Mini Demo: Secure Pipeline with SAST, SCA, Secret Scanning, SBOM, and Signing

A compact demo showing which evidence artifacts each security gate can produce.

Gitleaks secret scanning output.

Container scanning output.

Cosign signing and verification output.

Security summary of the demo pipeline.

Demo scenario

To keep the model practical, I framed it around a small demo system: a web API, a Dockerfile, a dependency file, and an example IaC configuration. The goal is not to build a flawless production pipeline. The goal is to show how each gate can produce evidence.

The flow includes checkout, secret scanning, SAST, SCA, IaC scanning, build, unit test, container scanning, SBOM generation, artifact signing, provenance verification, policy gate evaluation, and release summary.

Example GitHub Actions flow

The example below is a simplified pipeline skeleton for Medium. In real use, organization policy, runner security, secret management, and artifact retention policies should also be addressed.

name: secure-ci

on:
  pull_request:
  push:
    branches: [main]

jobs:
  security-gates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Secret scanning
        run: gitleaks detect --report-format json --report-path reports/gitleaks.json
      - name: SAST
        run: semgrep ci --json --output reports/semgrep.json
      - name: Container scan
        run: trivy image demo:${{ github.sha }} --format json --output reports/container.json
      - name: Generate SBOM
        run: syft demo:${{ github.sha }} -o cyclonedx-json > reports/sbom.json
      - name: Sign artifact
        run: cosign sign --yes demo:${{ github.sha }}
      - name: Verify policy gate
        run: conftest test reports --policy policy

Policy-as-Code example

The purpose of the policy layer is to combine the outputs of multiple tools into a single decision point.

package cicd.gates

default allow = false

deny[msg] if {
  input.gitleaks.new_secret_count > 0
  msg := "New secret detected"
}

deny[msg] if {
  input.sbom.present == false
  msg := "SBOM is missing"
}

deny[msg] if {
  input.provenance.verified == false
  msg := "Provenance could not be verified"
}

allow if {
  count(deny) == 0
}

Main takeaway from the demo

Individual tool outputs are useful, but the real value appears when they converge into a release decision. Gitleaks, Trivy, Syft, Cosign, and Conftest each produce separate outputs. The SSDF-to-Gates approach turns those outputs into gate evidence.