CI/CD Pipeline Tools Certification Submission Package
RAISE 2.0 — Appendix D Certification Request
Subj: REQUEST FOR CI/CD PIPELINE TOOLS CERTIFICATION — SECURE RUNTIME ENVIRONMENT (SRE)
Ref:
(a) Rapid Assess and Incorporate for Software Engineering (RAISE) Implementation Guide, 1 November 2022
(b) Navy Risk Management Framework (RMF) Process Guide
(c) DoD Enterprise DevSecOps Fundamentals, Version 2.5, 16 October 2024
(d) NIST SP 800-53 Rev 5, Security and Privacy Controls
(e) DISA STIG for Kubernetes, Version 2 Release 2
Encl:
(1) CI/CD Pipeline Architecture Diagram
(2) Security Gate Evidence Package
(3) Tool Configuration and Version Inventory
(4) Sample Pipeline Run — Full Artifact Set
(5) Kyverno Admission Control Policy Configuration
In accordance with reference (a), Appendix D, this memorandum requests certification of the Secure Runtime Environment (SRE) CI/CD pipeline tools for usability and functional capability. Upon certification, SRE will meet the requirements for designation as a RAISE Platform of Choice (RPOC).
| # | Component | eMASS ID | Environment | Description |
|---|---|---|---|---|
| 1 | SRE Production | Production | RKE2 Kubernetes cluster hosting tenant applications | |
| 2 | SRE Staging | Staging | Pre-production validation environment | |
| 3 | SRE Development | Development | Development and testing environment | |
| 4 | SRE CI/CD Tools | Shared | Pipeline tools, artifact storage, signing infrastructure |
Kubernetes Distribution: RKE2 v1.34.4 (DISA STIG-certified, FIPS 140-2 compliant)
Operating System: Rocky Linux 9.7 (DISA STIG-hardened, SELinux enforcing, FIPS enabled)
GitOps Engine: Flux CD v2.8.1
Per reference (a), Section 3.2, the following tools implement the 8 required RAISE security gates. Click any card to expand details.
SAST — Static Analysis
| License | LGPL-2.1 |
| Source | github.com/semgrep/semgrep |
| Rulesets | p/owasp-top-ten, p/security-audit |
| Output | SARIF JSON → GitHub Security tab |
| Fail Criteria | ERROR-level findings → pipeline stops |
| NIST Controls | SA-11 SA-15 |
SBOM — Software Bill of Materials
| License | Apache-2.0 |
| Source | github.com/anchore/syft |
| Formats | SPDX 2.3 JSON + CycloneDX 1.5 JSON |
| Output | sbom-spdx.json + sbom-cyclonedx.json |
| Fail Criteria | Generation failure → pipeline stops |
| NIST Controls | CM-2 CM-8 SA-17 |
Secrets Detection
| License | MIT |
| Source | github.com/gitleaks/gitleaks |
| Scope | Full git history + working directory |
| Output | secrets-report.json |
| Fail Criteria | Any secret detected → pipeline stops, credential rotation required |
| NIST Controls | IA-5 SC-28 |
Container Security Scan
| License | Apache-2.0 |
| Source | github.com/aquasecurity/trivy |
| Scan Scope | OS packages, language deps, misconfigurations |
| Output | SARIF JSON → GitHub Security tab + Harbor |
| Fail Criteria | CRITICAL CVE findings → pipeline stops |
| NIST Controls | RA-5 SI-2 |
DAST — Dynamic Analysis
| License | Apache-2.0 |
| Source | github.com/zaproxy/zaproxy |
| Scan Type | Baseline scan against running application |
| Output | zap-report.html + zap-report.json |
| Fail Criteria | HIGH-risk alerts flagged for remediation per SLA |
| NIST Controls | SA-11 SI-10 |
ISSM Review — Human Approval
| Type | Manual gate (human-in-the-loop) |
| Environment | issm-review (GitHub Environment) |
| Reviewers | ISSM + Security Team (required) |
| Reviews | All Phase 1 scan artifacts |
| Fail Criteria | ISSM rejects → pipeline stops |
| NIST Controls | CA-2 CA-7 |
Image Signing
| License | Apache-2.0 |
| Source | github.com/sigstore/cosign |
| Signing | Private key (stored in GitHub Secrets) |
| Attestations | SBOM (in-toto), SLSA provenance (v0.2) |
| Verification | Kyverno admission policy verifies at deploy time |
| Fail Criteria | Signing failure → image not deployable (Kyverno blocks) |
| NIST Controls | SI-7 SA-10 |
Artifact Repository
| License | Apache-2.0 |
| Source | github.com/goharbor/harbor |
| Features | OCI registry, Trivy re-scan on push, signature storage |
| Stores | Images, SBOM artifacts, Cosign signatures, SLSA provenance |
| Fail Criteria | Push failure → image not available for deployment |
| NIST Controls | CM-8 SI-7 |
| Tool | Version | Purpose | NIST Controls |
|---|---|---|---|
| GitHub Actions | SaaS | CI/CD pipeline orchestration (primary) | SA-10 AU-2 |
| GitLab CI | SaaS | CI/CD pipeline orchestration (alternative) | SA-10 AU-2 |
| Flux CD | 2.8.1 | GitOps continuous deployment engine | CM-2 CM-3 SA-10 |
| Kyverno | 3.x | Kubernetes admission control — signature verification | SI-7 CM-7 |
