VisOps-CodeScanning: DevSecOps GitLab CI/CD Template

About This Project: > This DevSecOps CI/CD pipeline template is the core script developed as part of my bachelor's degree graduation project, VisScan (Visibility & Scanning Operations), at Chiang Mai University. The project was designed to seamlessly integrate automated security gates into the software development lifecycle, ensuring that code scanning, secret detection, and container vulnerabilities are addressed with high visibility before deployment.

A comprehensive, ready-to-use DevSecOps pipeline template for GitLab CI/CD. This pipeline is designed to automatically detect the project stack, perform rigorous security audits, compile the code, build container images, and publish them securely.

This template is ideal for implementing Visibility Operations (VisOps) and automated code scanning across various application stacks.

Key Features

• Auto-Detection: Automatically identifies the project stack (Java Maven/Gradle, Node.js, Go, Python, or standard Dockerfile) and adapts the build process accordingly.
• Security First (DevSecOps): * Secret scanning using Gitleaks.
  • Static Application Security Testing (SAST) using Semgrep.
  • Container vulnerability scanning using Trivy.
• Daemonless Image Building: Utilizes Kaniko for building Docker images securely without requiring a Docker daemon.
• Software Bill of Materials (SBOM): Automatically generates CycloneDX SBOMs for the built images.
• Image Signing: Secures releases by signing container images using Cosign.
• Webhook Integration: Sends real-time pipeline status, security metrics, and artifacts to a centralized backend for monitoring and visibility.

Pipeline Stages

The pipeline consists of the following sequential stages:

1. Maintenance (update_trivy_db): Periodically updates and caches the Trivy vulnerability database to speed up subsequent scans.
2. Setup (fetch_and_detect): Clones the target repository and automatically detects the programming language and framework.
3. Security Audit (gitleaks_scan, semgrep_scan): Scans the source code for hardcoded secrets and code vulnerabilities.
4. Compile: Compiles the application based on the detected stack (compile_java_maven, compile_node, etc.). Skipped if SCAN_ONLY mode is active.
5. Build Artifact (build_and_push): Builds the Docker image and pushes a temporary tag to the registry.
6. Container Scan (trivy_scan, generate_sbom): Scans the built container image for OS and library vulnerabilities and generates an SBOM.
7. Release (push_to_hub, sign_image): Promotes the temporary image to the final release tag and signs it with Cosign.
8. Cleanup (cleanup_job): Removes temporary image tags from the registry and reports the final pipeline status.

Prerequisites & Configuration

To use this template, you need to configure the following CI/CD Variables in your GitLab project or group settings (Settings > CI/CD > Variables):

Required Variables

Variable Name	Description	Example
USER_REPO_URL	The URL of the target repository to be cloned and scanned.	https://github.com/user/repo.git
DOCKER_USER	Username for the container registry (e.g., Docker Hub).	myregistryuser
DOCKER_PASSWORD	Password or Access Token for the container registry.	my-secret-token
BACKEND_HOST_URL	The endpoint URL for receiving webhook payloads.	https://api.myvisops.com

Optional Variables

Variable Name	Description	Default Value
GIT_USERNAME	Username for private repository access.	""
GIT_TOKEN	Personal Access Token (PAT) for private repository access.	""
SCAN_MODE	Determines the pipeline behavior. Use SCAN_ONLY to skip builds.	SCAN_AND_BUILD
ENABLE_WEBHOOKS	Toggle webhook notifications on or off.	true
COSIGN_PRIVATE_KEY	Private key string for signing images via Cosign.	""
COSIGN_PASSWORD	Password for the Cosign private key.	""
PROJECT_NAME	Custom name for the scanned project.	scanned-project
USER_TAG	The final tag for the built Docker image.	latest

How to Use This Template

1. Click the Use this template button at the top of this GitHub repository to create your own copy.
2. Copy the contents of .gitlab-ci.yml into the root directory of your GitLab project.
3. Ensure all required CI/CD variables are configured in your GitLab project settings.
4. Trigger the pipeline manually, via API, or by pushing code to your repository.

Supported Stacks

The fetch_and_detect job currently supports automatic build configuration for:

• Java (Maven & Gradle)
• Node.js
• Go
• Python
• Standalone Dockerfile

If a Dockerfile is present in the root (or detected context), the pipeline will prioritize it. If not, it will automatically generate a standard Dockerfile based on the detected language.