Senior SecOps

Automated Vulnerability Scanning Pipeline:

GitHub Actions workflow:

name: Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Node.js — npm audit
      - name: npm audit
        run: npm audit --audit-level=critical
        continue-on-error: false  # fail CI on critical

      # Python — safety + pip-audit  
      - name: pip-audit
        run: |
          pip install pip-audit
          pip-audit --requirement requirements.txt --severity CRITICAL --fail-on CRITICAL

      # Container images — Trivy
      - name: Trivy image scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ env.IMAGE_TAG }}
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          format: 'sarif'
          output: 'trivy.sarif'

      - name: Upload SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy.sarif'

Slack alert on failure:

      - name: Notify Slack on critical vuln
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          payload: '{"text":"CRITICAL vulnerability found in ${{ github.repository }} — ${{ github.sha }} — check Security tab"}'
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SECURITY_WEBHOOK }}

Policy decision — don't block on HIGH initially: Start with --audit-level=critical only. Add HIGH after you've cleared the existing backlog, or you'll have 200 blocking failures on day one.