DevSecOps Practice Hub — Sample Code

Created by: Wang Yuen — wangyuen.linkedin@gmail.com

Sample code, pipeline definitions, lab exercises and patterns from moderndevops.cc — a browsable catalog of DevSecOps practices, tools, CI/CD pipeline examples and hands-on labs mapped across the delivery lifecycle.

---

Repository Structure

moderndevops/
├── labs/          # Hands-on lab exercises (10 labs)
├── pipelines/     # Ready-to-use CI/CD pipeline definitions
├── practices/     # Code examples organised by DevSecOps practice
└── patterns/      # Architectural patterns and design guidance

---

Labs

Step-by-step hands-on exercises with commands, expected results and key lessons.

Lab	Title	Difficulty	Duration
Lab 01	Scan a Container Image	Beginner	20 min
Lab 02	Detect Committed Secrets	Beginner	25 min
Lab 03	Secure Terraform with Checkov	Beginner	30 min
Lab 04	Enforce Kubernetes Policy	Intermediate	45 min
Lab 05	Restrict Pod Privileges	Intermediate	35 min
Lab 06	Build a Secure CI/CD Pipeline	Advanced	90 min
Lab 07	Sign and Verify an Artifact	Advanced	40 min
Lab 08	Detect Runtime Anomalies	Advanced	45 min
Lab 09	Secure an Ansible Automation Workflow	Intermediate	40 min
Lab 10	Triage Vulnerability Findings	Intermediate	35 min

---

Pipelines

Production-grade CI/CD pipeline definitions for multiple platforms.

Pipeline	Platform	Description
gitlab-devsecops	GitLab CI	End-to-end pipeline: SAST, SCA, secrets, image scan, SBOM, DAST, manual gate
github-actions-devsecops	GitHub Actions	Least-privilege workflow with digest-pinned actions, OIDC and build provenance
jenkins-devsecops	Jenkins	Declarative Jenkinsfile with parallel scans and approval gate
ansible-automation	GitLab CI + AAP	Ansible content validation, linting, secret scanning and Molecule testing

---

Practices

Code examples and configuration snippets organised by DevSecOps practice.

Practice	Group	Difficulty
SAST	Secure Development	Beginner
Secret Detection	Secure Development	Beginner
Container Security	Container Security	Beginner
IaC Security	Infrastructure Security	Intermediate
Policy as Code	Governance	Advanced
Kubernetes Security	Container Security	Advanced
SBOM	Software Supply Chain	Intermediate
Secrets Management	Cloud Security	Intermediate

---

Patterns

Architectural patterns that describe recurring DevSecOps solutions.

Pattern	Summary
Shift Left Security	Move security feedback as close to the developer as possible
Security Gates	Objective, documented criteria that a release must satisfy before progressing

---

Source

All content sourced from https://moderndevops.cc — DevSecOps Practice Hub.

---

License & AI Disclosure

This project contains code and model weights released under the Apache License 2.0.

• Code: Licensed under Apache 2.0.
• Model Weights: Licensed under Apache 2.0.
• Generated Assets: All images and text outputs in the /samples directory were generated or modified using generative AI and are dedicated to the public domain under CC0 1.0.