Security in CICD / DevSecOps

• OPA (Open Policy Agent)

  90 9,118 9.6 Go

  Open Policy Agent (OPA) is an open source, general-purpose policy engine.

  

Depends on the area you're focusing on, but OPA is great for a bunch of tools in the ecosystem. We use it for Terraform.

• slsa

  35 1,422 8.7 Shell

  Supply-chain Levels for Software Artifacts

  

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• cosign

  30 4,068 9.6 Go

  Code signing and transparency for containers and binaries

  

most critical thing today is: https://github.com/sigstore/cosign

• gitlab

  448 - -

There's a lot of cool security stuff out there. One place to start could be look at GitLab's "Auto DevOps" and hoping through the template that link to from their ci.yaml.

• DependencyCheck

  11 5,878 9.5 Java

  OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

From OWASP for those class of tools you could look into DependencyCheck and DependencyTrack

• dependency-track

  18 2,315 9.8 Java

  Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

  

From OWASP for those class of tools you could look into DependencyCheck and DependencyTrack

Suggest a related project