Add DevSecOps pipeline: SAST, SCA, secret scanning, IaC checks, and Claude review - #305

Merged

gerardrecinto merged 11 commits into

feat/devsecops-pipeline-and-remediation

Sep 10, 2026

Commits on Sep 10, 2026

feat(security): add CodeQL SAST workflow for Go and JS/TS
gerardrecinto
committed
50d8bb8
feat(security): add secret, dependency, and container config scanning
gerardrecinto
committed
df6afdf
fix(docker): run nocov and bindings build images as non-root
gerardrecinto
committed
14b967f
feat(devops): add local security-scan Makefile targets
gerardrecinto
committed
fe22800
feat(automation): add Claude Code PR review and remediation workflows
gerardrecinto
committed
7d2e179
docs(security): document the pipeline security controls
gerardrecinto
committed
3ebaa70
fix(security): pin trivy-action to a valid tag
gerardrecinto
committed
5f35ac2
fix(security): give the wasm demo builds an explicit -o path
gerardrecinto
committed
7fad8d1
fix(security): bump pinned trivy-action to a working version
gerardrecinto
committed
0015dd2
fix(automation): skip Claude workflows cleanly without an API key
gerardrecinto
committed
844a3db
fix(security): correct severity gating and drop the paid Gitleaks action
gerardrecinto
committed
89895e6