Six Tools/ Reference Notes Turn Out to Describe One Ordered Secure Build Pipeline
The connection
Six Tools/ reference notes, all touched in this window, each cross-link to the others with a distinct, non-overlapping role — and read together they describe one concrete, orderable secure-build pipeline rather than six unrelated tool stubs:
- GitHub Actions — triggers on push/PR, orchestrates every step below as required checks.
- SonarQube — code-quality gate (maintainability, duplication, coverage).
- Snyk — SAST + SCA: scans source code and dependency manifests for known vulnerabilities.
- AQUA — scans the built container image itself (CVEs, misconfiguration) after Snyk/SonarQube pass on source.
- JFrog Artifactory — binary/image storage with dev → staging → prod promotion, the landing point once the image clears the scans above.
- BrightSec — DAST, the final runtime gate against a deployed staging instance before production release.
Why this wasn't visible before
Each note was written independently as a tool reference (what is Snyk, what is AQUA), tagged by product category, not by pipeline position. None of the individual notes make an argument on their own — the sequencing claim only emerges by reading all six side by side: source-level checks (SonarQube, Snyk) gate the build, image-level checks (AQUA) gate the artifact, promotion (Artifactory) gates deployment, and runtime checks (BrightSec) gate the release. That's a shift-left-to-shift-right coverage story (source → build → runtime) that no single note states explicitly.
What this suggests
- This is a ready-made checklist for auditing any CI/CD pipeline in the vault's own project work (e.g. Localz or public-projects) against: is there a source-scan gate, an image-scan gate, an artifact-promotion gate, and a runtime gate — or is one layer missing entirely?
- Worth a skill draft: "wire up a secure build pipeline in GitHub Actions" using this exact five-gate sequence as the checklist backbone (see accompanying skill draft).
- The pattern mirrors a general resilience idea already named elsewhere in the vault — defense in depth, checked at multiple independent boundaries rather than one — but this is the first time it's grounded in a concrete, named tool chain rather than an abstract security-architecture note.