theoptimizers/devsecops

•Updated 5 months ago

Image

636

theoptimizers/devsecops repository overview

⁠🔐 DevSecOps Scanner (Syft + Grype + Trivy + Gitleaks)

A lightweight, automated DevSecOps scanning utility that integrates multiple open-source security tools into a single Docker image.
Supports code, container image, and secret scanning with flexible reporting and multi-platform support.

⁠🚀 Features

✅ Code scanning using Syft⁠ (SBOM) + Grype⁠
✅ Container image scanning using Trivy⁠
✅ Secret scanning using Gitleaks⁠
✅ Public & Private Repositories (GitHub & Bitbucket)
✅ AWS S3 integration for report uploads
✅ Multi-architecture support: amd64 and arm64
✅ Offline/local report storage

⁠🧰 Requirements

Requirement	Description
🐳 Docker	Required to run the image
☁️ AWS credentials (optional)	If uploading reports to S3
🔑 GitHub / Bitbucket credentials (optional)	For private repositories

⁠🛠️ Usage

All reports are saved under the /output directory.
You can mount a local folder ($(pwd)/reports) to collect them.

⁠📦 Public Repositories

⁠💾 Save report locally (GitHub)

docker run --rm \
  -e REPO_URL=https://github.com/your_user/your_public_repo.git \
  -e REPO_BRANCH=master \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --code-scanner


💾 Save report locally (Bitbucket)

docker run --rm \
  -e REPO_URL=https://bitbucket.org/your_team/public_repo.git \
  -e REPO_BRANCH=main \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --code-scanner


☁️ Upload Reports to S3 (Public Repos)

GitHub

docker run --rm \
  -e REPO_URL=https://github.com/your_user/your_public_repo.git \
  -e REPO_BRANCH=master \
  -e AWS_ACCESS_KEY_ID=your_key \
  -e AWS_SECRET_ACCESS_KEY=your_secret \
  -e S3_BUCKET=your-bucket-name \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --code-scanner

Bitbucket

docker run --rm \
  -e REPO_URL=https://bitbucket.org/your_team/public_repo.git \
  -e REPO_BRANCH=main \
  -e AWS_ACCESS_KEY_ID=your_key \
  -e AWS_SECRET_ACCESS_KEY=your_secret \
  -e S3_BUCKET=your-bucket-name \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --code-scanner


🔐 Private Repositories

GitHub (local report)

docker run --rm \
  -e REPO_URL=https://github.com/your_user/your_private_repo.git \
  -e REPO_BRANCH=main \
  -e GITHUB_USER=your_user \
  -e GITHUB_TOKEN=your_token \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --code-scanner


Bitbucket (local report)

docker run --rm \
  -e REPO_URL=https://bitbucket.org/your_team/your_repo.git \
  -e REPO_BRANCH=main \
  -e BITBUCKET_USER=your_username \
  -e APP_PASSWORD=your_app_password \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --code-scanner


☁️ Private Repos + S3 Storage

GitHub

docker run --rm \
  -e REPO_URL=https://github.com/your_user/your_private_repo.git \
  -e REPO_BRANCH=main \
  -e GITHUB_USER=your_user \
  -e GITHUB_TOKEN=your_token \
  -e AWS_ACCESS_KEY_ID=your_key \
  -e AWS_SECRET_ACCESS_KEY=your_secret \
  -e S3_BUCKET=your-bucket-name \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --code-scanner

Bitbucket

docker run --rm \
  -e REPO_URL=https://bitbucket.org/your_team/your_repo.git \
  -e REPO_BRANCH=main \
  -e BITBUCKET_USER=your_username \
  -e APP_PASSWORD=your_app_password \
  -e AWS_ACCESS_KEY_ID=your_key \
  -e AWS_SECRET_ACCESS_KEY=your_secret \
  -e S3_BUCKET=your-bucket-name \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --code-scanner


🔎 Secret Scanning (Gitleaks)

Bitbucket (public)

docker run --rm \
  -v $(pwd)/reports:/output \
  -e REPO_URL="https://bitbucket.org/yourteam/public-repo.git" \
  -e REPO_BRANCH=main \
  theoptimizers/devsecops:v2 \
  --git-secrets-check


Bitbucket (private)

docker run --rm \
  -v $(pwd)/reports:/output \
  -e REPO_URL="https://bitbucket.org/yourteam/private-repo.git" \
  -e REPO_BRANCH=main \
  -e BITBUCKET_USER="your-bitbucket-username" \
  -e APP_PASSWORD="your-app-password" \
  theoptimizers/devsecops:v2 \
  --git-secrets-check


GitHub (public)

docker run --rm \
  -e REPO_URL=https://github.com/your_user/your_public_repo.git \
  -e REPO_BRANCH=main \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --git-secrets-check


GitHub (private)

docker run --rm \
  -e REPO_URL=https://github.com/your_user/private-repo.git \
  -e REPO_BRANCH=main \
  -e GITHUB_USER=your_user \
  -e GITHUB_TOKEN=your_token \
  -v $(pwd)/reports:/output \
  theoptimizers/devsecops:v2 \
  --git-secrets-check


🐳 Docker Image Scanning (Trivy)

Remote Public Image

docker run --rm \
  -v $(pwd)/reports:/output \
  -v $(pwd)/.cache/trivy:/root/.cache/trivy \
  theoptimizers/devsecops:v2 \
  --docker-scanner your_image_name

Local Image

docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd)/reports:/output \
  -v $(pwd)/.cache/trivy:/root/.cache/trivy \
  theoptimizers/devsecops:v2 \
  --docker-scanner your_image_name

🧩 Tools Installed

Tool	Version	Description
Syft	1.40.1	Generates SBOM (Software Bill of Materials)
Grype	0.105.0	Vulnerability scanner for SBOMs
Trivy	0.68.2	Container image and filesystem scanner
AWS CLI	2.31.13	Used for uploading reports to S3
Gitleaks	8.30.0	Secret and credential scanner

📁 Output Files

Tool	Default Output	Format
Syft	`/output/syft-sbom.json`	CycloneDX JSON
Grype	`/output/grype-report.json`	JSON
Trivy	`/output/trivy-docker-report-*.json`	JSON
Gitleaks	`/output/gitleaks-report.json`	JSON

⚠️ Exit Codes

Code	Meaning
`0`	No critical vulnerabilities found
`1`	Critical vulnerabilities detected or error occurred

Tag summary

Recent tags

Content type

Image

Digest

sha256:9d1236ab8…

Size

228.9 MB

Last updated

5 months ago

docker pull theoptimizers/devsecops:v1