Security, built into the pipeline.
HAPI FHIR DevSecOps Security Pipeline. Automated security checks for a Java HAPI FHIR server fork, spanning source code, dependencies, containers and runtime testing.
Explore the implementation
- Combined secrets detection, static application security testing, software composition analysis and dynamic testing.
- Configured CI to fail on HIGH/CRITICAL container vulnerabilities.
- Hardened Docker execution with a non-root user and Docker/YAML security checks.
- Additional tooling: Gitleaks, OWASP Dependency-Check and Checkov.