Skip to content

📊 Pipeline Sentinel v0.2.3 – The DevSecOps Command Centre

Choose a tag to compare

View all tags
@Mehrdoost Mehrdoost released this 15 May 18:56
· 9 commits to main since this release
v0.2.3
bfe068f

🛡️ Pipeline Sentinel v0.2.3 – The DevSecOps Command Centre

We're excited to release Pipeline Sentinel v0.2.3, a massive leap forward in open‑source CI/CD security observability. This release turns your scanner chaos into a unified, AI‑powered, policy‑driven dashboard – now with auto‑remediation, deep attack path visualisation, and compliance reports.

🚀 What's New

🧠 Auto‑Remediation Engine (--fix)

Pipeline Sentinel can now automatically apply AI‑suggested fixes. Use --analyze --fix and the tool will:

  • Generate precise fix diffs for SAST findings (Semgrep)
  • Patch vulnerable dependencies in package.json / requirements.txt
  • Create a new git branch (auto-fix) and push it, ready for a Pull Request

🕸️ Deep Attack Path Visualisation (MITRE ATT&CK + Topology)

The attack graph has been completely re‑imagined:

  • Accept a topology file (--topology topology.json) describing your assets, subnets, and connections
  • The LLM maps findings onto your infrastructure, showing lateral movement paths across servers
  • All attack paths now include MITRE ATT&CK tactics and techniques (e.g., T1190, TA0001)
  • Interactive D3.js force graph in the dashboard, with clickable nodes showing finding details

đź“Š Compliance & Executive Reports

  • Generate professional PDF reports with --report report.pdf
  • Reports include executive summary, risk score, findings table, and compliance mapping (CIS, PCI‑DSS, ISO 27001)
  • A new --compliance flag lets you align results with your preferred framework
  • The dashboard now shows an AI‑generated executive summary card with risk score

🛡️ Policy‑as‑Code Engine (--policy)

Define security gates as code:

{"max_critical": 5, "on_violation": "fail"}

If critical findings exceed the threshold, the CLI exits with code 1 – perfect for CI/CD pipelines.

🧩 Hybrid RuleFusion Engine

  • Offline: load custom JSON rules from any local directory (--rules ~/my-rules/)

  • Online: pull community‑curated rules with --update-rules

  • Auto‑detects Trivy, Semgrep, Poutine, Zizmor, and plain‑list formats

Policy evaluation built directly into the engine

đź”’ Security Hardening

  • Input validation on all scanner targets to prevent command injection

  • API key authentication for the web dashboard (optional, set PIPELINE_API_KEY)

  • Non‑root Docker image with multi‑stage build for smaller size and better security

Observability & Logging

  • Replaced print with structured logging via loguru – coloured, timestamped, and consistent

  • Graceful error handling: missing Ollama won't crash the dashboard; a clear message is shown instead

Assets 2
Loading