From 9a415c9e4ddbcd2cba1182b773f64b2448542923 Mon Sep 17 00:00:00 2001
From: Jashwanth <jashwanthmu@gmail.com>
Date: Fri, 2 Oct 2026 08:20:25 +0530
Subject: [PATCH] docs: complete DevSecOps pipeline documentation

12-gate security pipeline fully documented:
- Architecture diagram showing all 4 pipeline stages
- Gate details: tool, what it catches, blocks or reports
- Real findings table: CVE-2024-33663, OPA kafka probe catch
- Workflow file mapping
- Interview answer ready

Phase 2 DevSecOps complete
---
 docs/decisions/devsecops-pipeline.md | 90 ++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)

diff --git a/docs/decisions/devsecops-pipeline.md b/docs/decisions/devsecops-pipeline.md
index 71816e5..32ebf0e 100644
--- a/docs/decisions/devsecops-pipeline.md
+++ b/docs/decisions/devsecops-pipeline.md
@@ -47,3 +47,93 @@ Target implementation: after Week 16 DevOps foundation.
 | OWASP ZAP | Only tool that tests the RUNNING application, not just code |
 | OPA | Policy as code — security rules enforced at Kubernetes level |
 | Gitleaks | Prevents secrets from ever entering git history |
+
+
+## Pipeline Architecture
+
+Push to GitHub
+│
+▼
+┌─────────────────────────────────────────┐
+│ PRE-FLIGHT GATES (4) │
+│ Gate 1: TruffleHog - Secret Scan │
+│ Gate 2: Hadolint - Dockerfile Lint │
+│ Gate 3: Checkov - IaC Security │
+│ Gate 4: TerraSecure - ML IaC Scan │
+└─────────────────────────────────────────┘
+│
+▼
+┌─────────────────────────────────────────┐
+│ SAST GATES (3) │
+│ Gate 5: Bandit - Python SAST │
+│ Gate 6: ESLint Security - TS SAST │
+│ Gate 7: SonarQube - Quality Gate │
+└─────────────────────────────────────────┘
+│
+▼
+┌─────────────────────────────────────────┐
+│ SUPPLY CHAIN GATES (2) │
+│ Gate 8: Snyk - Dependency CVE Scan │
+│ Gate 9: Syft - SBOM Generation │
+└─────────────────────────────────────────┘
+│
+▼
+┌─────────────────────────────────────────┐
+│ RUNTIME GATES (3) │
+│ Gate 10: OWASP ZAP - DAST Scan │
+│ Gate 11: OPA - Policy Validation │
+│ Gate 12: Vault - Secrets Check │
+└─────────────────────────────────────────┘
+│
+▼
+DEPLOY (ArgoCD → EKS)
+
+
+## Gate Details
+
+| Gate | Tool | What it catches | Blocks? |
+|------|------|----------------|---------|
+| 1 | TruffleHog | AWS keys, tokens, passwords in code | Yes |
+| 2 | Hadolint | Dockerfile bad practices, root user | Yes |
+| 3 | Checkov | Terraform misconfigs, K8s security | Reports |
+| 4 | TerraSecure | ML-detected IaC vulnerabilities | Reports |
+| 5 | Bandit | SQL injection, weak crypto in Python | Yes (HIGH) |
+| 6 | ESLint security | XSS, prototype pollution in TypeScript | Yes |
+| 7 | SonarQube | Code quality, coverage, tech debt | Yes |
+| 8 | Snyk | CVEs in Python + Node dependencies | Yes (HIGH) |
+| 9 | Syft SBOM | Generates software bill of materials | No (report) |
+| 10 | OWASP ZAP | XSS, SQLi, auth bypass at runtime | Reports |
+| 11 | OPA | K8s policy violations | Yes |
+| 12 | Vault | Hardcoded secrets detection | Yes |
+
+## Real findings caught during development
+
+| Finding | Gate | Severity | Fix |
+|---------|------|----------|-----|
+| CVE-2024-33663 python-jose | Trivy | CRITICAL | Upgraded to 3.4.0 |
+| Kafka missing liveness probe | OPA Gate 11 | HIGH | Added health check |
+| Public EKS endpoint | Checkov Gate 3 | MEDIUM | Documented as dev |
+| No NetworkPolicy | Checkov Gate 3 | MEDIUM | Added networkpolicy.yaml |
+| Containers running as root | Checkov Gate 3 | HIGH | Added runAsUser: 10001 |
+
+## Workflows
+
+| File | Gates |
+|------|-------|
+| .github/workflows/ci.yml | pytest + ESLint + Trivy + Docker |
+| .github/workflows/cd.yml | GHCR push on main merge |
+| .github/workflows/devsecops-preflight.yml | Gates 1-4 |
+| .github/workflows/devsecops-sast.yml | Gates 5-7 |
+| .github/workflows/devsecops-supply-chain.yml | Gates 8-9 |
+| .github/workflows/devsecops-dast.yml | Gate 10 |
+| .github/workflows/devsecops-policy-vault.yml | Gates 11-12 |
+
+## Points
+
+> "Every commit to CRMS runs through 12 automated security gates.
+> We catch secrets, Dockerfile issues, IaC misconfigs, Python and
+> TypeScript vulnerabilities, dependency CVEs, generate an SBOM,
+> run DAST against the live app, validate K8s policy compliance,
+> and check for hardcoded secrets - all before any code reaches
+> production. The pipeline caught a real CRITICAL JWT CVE and a
+> missing Kubernetes liveness probe during development."
\ No newline at end of file