Design DevSecOps Pipeline - System Design | WinJob

DevSecOps Context and Shift-Left Security Goals

A production DevSecOps platform embeds security into every DevSecOps stage: static analysis, dependency and license checks, container vulnerability scanning, policy-as-code gates, and signed attestations before promotion. Interviewers expect explicit severity SLAs, false-positive handling, and how Snyk/SonarQube/Aqua-class tools integrate—not a checkbox "run scanner" step.

Problem framing

Shift-left: SAST + secret scan on every PR; SCA on lockfiles; image scan before registry push
Policy-as-code blocks merge on critical CVEs or unsigned images (OPA/Kyverno/Sonar quality gate)
Immutable audit trail linking commit → scan results → promotion decision → deploy digest
Target SLO: p95 security feedback on PR < 15 minutes; zero critical vulns in prod path

Design choices

Central security orchestration plane with pluggable scanners (SAST, SCA, container, DAST)
Normalize findings to a single schema (CVE, severity, package, fix version, SLA due date)
Risk-based gates: block critical/high in prod path; warn/monitor in dev branches
OIDC to scanners and cloud APIs; no long-lived API keys on runners

Deep dive

For section 1, explain triage workflows, waiver/expiry for accepted risks, and how SonarQube quality gates differ from container CVE gates. Cover supply-chain attestations (SLSA, Sigstore/cosign), SBOM storage, and how Aqua/Trivy/Grype results feed deployment policies.

javaOne Dark Pro

1 public final class SecurityGate {
2   public boolean allowPromotion(String severity, boolean waived, boolean slaBreached) {
3     if ("CRITICAL".equals(severity) && !waived) return false;
4     return !slaBreached;
5   }
6 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass
4 class Finding:
5     cve_id: str
6     severity: str
7     component: str
8  
9 def blocks_merge(findings: list[Finding], block_levels: set[str]) -> bool:
10     return any(f.severity in block_levels for f in findings)

typescriptOne Dark Pro

1 interface ScanResult {
2   scanner: "sast" | "sca" | "container";
3   criticalCount: number;
4   highCount: number;
5 }
6  
7 export function shouldBlockPromotion(results: ScanResult[]): boolean {
8   return results.some((r) => r.criticalCount > 0);
9 }

Interviewer positioning

Anchor on mean time to remediate, percent PRs blocked by policy, and false-positive rate. Reference how Snyk, SonarQube, and Aqua operationalize developer-friendly feedback in large enterprises.

How to open this one

The framing that lands for DevSecOps is shifting security left into the pipeline as enforced gates, not a review at the end: SAST/DAST, dependency and secret scanning, SBOM generation, and signature verification all run as fail-closed stages. Lead with policy-as-code that blocks a critical CVE from promotion, and the failure story that proves it: a leaked credential or a vulnerable dependency reaches prod because scanning was advisory instead of blocking. That shows you understand security has to be a gate with teeth, not a dashboard.

Key Highlights

•Shift-left: SAST, secrets, SCA on every PR
•Policy-as-code blocks critical CVEs and unsigned images
•Unified findings schema with SLA and waiver expiry

1	public final class SecurityGate {
2	public boolean allowPromotion(String severity, boolean waived, boolean slaBreached) {
3	if ("CRITICAL".equals(severity) && !waived) return false;
4	return !slaBreached;
5	}
6	}

1	from dataclasses import dataclass
2
3	@dataclass
4	class Finding:
5	cve_id: str
6	severity: str
7	component: str
8
9	def blocks_merge(findings: list[Finding], block_levels: set[str]) -> bool:
10	return any(f.severity in block_levels for f in findings)

1	interface ScanResult {
2	scanner: "sast" \| "sca" \| "container";
3	criticalCount: number;
4	highCount: number;
5	}
6
7	export function shouldBlockPromotion(results: ScanResult[]): boolean {
8	return results.some((r) => r.criticalCount > 0);
9	}