The challenge
Developers needed consistent security feedback both on developer machines and before code changes were merged, without managing a different toolchain in each environment.
My contribution
- Contributed to the design and implementation of Dev Gate and Sec Gate solutions.
- Built a shared container image containing tools such as Gitleaks, TFLint, Checkov, Pylint, PSScriptAnalyzer and Hadolint, alongside other code-analysis tools.
- Helped make the toolchain available in developer workflows and GitHub Actions pull-request checks.
Workflow design
01A standardised container packages the security and quality tooling.
02Developers run checks in their local workflows around code commits.
03GitHub Actions runs the same toolchain on pull requests for consistent feedback.
Outcome & impact
This design promotes earlier feedback, reusable checks and consistency between local and CI environments. No unverified reduction in vulnerabilities or build times is claimed.
Public case study: implementation details have been generalised to avoid disclosing private employer systems, source code, account identifiers or infrastructure configuration.