Season 8: You Own the Release · Episode 4 of 8
The Security Gate Says No
You play: AI Engineering Intern
Included with Core programme and Certification prep
The situation
A routine dependency update is in review and every unit test is green. Lydia has read the scan output, the dependency sources and the config files, and she doesn't think it should ship.
What you'll learn
- Security and compliance gates in a delivery pipeline: separating blocking risk from noise; scanning shipped dependencies against advisories at a chosen severity; checking where a dependency came from; scoped, short-lived pipeline credentials; independent approvals; rotating an exposed secret; and keeping scan evidence linked to a traceable artifact.
- GitHub Advanced Security (CodeQL, secret scanning and push protection, Dependabot, dependency review), Defender for Cloud DevOps security, GITHUB_TOKEN permissions, GitHub Apps versus personal access tokens, Stakeholder and outside-collaborator access.
Who you work with
Lydia Roe
Security Engineer
Kabelo Mokoena
Platform and DevOps Engineer
Scenes
- 1.It passed every test
- 2.Blocks the release, or note it?
- 3.A gate that actually blocks
- 4.What the scanner is allowed to do
- 5.Fix it, prove it, and get a second pair of eyes
- 6.Green is not evidence
- 7.Handover
What you leave with
You set a scan gate to block what matters and let the rest through with a note, proved it by shipping the last good commit and stopping the update, chose a scoped short-lived credential for the scan job, and released a fix with an independent approval and a rotated key. You also decided what evidence a release record has to keep.