CI/CD Security Pipeline: GitLab DevSecOps Setup

# .gitlab-ci.yml - Complete Security Pipeline
stages:
  - pre-build
  - build
  - test
  - security
  - deploy

variables:
  SECURE_LOG_LEVEL: "info"
  SAST_ANALYZER_IMAGE_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"
  DAST_ANALYZER_IMAGE_PREFIX: "$CI_TEMPLATE_REGISTRY_HOST/security-products"

# Pre-build security checks
pre-commit-security:
  stage: pre-build
  script:
    - echo "Running pre-commit security checks"
    - git secrets --scan
    - pre-commit run --all-files
  rules:
    - if: '$CI_PIPELINE_SOURCE == "push"'

# SAST - Static Application Security Testing
sast:
  stage: security
  artifacts:
    reports:
      sast: gl-sast-report.json
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

# Dependency Scanning
dependency-scanning:
  stage: security
  artifacts:
    reports:
      dependency_scanning: gl-dependency-scanning-report.json
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

# Container Scanning
container-scanning:
  stage: security
  variables:
    GIT_STRATEGY: none
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      exists:
        - Dockerfile

# Secret Detection
secret-detection:
  stage: security
  artifacts:
    reports:
      secret_detection: gl-secret-detection-report.json
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

# Advanced security scanning with custom tools
advanced-security:
  stage: security
  image: python:3.11
  before_script:
    - pip install bandit semgrep safety
  script:
    # Python security scanning
    - bandit -r . -f json -o bandit-report.json
    - semgrep --config=auto --json --output=semgrep-report.json .
    - safety check --json --output=safety-report.json
    
    # Infrastructure security scanning
    - pip install tfsec-checkov
    - checkov --framework terraform --output json --output-file checkov-report.json .
    
    # Container security scanning
    - docker build -t temp-image .
    - trivy image --format json --output trivy-report.json temp-image
  artifacts:
    reports:
      sast: bandit-report.json
    paths:
      - semgrep-report.json
      - safety-report.json
      - checkov-report.json
      - trivy-report.json
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'

# DAST - Dynamic Application Security Testing
dast:
  stage: security
  variables:
    DAST_WEBSITE: "https://$CI_ENVIRONMENT_URL"
    DAST_FULL_SCAN_ENABLED: "true"
    DAST_BROWSER_SCAN: "true"
  artifacts:
    reports:
      dast: gl-dast-report.json
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: manual

# .gitlab/security-policy.yml
# Security policy for vulnerability management
security_policy:
  vulnerability_management:
    enabled: true
    cadence: "monthly"
    auto_resolve: false
    
    # Critical vulnerabilities require immediate action
    critical_vulnerabilities:
      auto_create_issue: true
      due_in: "7 days"
      
    # High vulnerabilities
    high_vulnerabilities:
      auto_create_issue: true
      due_in: "30 days"
      
    # Medium vulnerabilities
    medium_vulnerabilities:
      auto_create_issue: false
      due_in: "90 days"

# Approval policies for security
approval_policies:
  security_approvals:
    enabled: true
    rules:
      - name: "Security team approval for critical changes"
        conditions:
          - when: "critical_security_change"
            approvals_required: 2
            eligible_approvers: ["security-team"]