| NeuVector | 5.x | Runtime container security monitoring | SI-3 SI-4 IR-4 |
| Docker Buildx | 0.18.x | Multi-platform container image builds | SA-10 |
The CI/CD pipeline implements all 8 RAISE security gates in four phases:
Gitleaks — Secrets Detection
Scan full git history + working directory
Semgrep — SAST Scan
Rulesets: p/owasp-top-ten, p/security-audit
Docker Buildx — Build Container Image
Multi-platform OCI image build
Trivy — Container Vulnerability Scan
OS packages, language deps, misconfigurations
Syft — Generate SBOM
SPDX 2.3 + CycloneDX 1.5 formats
ISSM Reviews All Phase 1 Artifacts
GitHub Environment: issm-review — Required reviewers: ISSM + Security Team
Harbor — Push Image to OCI Registry
Trivy re-scan on push (Harbor-side verification)
Cosign — Sign Image + Attach Attestations
SBOM attestation (in-toto) + SLSA provenance
Flux CD — Update GitOps Repo
Auto-deploy — Kyverno verifies Cosign signature at admission
OWASP ZAP — DAST Baseline Scan
Dynamic testing against running application
After the CI/CD pipeline produces a signed image, the Kubernetes cluster enforces supply chain integrity at admission:
1. Kyverno verify-image-signatures — Verifies every pod's image has a valid Cosign signature from the pipeline's signing key before allowing creation
2. Kyverno restrict-image-registries — Only images from harbor.sre.internal are permitted
3. Kyverno disallow-latest-tag — All images must use pinned version tags
4. Harbor Trivy scan — Images are re-scanned on push as a second layer of verification
This ensures that only images that passed all 8 security gates can run on the platform.
| Artifact | Format | Storage Location | Retention |
|---|---|---|---|
| SAST Report | SARIF JSON | GitHub Security tab | 90 days |
| Secrets Scan | JSON | CI/CD artifacts | 90 days |
| Container Scan | SARIF JSON | GitHub Security + Harbor | 90 days |
| SBOM (SPDX) | SPDX 2.3 JSON | Harbor OCI artifact | Image lifetime |
| SBOM (CycloneDX) | CycloneDX 1.5 JSON | Harbor OCI artifact | Image lifetime |
| DAST Report | HTML + JSON | CI/CD artifacts | 90 days |
| Image Signature | Cosign OCI signature | Harbor OCI artifact | Image lifetime |
| SBOM Attestation | In-toto / Cosign attestation | Harbor OCI artifact | Image lifetime |
| SLSA Provenance | SLSA v0.2 / In-toto v0.1 | Harbor OCI artifact | Image lifetime |
| ISSM Approval Record | GitHub Environment log | GitHub audit log | Indefinite |
| Pipeline Run Log | GitHub Actions log | GitHub | 90 days |
| Gate | Fail Condition | Enforcement |
|---|---|---|
| GATE 1 | Semgrep ERROR findings | Pipeline aborts, no image built |
| GATE 2 | SBOM generation fails | Pipeline aborts, no image pushed |
| GATE 3 | Any secret detected | Pipeline aborts, credential rotation required |
| GATE 4 | CRITICAL CVE in image | Pipeline aborts, base image update required |
| GATE 5 | HIGH-risk DAST alerts | Finding tracked, remediation required per SLA |
| GATE 6 | ISSM rejects | Pipeline aborts, developer fixes and resubmits |
| GATE 7 | Signing failure | Image not deployable (Kyverno blocks unsigned) |
| GATE 8 | Push failure | Image not available for deployment |
ci/github-actions/build-scan-deploy.yamlci/gitlab-ci/build-scan-deploy.gitlab-ci.ymlci/github-actions/dast-scan.yamlci/github-actions/update-gitops.yamlcosign verify output)verify-image-signatures policy YAMLrestrict-image-registries policy YAMLcosign verify command demonstrating signature validation| Role | Name | Phone | |
|---|---|---|---|
| System Owner | |||
| ISSM | |||
| ISSO | |||
| Lead Engineer |
I certify that the CI/CD pipeline tools listed in Section 4 have been configured, tested, and validated to implement all 8 RAISE security gates as defined in reference (a). The pipeline enforces automated security scanning, manual ISSM review, cryptographic image signing, and admission control verification for all container images deployed to the SRE platform.
I request the Technical Authority review and certify these tools for use in the SRE RPOC.
RPOC System Owner / ISSM
Technical Authority Disposition
Run these commands to collect evidence artifacts for the submission package:
When a CI/CD tool requires a version update:
1. Test updated tool in the development environment pipeline
2. Verify all 8 gates still function correctly with the new version
3. Update version pin in pipeline workflow files
4. Document the change in the CHANGELOG
5. Notify the ISSM of the tool version change
6. If a tool is being replaced (not just updated), coordinate with the SCA and AO per SLA Section 16