DevSecOps › Module 2 › Lesson 3
Pipeline Stages
Pipeline stages literacy names source, build, test, deploy, operate phases and security touchpoints — map stages on YOUR $DEVSEC_LAB workflow diagram.
Visual · t36_pipeline_stages
Pipeline stages literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Stages without security touchpoints leak defects — literacy names where gates belong on pipelines you document for lab repos.
A typical CI/CD pipeline flows source → build → test → deploy → operate. Security touchpoints attach at each — branch protection at source, SAST at build, DAST on YOUR lab URL at test, IaC scan at deploy, runtime monitoring at operate. One diagram clarifies who owns which gate. Cyberlium maps pipeline stages on YOUR $DEVSEC_LAB — assign security touchpoint per stage for one fictional GitHub Actions workflow. Next: Fundamentals Lab.
1. Stage touchpoints (named)
Source: branch protection, signed commits, CODEOWNERS on YOUR repo. Build: compile, unit test, SAST, secrets scan. Test: integration tests, DAST against YOUR lab URL. Deploy: IaC policy, artifact signing. Operate: runtime alerts, dependency refresh.
On $DEVSEC_LAB, write stage row — stage, security touchpoint, owner role for one fictional workflow.
Command guide
Try these commands — Stage touchpoints (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions Gitleaks — https://gitleaks.io/ Aqua Trivy — https://aquasecurity.github.io/trivy/ Bridgecrew Checkov — https://www.checkov.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
curl -sS https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions | head -8
cat > "$DEVSEC_LAB/notes/pipeline-security-stages.txt" <<'EOF'
CI/CD security stages — YOUR sample-repo pipeline literacy:
Pre-commit: secret scan (gitleaks) on developer workstation
PR/CI: gitleaks detect + checkov on iac/ + trivy fs on container/
Build: trivy image on YOUR built image tag
Deploy gate: block merge on CRITICAL/HIGH (policy stub in findings/)
Post-deploy: ZAP baseline on YOUR localhost:8080 ONLY — never stranger URL
Supply chain: SBOM generation (syft optional) + checklist in sbom/
Artifact: .github/workflows/security.yml stub ties stages together
EOFCommand — copy this
grep -E 'gitleaks|checkov|trivy|localhost|stranger' "$DEVSEC_LAB/notes/pipeline-security-stages.txt"
Primary tools to practice this lesson: grep, curl. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Gitleaks (https://gitleaks.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/); Bridgecrew Checkov (https://www.checkov.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why stage literacy prevents gate gaps
SAST only at deploy misses PR feedback. DAST without lab URL scope invites third-party abuse. Documented touchpoints survive team turnover and feed DevSec maturity metrics.
Students assign lab stages on notes — production pipelines follow platform standards and audit requirements.
3. Lab boundary
Forbidden: DAST touchpoint aimed at stranger production URLs. Allowed: pipeline stages card — five stages with $DEVSEC_LAB fictional touchpoints.
Ship: pipeline stages card for YOUR lab workflow. Next: Fundamentals Lab.
4. What you ship: pipeline stages card for $DEVSEC_LAB
Five stages with security touchpoints. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Pipeline stages card. $DEVSEC_LAB named. File t36-m02-l03-pipeline-stages.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip test-stage DAST because 'lab URL is slow.' Aim operate-stage scans at stranger sites.
Right
Write pipeline stages card for YOUR $DEVSEC_LAB. Next: Fundamentals Lab.
Mission: map pipeline stages on YOUR lab
1) List source, build, test, deploy, operate. 2) Write security touchpoint per stage. 3) Confirm DAST targets YOUR lab URL only. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Test-stage DAST belongs on YOUR lab URL — never stranger production.
Knowledge Check
APPLY: Pipeline test stage DAST on Cyberlium targets:
Multiple choice
Knowledge Check
APPLY: True or False: Build stage commonly includes SAST and secrets scanning.
True or False
Knowledge Check
APPLY: Pipeline stages literacy on Cyberlium uses:
Multiple choice