DevSecOps & Compliance — Security von Anfang an

# Security Scan Pipeline Stage
security-scan:
  stage: security
  parallel:
    matrix:
      - SCAN_TYPE:
        - sast
        - dependency-check
        - container-scan
  script:
    - |
      case $SCAN_TYPE in
        sast)
          semgrep --config auto ./src
          ;;
        dependency-check)
          trivy fs --severity HIGH,CRITICAL .
          syft . -o cyclonedx-json > sbom.json
          ;;
        container-scan)
          trivy image $CI_REGISTRY_IMAGE
          cosign verify $CI_REGISTRY_IMAGE
          ;;
      esac

policy-check:
  stage: security
  script:
    - opa eval -d policies/ -i scan-results.json
      "data.security.allow"
  allow_failure: false