DevSecOps: Trivy + Checkov + Hardening

The top rung of the MVP. The pipeline now scans the Docker image for CVEs with Trivy and the Terraform for misconfigurations with Checkov, fails the build on real problems, hardens GitHub Actions permissions, and ships with a security checklist, runbook, and cleanup guide. This is the difference between 'it deploys' and 'it deploys safely'.

The files this template produces. Copy any of them straight into your project.

name: Security Gates

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read
  security-events: write   # to upload SARIF to the Security tab

jobs:
  iac-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Checkov (Terraform)
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: infra/
          framework: terraform
          soft_fail: false        # fail the build on findings
          output_format: sarif
          output_file_path: checkov.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: checkov.sarif

  image-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t web:scan .
      - name: Trivy (image CVEs)
        uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: web:scan
          severity: HIGH,CRITICAL
          exit-code: "1"          # fail on HIGH/CRITICAL
          format: sarif
          output: trivy.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy.sarif

1. 1

   Add the IaC scan (Checkov)

   Point Checkov at your infra/ directory. Start in soft-fail to see findings, then flip to hard-fail so misconfigurations block the build.

   checkov -d infra/ --framework terraform

   Run it locally first to triage before enforcing in CI.

2. 2

   Add the image scan (Trivy)

   Scan the built image for known CVEs. Gate on HIGH and CRITICAL so vulnerable images never reach the registry.

   trivy image --severity HIGH,CRITICAL --exit-code 1 web:scan

   Exit code 1 fails the pipeline when serious CVEs are present.

3. 3

   Harden the pipeline

   Set minimal `permissions:` on every workflow, keep OIDC (no static keys), and remove any wildcard IAM actions. Least privilege everywhere.

   A pipeline that can do anything is a pipeline an attacker can do anything with.

4. 4

   Wire results into the Security tab

   Upload SARIF from both scanners so findings show up in GitHub's Security tab and on PRs — visible, not buried in logs.

5. 5

   Adopt the checklist and runbook

   Commit SECURITY_CHECKLIST.md and RUNBOOK.md. The real upgrade at this level is operational discipline, not just tools.

Ask the assistant to explain, review, or recommend — authored for this template.

• Vulnerable images are blocked

  Info

  Trivy fails the build on HIGH/CRITICAL CVEs, so they never reach ECR or production.

• Misconfigured infra is blocked

  Info

  Checkov catches insecure Terraform (open SGs, unencrypted volumes) before apply.

• Least-privilege pipeline + IAM

  Info

  Scoped workflow permissions and OIDC roles shrink the blast radius of a leak.

• Scanning is continuous, not one-time

  Low

  New CVEs appear daily; a clean scan today can fail tomorrow.

  Run scheduled scans and keep base images current.

Tear it down when you're done — the fastest way to avoid a surprise bill.

1. 1

   terraform destroy the environment when you're done demoing.

   Billing

   terraform destroy

2. 2

   Expire old ECR images via the lifecycle policy.

3. 3

   Revoke the OIDC role trust and any deploy keys.

   Billing
4. 4

   Confirm the Billing dashboard shows nothing running.