DevSecOps › Module 2 › Lesson 3
Pipeline Stages
Pipeline stages literacy names source, build, test, deploy, operate phases and security touchpoints — map stages on YOUR $DEVSEC_LAB workflow diagram.
Visual · t36_pipeline_stages
Pipeline stages literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Stages without security touchpoints leak defects — literacy names where gates belong on pipelines you document for lab repos.
A typical CI/CD pipeline flows source → build → test → deploy → operate. Security touchpoints attach at each — branch protection at source, SAST at build, DAST on YOUR lab URL at test, IaC scan at deploy, runtime monitoring at operate. One diagram clarifies who owns which gate. Cyberlium maps pipeline stages on YOUR $DEVSEC_LAB — assign security touchpoint per stage for one fictional GitHub Actions workflow. Next: Fundamentals Lab.
1. Stage touchpoints (named)
Source: branch protection, signed commits, CODEOWNERS on YOUR repo. Build: compile, unit test, SAST, secrets scan. Test: integration tests, DAST against YOUR lab URL. Deploy: IaC policy, artifact signing. Operate: runtime alerts, dependency refresh.
On $DEVSEC_LAB, write stage row — stage, security touchpoint, owner role for one fictional workflow.
Command guide
Try these commands — Stage touchpoints (named)
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions); Gitleaks (https://gitleaks.io/); Aqua Trivy (https://aquasecurity.github.io/trivy/); Bridgecrew Checkov (https://www.checkov.io/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why stage literacy prevents gate gaps
SAST only at deploy misses PR feedback. DAST without lab URL scope invites third-party abuse. Documented touchpoints survive team turnover and feed DevSec maturity metrics.
Students assign lab stages on notes — production pipelines follow platform standards and audit requirements.
3. Lab boundary
Forbidden: DAST touchpoint aimed at stranger production URLs. Allowed: pipeline stages card — five stages with $DEVSEC_LAB fictional touchpoints.
Ship: pipeline stages card for YOUR lab workflow. Next: Fundamentals Lab.
4. What you ship: pipeline stages card for $DEVSEC_LAB
Five stages with security touchpoints. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Pipeline stages card. $DEVSEC_LAB named. File t36-m02-l03-pipeline-stages.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip test-stage DAST because 'lab URL is slow.' Aim operate-stage scans at stranger sites.
Right
Write pipeline stages card for YOUR $DEVSEC_LAB. Next: Fundamentals Lab.
Mission: map pipeline stages on YOUR lab
1) List source, build, test, deploy, operate. 2) Write security touchpoint per stage. 3) Confirm DAST targets YOUR lab URL only. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Test-stage DAST belongs on YOUR lab URL — never stranger production.
Knowledge Check
APPLY: Pipeline test stage DAST on Cyberlium targets:
Multiple choice
Knowledge Check
APPLY: True or False: Build stage commonly includes SAST and secrets scanning.
True or False
Knowledge Check
APPLY: Pipeline stages literacy on Cyberlium uses:
Multiple choice