Ci security gate

Skill Hayatelin/devsecops-skills/skills/ci-security-gate

A security skills pack for Claude Code, Cursor, Codex and Gemini CLI: secrets pre-flight, dependency audit, secret rotation, STRIDE threat modeling, secure code review, Dockerfile hardening and env hygiene.

Install

npx -y skills add Hayatelin/devsecops-skills --skill ci-security-gate

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Wire security checks into CI as a blocking gate before merge/deploy. Use when the user wants to stop insecure code from shipping, is setting up GitHub Actions / GitLab CI security, or asks how to enforce secrets/dependency/SAST checks automatically.

SKILL.md

2.2 KB, as published. Nobody here has run it

ci-security-gate — block insecure code at the door

When to use

The user wants automated, enforced security in their pipeline so problems are caught before merge — not after an incident. The goal is a gate that fails the build on real issues without drowning the team in noise.

Process

Choose the layers (cheap → deeper) and run them on every PR:
- Secrets / dangerous code: secscan (secscan . --min-severity high) and/or gitleaks.
- Dependencies: the ecosystem auditor + osv-scanner / grype.
- SAST: Semgrep (semgrep --config auto) or CodeQL for deeper analysis.
- IaC/containers (if relevant): trivy / checkov.
Set thresholds that fail the build (start strict only on the worst):
- Fail on: any committed secret, any reachable high/critical vuln, high-severity SAST.
- Warn (don't fail) on: low/medium, to avoid alert fatigue early on.
Make it required: mark the security job as a required status check in branch protection so PRs can't merge red.
Keep signal high: allow scoped, reviewed suppressions (e.g. # secscan:ignore, semgrep nosemgrep) with a comment explaining why; review suppressions periodically.
Cache tool installs and run jobs in parallel so the gate stays fast (< a few min).

Example (GitHub Actions, blocking on high severity)

security:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: Hayatelin/secscan-skill@v1
      with: { path: ".", min-severity: "high" }
    - run: pipx run osv-scanner scan .

Pitfalls

Failing on everything from day one → the team disables the gate. Ramp severity up.
A gate that isn't a required check → it gets ignored.
Slow gates (>5 min) get skipped; parallelize and cache.

Report back

Summarize which layers run, what fails vs warns, whether it's a required check, and the current pass/fail state.