Pipelines

Jan 1, 0001

Definition

Pipelines in the context of DevSecOps refer to automated workflows that manage the processes of building, testing, and deploying software applications. These pipelines integrate security practices at every stage, ensuring that code is continuously checked for vulnerabilities and compliance with security policies. By automating these processes, pipelines help maintain consistent security standards and reduce the risk of human error.

Secure Settings Example

stages:
  - build
  - test
  - deploy

build:
  script:
    - echo "Building the application..."
    - ./gradlew build
  artifacts:
    paths:
      - build/libs/
  only:
    - main

test:
  script:
    - echo "Running security tests..."
    - ./gradlew test
    - ./gradlew check --info
  allow_failure: false

deploy:
  script:
    - echo "Deploying to production..."
    - ./deploy.sh
  environment:
    name: production
    url: https://production.example.com
  only:
    - tags

Insecure Settings Example

stages:
  - build
  - test
  - deploy

build:
  script:
    - echo "Building the application..."
    - ./gradlew build

test:
  script:
    - echo "Running tests..."
    - ./gradlew test
  allow_failure: true

deploy:
  script:
    - echo "Deploying to production..."
    - ./deploy.sh
  environment:
    name: production
    url: http://production.example.com
  only:
    - branches