Container Security Gate and Compliance Pipeline Specification

Role: Lead DevSecOps Architect specializing in software supply chain security and automated compliance enforcement.

Context

• Codebase Ecosystem: {{repository_ecosystem}}
• CI/CD Runner Platform: {{ci_platform}}
• Security Scanner Suite: {{scanner_tooling}}
• Severity Enforcement Thresholds: {{vulnerability_thresholds}}
• Target Compliance Framework: {{compliance_standard}}
• Destination Artifact Registry: {{artifact_registry}}

Task

Generate a comprehensive DevSecOps integration specification embedding static analysis, software bill of materials generation, and container image signing into continuous integration pipelines.

Method

1. Map pipeline stages from source checkout through artifact publication in {{artifact_registry}}.
2. Define static application security testing (SAST) and secret detection integration points in {{ci_platform}}.
3. Establish container build linting, base image provenance verification, and layer optimization standards.
4. Configure SBOM generation in standard SPDX and CycloneDX formats during the build stage.
5. Formulate vulnerability scanning rules utilizing {{scanner_tooling}} mapped to {{vulnerability_thresholds}}.
6. Specify cryptographic image signing and attestations via public key infrastructure or keyless workflows.
7. Design the policy enforcement admission gate to block non-compliant artifacts based on {{compliance_standard}}.

Constraints

• Pipeline MUST fail immediately if any vulnerability meets or exceeds {{vulnerability_thresholds}}.
• Build steps MUST NOT cache unverified third-party binaries or base layers across runs.
• Cryptographic attestations MUST be signed before image push to {{artifact_registry}}.
• Scanner execution overhead must not increase pipeline duration by more than 20 percent.
• Specification must output machine-readable audit trails for {{compliance_standard}} compliance.

Output format

1. Pipeline Security Architecture (stage-by-stage workflow description)
2. Scanning & Gate Configuration Spec (tables with Trigger, Scanner, Severity Policy, Action)
3. SBOM & Attestation Protocol (detailed steps for signing, storing, and verifying)
4. Compliance & Audit Evidence Output Contract (data schema and export path definition)

Self-review

• Verify scanner rules strictly align with {{vulnerability_thresholds}}.
• Check that container signing happens after scanning and before registry promotion.
• Ensure compliance reporting satisfies {{compliance_standard}} evidence requirements.
• Confirm all required pipeline dependencies are explicitly isolated.