Pipelines for Securing your Python Development Lifecycle

See it on [GitHub | GitLab]

Reference Repository from my Talk of the same title: Pipelines for Securing your Python Development Lifecycle

Important files/directories

samples	Contains samples of things that will cause the pipelines to fail
.gitlab-ci.yml	GitLab CI Config
.github/workflows/security.yml	GitHub CI Config
Pipeline results	[GitLab | GitHub]

Please feel free to fork this repo and try it yourself.

Running tools locally

All of these tools can be run locally as well

Try with uvx:

• uvx bandit -x .venv -r .
• uvx pip-audit -r samples/requirements.txt

Gitleaks

1. Install gitleaks
2. gitleaks git --verbose --redacted .

Have a play with the malicious yaml payloads

uv run samples/naughty_yaml.py

More reading and examples: YAML Deserialization Attack in Python

TODOs and Possible Enrichments

• Share some other usefull scripts for CI