DevSecOps › Module 9 › Lesson 3
Secure Merge
Secure merge literacy — branch protection, required checks, review count, signed commits stub, merge queue — merge gate rows on YOUR `$DEVSEC_LAB` repos.
Visual · t36_secure_merge
Secure merge = named PR gate rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Merge without gates ships vulnerabilities — name branch protection and required check rows on YOUR lab repos before bypassing stranger org merge rules.
Secure merge literacy names: branch protection rule category, required status check category (Checkov/Trivy literacy link), review count minimum category, signed commits stub category, and merge queue/batch stub category. Analyst documents secure merge checklist on `$DEVSEC_LAB` repo — five rows with pass/fail criteria — without force-pushing to stranger org repos, without bypassing required checks on prod without ticket, without merge sabotage recipes. Cyberlium teaches merge governance on YOUR notes — shift-left handoff literacy. Refused: stranger org force-push, prod check bypass, merge sabotage. Lab row: secure merge checklist (five rows, pass/fail, required checks list).
1. Named merge rows
Branch protection, required checks, review count, signed commits, merge queue — five literacy anchors.
Required checks link Module 6 Checkov and Module 7 Trivy gates — same repo thread.
Command guide
Try these commands — Named merge rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions NIST SSDF — https://csrc.nist.gov/Projects/ssdf CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
cat > "$DEVSEC_LAB/findings/pipeline-gate-policy.md" <<'EOF'
# Pipeline Gate Policy — YOUR org stub
## Block merge / deploy
- gitleaks: any verified secret (exclude FAKE-labeled lab strings per policy)
- checkov: CRITICAL and HIGH failed checks
- trivy: CRITICAL OS/app CVEs in container artifact
## Warn / ticket
- trivy HIGH → backlog.csv within 7d SLA
- ZAP baseline medium on localhost lab app → review false positives
## Exceptions
- Time-bound waiver with CISO approval + compensating control
- NEVER waive secret leaks or stranger-scan findings
## CI enforcement
- security.yml jobs must pass before merge to main
EOFCommand — copy this
grep -E 'Block|gitleaks|checkov|trivy|NEVER' "$DEVSEC_LAB/findings/pipeline-gate-policy.md" grep -E 'secret-scan|iac-scan|container-scan' "$DEVSEC_REPO/.github/workflows/security.yml"
Primary tools to practice this lesson: grep, python3. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); NIST SSDF (https://csrc.nist.gov/Projects/ssdf); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Check bypass discipline
Bypass requires exception stub from Module 9-2 — document UTC and owner.
Force-push refused on protected branches — lab and prod literacy.
3. Refused
No force-push to stranger repos; no prod check bypass; no merge sabotage recipes.
Merge literacy supports safe delivery — not pipeline warfare.
4. What you ship: secure merge checklist
Five merge rows + required checks list + pass/fail + NEVER force-push stranger repo line.
5. What you record before the next lesson
Secure merge checklist path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Force-push to stranger org repo main branch bypassing branch protection as 'merge hygiene test.'
Right
Secure merge checklist from `$DEVSEC_LAB` repo. Next: Governance Lab.
Mission: secure merge checklist
1) Name five secure merge rows. 2) Required checks list from Modules 6–7. 3) Pass/fail criteria per row. 4) Write NEVER force-push stranger repo line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Required checks — minimum count literacy?”
Knowledge Check
APPLY: Secure merge literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Force-push to stranger org repos is course lab.
True or False
Knowledge Check
APPLY: Merge checklist includes:
Multiple choice