Shift-Left Security in CI/CD
Add pre-commit secret scanning, dependency vulnerability checks, and a fail-the-build security gate to a real GitHub Actions pipeline, so security issues are caught before code ever reaches a shared branch.
Prerequisites: a GitHub account and a sample repository (any small Node.js or Python app works), Git installed locally, and pre-commit installed (pip install pre-commit).
"Shift-left" means moving security checks as early in the development lifecycle as possible — ideally to the developer's own machine, before code is even committed, rather than catching problems in a dedicated security review weeks later. The earlier a vulnerability is caught, the cheaper it is to fix: a secret caught by a pre-commit hook costs nothing; the same secret caught after it's been pushed, mirrored, and cached by GitHub requires a credential rotation and history rewrite.
You'll build two layers: a local pre-commit hook that blocks obviously bad commits (hardcoded secrets) before they leave your machine, and a CI pipeline stage that catches what the local hook might miss (dependency vulnerabilities, secrets in files the hook didn't scan) and fails the build rather than just warning.
Test what you just learned
Self-testing is one of the best ways to retain new skills. Unlock project quizzes to check your understanding.
Log in to unlock0 / 6 complete