🐺 Okami SecOps Baseline

A minimum security baseline for CI/CD pipelines — in one script and one job.

Five controls that catch the most common supply-chain and pipeline risks before they ship: dependency vulnerabilities (SCA), leaked secrets, container image CVEs, IaC misconfigurations and auditable evidence for every run. Open-source tools only.

🌐 okamiops.com · 📄 Guide (PDF) · Part of the OkamiOps open-source suite.

---

What it checks

#	Control	Tool	Fails the build on
1	Dependencies (SCA)	npm audit / pip-audit / osv-scanner	high & critical vulns
2	Secrets	gitleaks	any verified leak
3	Containers & filesystem	trivy	HIGH / CRITICAL
4	Infrastructure as Code	trivy config	HIGH / CRITICAL misconfig
5	Static analysis + evidence	semgrep (SARIF artifact)	report-only by default

Every scanner writes its output to ./secops-evidence/ — logs, SARIF and JSON you can attach to an audit (LGPD, GDPR, ISO 27001, PCI) or feed into your SIEM.

Quick start

curl -fsSL https://raw.githubusercontent.com/OkamiOps/secops-baseline/main/okami-secops-baseline.sh -o okami-secops-baseline.sh
chmod +x okami-secops-baseline.sh
./okami-secops-baseline.sh

Run it locally first, triage the findings, then make it blocking in CI.

GitHub Actions

# .github/workflows/secops.yml
name: secops-baseline
on: [push, pull_request]
jobs:
  baseline:
    uses: OkamiOps/secops-baseline/.github/workflows/secops-baseline.yml@main

GitLab CI

See gitlab-ci.example.yml.

Adoption path

1. Week 1 — observe. Run report-only (SECOPS_ENFORCE=0). Collect evidence, measure noise.
2. Week 2 — triage. Suppress accepted findings explicitly (.trivyignore, .gitleaksignore) with a comment and an owner.
3. Week 3 — enforce. Set SECOPS_ENFORCE=1. High/critical now block the merge.
4. Ongoing. Review suppressions monthly. When findings recur or nobody owns fixes, the problem is no longer tooling — it's process. That's where OWASP SAMM and a Secure SDLC come in.

Configuration

Variable	Default	Effect
SECOPS_ENFORCE	1	0 = report-only, never fails the build
SECOPS_SEVERITY	HIGH,CRITICAL	Trivy severity gate
SECOPS_EVIDENCE_DIR	./secops-evidence	Where logs/SARIF/JSON land

What this is not

A baseline is triage, not a program. It does not replace threat modeling, an OWASP SAMM assessment or a Secure SDLC. When you outgrow it, that's a good sign.

---

Maintained by OkamiOps — open-source software and remote consulting for secure AI, AppSec and compliance. MIT licensed.