Secure › Module 7 › Lesson 3
CI Gate
Fail builds on critical SAST — wire YOUR $REPO pipeline, not stranger CI.
Visual · t17_ci_gate
CI gate = automated merge blocker on security findings. Original Cyberlium.
Opening
Green CI with ignored SAST is a sticker — not a control.
Integrate SAST in CI (GitHub Actions, GitLab CI, etc.) on YOUR $REPO: run on pull requests, fail or warn on severity threshold you document, upload SARIF for review UI if available. Start with warn-only, move to fail on critical after baseline cleanup. Never tamper with classmate or employer CI to 'test gates,' never disable org-wide security workflows without authorization. Defenders tune thresholds; attackers hope merges skip review.
1. Pipeline placement
Run SAST on PR and main — fast rules first, deep scan nightly optional.
Cache dependencies; pin action and tool versions.
Command guide
Try these commands — Pipeline placement
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CI security gates — https://owasp.org/www-project-developer-guide/ Bandit — https://bandit.readthedocs.io/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
brew install gitleaks # or go install
macOS:
Command — copy this
brew install gitleaks
Windows:
Command — copy this
choco install gitleaks
═══ LINUX / macOS ═══
Command — copy this
grep -rE 'AKIA[0-9A-Z]{16}|ghp_[a-zA-Z0-9]{36}' "$HOME/cyberlium-lab/t17-toy" 2>/dev/null | head -5 || echo 'No obvious secret patterns in MY_REPO'
mkdir -p "$HOME/cyberlium-lab/t17-demo"
gitleaks detect --source "$HOME/cyberlium-lab/t17-demo" --no-git -v 2>/dev/null || echo 'Install gitleaks for CI gate literacy'Primary tools to practice this lesson: grep, gitleaks. Reference sites: CI security gates (https://owasp.org/www-project-developer-guide/); Bandit (https://bandit.readthedocs.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Threshold policy
Document: fail on critical/high, warn on medium — adjust per team maturity.
Baseline existing debt with dated burn-down — not silent disable.
3. Boundary
Edit CI only in $REPO you control. Fork course starter is fine.
No submitting PRs to random OSS solely to break their CI 'for research.'
4. What you ship: CI gate sketch
YAML snippet or diagram + severity threshold + $REPO-only edit rule.
5. What you record before the next lesson
CI gate notes path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable employer org SAST workflow without change ticket.
Right
Name CI gate pattern. Next: SAST lab.
Mission: CI gate draft
1) Sketch SAST job stages for $REPO. 2) Write fail threshold policy. 3) Write NEVER edit stranger CI.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Warn-only vs fail-on-critical rollout?”
Knowledge Check
APPLY: CI gate purpose:
Multiple choice
Knowledge Check
APPLY: True or False: Tampering employer CI without scope is lab.
True or False
Knowledge Check
APPLY: SARIF upload helps:
Multiple choice