Below is a production-quality README.md you can copy-paste directly into your Git repository. It is interview-ready, explains each pipeline stage, why it exists, and what risk it mitigates.

This repository demonstrates a job-ready DevSecOps pipeline implemented using Azure DevOps, following shift-left security and fail-fast principles.

The pipeline integrates security, quality, and delivery into every stage of the software lifecycle.

SAST (Bandit)
→ Dependency Scan (pip-audit)
→ Unit Tests & Coverage
→ Build & Push Docker Image
→ Container Security Scan (Trivy + SARIF)

Each stage exists to reduce risk as early as possible.

• Scans Python source code
• Detects insecure coding patterns (e.g. hardcoded secrets, unsafe functions)

• Bandit

• Prevents insecure code from ever entering the pipeline
• Catches issues before dependencies, builds, or deployments
• Implements shift-left security

• Pipeline stops immediately
• No tests, builds, or deployments are executed

• Code-level vulnerabilities
• Insecure development practices

• Scans requirements.txt
• Checks Python dependencies against known CVEs

• pip-audit

• Most modern attacks come from vulnerable dependencies
• Protects against supply-chain attacks
• Ensures only secure libraries are allowed

• Pipeline fails fast
• Prevents vulnerable dependencies from reaching runtime

• Known CVEs
• End-of-life or unpatched libraries

• Runs automated unit tests using pytest

• Generates:

  • JUnit test reports
  • Code coverage reports

• pytest
• pytest-cov

• Ensures application correctness
• Prevents broken or untested code from being packaged
• Provides measurable quality metrics

• Test results (JUnit)
• Coverage reports (Cobertura XML)

• Functional defects
• Regressions
• Untested code paths

• Builds a Docker image
• Pushes the image to Azure Container Registry (ACR)

• Docker@2 (buildAndPush)

• Produces a single immutable artifact
• Ensures the same image is used for scanning and deployment
• Avoids “works on my machine” issues

• Build and push occur in the same job
• This avoids Azure DevOps agent isolation issues

• Artifact drift
• Inconsistent builds

• Scans the container image stored in ACR
• Detects OS and dependency vulnerabilities
• Generates a SARIF security report

• Trivy

• Containers are the runtime attack surface
• Ensures only secure images are deployed
• Enforces security gates at the artifact level

• trivy.sarif file
• Uploaded as CodeAnalysisLogs

• SARIF is ingested by Azure DevOps Advanced Security

• Findings appear in:

  Pipelines → Run → Security → Code Analysis
  

• Runtime vulnerabilities
• High / Critical CVEs in base images or packages

• Static Analysis Results Interchange Format
• Industry-standard format for security findings

• Tool-agnostic
• Native support in Azure DevOps
• Enables centralized security visibility

• Azure DevOps shows SARIF results only if vulnerabilities exist
• A clean scan produces no Security tab findings

Built an enterprise-grade DevSecOps CI/CD pipeline on Azure DevOps integrating SAST, dependency scanning, automated testing, container security scanning with Trivy, SARIF reporting, and security gates using Azure Container Registry.

This pipeline mirrors real enterprise DevSecOps practices, not a toy example:

• Security is enforced early
• Artifacts are immutable
• Results are visible and auditable
• Failures are intentional and meaningful

Yes — you can use almost the same DevSecOps tools for Node.js, with a few language-specific swaps. This is exactly how real multi-language pipelines are designed.

👉 Trivy stays exactly the same (language-agnostic).