassed the previous layers. Following the same workflow for secrets scanning and SAST on pull requests involves using gitleaks as a pre-commit hook and Semgrep for additional checks. Both jobs should be required status checks in branch protection or a ruleset to act as gates for merge. Finally, Trivy is used for both SCA and image scanning. Trivy fs reads the lockfiles to cover transitive dependencies and scans the container image for CVEs. After building the image, Trivy image scans the OS packages and application dependencies inside it. The signing process uses Cosign to sign an image that already exists in a registry, ensuring the immutable digest is protected.",
  "summary": "\"We want to shift security left. Walk me through how you would build a DevSecOps pipeline from scratch for a Kubernetes-based microservices stack.\" Naming tools does not answer it. The interviewer wants to know why each layer of the pipeline exists, what it catches, what it misses, and where it blocks a change instead of warning about it. This post builds that answer layer by layer, with…",
  "key_points": [
    "Implement secrets detection via pre-commit hook scanning for keys, tokens, and passwords",
    "Enforce static application security testing (SAST) on every pull request with pr-security job",
    "Use Trivy for software composition analysis (SCA) and image scanning, blocking unsigned images"
  ],
  "editors_take": "Layering automated scanning and admission control transforms security from a final checkpoint into an integrated series of mandatory gates that prevent vulnerable code from ever reaching production environments.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}