Sample Secure Pipeline with GithHub Actions - Ideal for Open Source Projects
- Add Snyk API Token in GitHub Repositority Secrets - SNYK_TOKEN
- Add Git Guardian API Token for in GitHub Repositority Secrets - GITGUARDIAN_API_KEY
| Step | Github Action | Comments | Open Source Alternative |
|---|---|---|---|
| Secrets Scanner | GitGuardian | truffleHog | |
| SCA - Dependency Checker | snyk | OWASP Dependency Check | |
| Static Code Analysis | Spot Bugs | ||
| Static Code Analysis | CodeQL | ||
| Container Scan | Anchore | ||
| Container Lint | Dockle | ||
| K8s Hardening | Dockle | ||
| License Checker | License finder | ||
| DAST | OWASP ZAP Basline Scan | ||
