shubomifashakin/devsecops-pipeline-scaffold

DevSecOps Pipeline Scaffold is a collection of ready made GitHub Actions workflows and configuration files covering the security checks a typical software pipeline needs: scanning for secrets, scanning dependencies for known vulnerabilities, scanning container images, running static application security testing, and checking infrastructure configuration files like Terraform or CloudFormation. Each workflow file pairs with a matching config file, such as a Gitleaks settings file or a Semgrep ruleset, and a written explanation of why that check belongs at a particular stage of a pipeline rather than running on every single push. The project can be used two ways. The first is as plain templates: copy the workflow files into your own repository's GitHub Actions folder, copy the matching config files into your repo root, then adjust a handful of details such as your default branch name, whether you use Discord notifications, and how strict the failure thresholds should be. The second way is as a Claude Code skill. Because the repository includes a SKILL.md file plus supporting assets and reference documents, installing it through the skills command line tool lets Claude inspect your project, decide which checks actually apply to your tech stack, and assemble the right files automatically instead of you picking through them by hand. A pre commit hook is also included so secrets can be caught locally before code is ever pushed, working alongside the pipeline level secret scan that catches anything that slips through. The project is released under the MIT license, so the templates can be reused freely in other projects. It is aimed at developers and teams who want a working security baseline for their pipeline without researching and wiring up each tool individually.