Integration with CI/CD Pipelines
🌟 Objective
Guarantee that SBOM, SCA and dependency governance practices are applied in an automated and traceable way in the applications' build, test and release pipelines.
🚀 Automating these practices ensures consistent application, early detection of risks and controlled blocking of releases with serious findings.
🛠️ Expected actions in CI/CD pipelines
| CI/CD Phase | Expected action | Result |
|---|---|---|
| Build | Automatic generation of the SBOM (e.g. Syft, CycloneDX) | Versioned .json or .xml artefact |
| Security analysis | Execution of SCA with an open source or commercial scanner | Findings report (SARIF/JSON/HTML) |
| Validation | Checks the severity of findings and applies policies | Blocker or warning + record |
| Release | Attaches the SBOM and findings to the final artefact | Traceability per version |
💡 Integration examples (pseudocode)
steps:
- name: Generate SBOM
run: syft . -o cyclonedx-json > sbom.json
- name: Run SCA
run: grype sbom:sbom.json -o sarif > results.sarif
- name: Validate findings
run: ./scripts/validate-findings.sh results.sarif
Can be integrated into GitHub Actions, Azure DevOps, GitLab CI, Jenkins, etc.
🔐 Blocking policies (examples)
| Criterion | Action |
|---|---|
| CVSS >= 9.0 and not mitigated | Blocks the pipeline |
| Vulnerability with a known exploit | Requires formal approval |
| "Medium" finding with a patch available | Generates a warning + task |
The rules may be maintained in a versioned file (
policy.yaml) or in a central system.
🔧 Integration with the backlog and traceability
- Findings must automatically generate:
- A task in Jira/Azure DevOps
- An association with the commit/PR
- A cross-reference to the SBOM and the release artefact
📄 The use of formats such as SARIF is suggested, to allow automatic import by IDEs and ALM platforms.
🔒 Recommended practices by risk
| Application risk | Mandatory CI/CD practice |
|---|---|
| L1 (low) | SBOM generation + lightweight SCA (e.g. npm audit) |
| L2 (medium) | Formal SCA + blocking of critical findings |
| L3 (high) | Complete SBOM, automated SCA, recording and approval of exceptions |
🔗 Links to other files
| Document | Relationship with the pipeline |
|---|---|
01-inventario-sbom.md | Mandatory input source |
02-analise-sca.md | Integrated scanner and validation |
09-excecoes-e-aceitacao-risco.md | Control of findings with documented justification |
🚀 Integrating SBOM and SCA into pipelines is the bridge between theory and execution. It ensures that the policies defined by the security team are effectively applied, auditable and repeatable.