code
GitLab
Source control, merge requests and CI/CD in one platform, with built-in security scanning templates.
Tools
The DevSecOps toolchain
Each profile covers purpose, where the tool sits in the pipeline, a minimal working setup and the common pitfalls. No vendor claims.
-
04
Test
- Test frameworks
- k6
Code Version control, reviews and pre-commit hygiene.
Build Reproducible builds in CI.
build
GitHub Actions
CI/CD workflows integrated with GitHub repositories and the Actions marketplace.
build
Jenkins
Self-hosted automation server with pipelines as code and a large plugin ecosystem.
Secure SAST, SCA, secrets, SBOM and DAST before release.
secure
Checkov
Static analysis for infrastructure as code: Terraform, CloudFormation, Kubernetes and Dockerfiles.
secure
Gitleaks
Detects hard-coded secrets in Git history and working trees.
secure
Grype
Vulnerability scanner for images, filesystems and SBOMs produced by Syft.
secure
OWASP ZAP
Open-source DAST scanner and proxy for web applications and APIs.
secure
Semgrep
Fast, pattern-based static analysis with thousands of community and security rules.
secure
Syft
Generates SBOMs (CycloneDX, SPDX) from images, directories and archives.
secure
Trivy
All-in-one scanner for container images, filesystems, IaC, Kubernetes and SBOMs.
Package Immutable, signed artifacts.
package
Cosign (Sigstore)
Signs and verifies container images, SBOMs and attestations.
package
Docker
Container build and runtime tooling; the default way to package applications as OCI images.
Deploy Declarative, auditable rollouts.
deploy
Ansible
Agentless configuration management and orchestration over SSH.
deploy
Argo CD
Declarative GitOps continuous delivery controller for Kubernetes.
deploy
Helm
Package manager for Kubernetes: templated charts with versioned releases.
deploy
Kubernetes
Container orchestration platform and the deployment target for most of the toolchain.
deploy
Terraform
Infrastructure as code with a plan/apply workflow and a large provider ecosystem.
Protect Secrets, policy and runtime defence.
protect
Falco
Runtime security: detects anomalous syscalls and Kubernetes events in real time.
protect
HashiCorp Vault
Centralised secrets management with dynamic, short-lived credentials.
protect
Kyverno
Kubernetes-native policy engine: validate, mutate, generate and verify images with YAML.
protect
Open Policy Agent (OPA)
General-purpose policy engine using the Rego language.
Observe Metrics, logs and traces with alerting.
observe
Grafana
Dashboards and alerting across metrics, logs and traces.
observe
Loki
Log aggregation that indexes labels, not content, for cost-efficient storage.
observe
OpenTelemetry
Vendor-neutral APIs, SDKs and a collector for traces, metrics and logs.
observe
Prometheus
Pull-based metrics collection, storage and alerting with PromQL.