How do I initialize the DevSecOps CI Pipeline (Gitleaks, Semgrep, CodeQL, Trivy, SBOM) kit?

Clone the repository with `git clone https://github.com/Umar-444/Techtalks-stack-kits.git`, navigate to `kits/security-devsecops-ci/`, and hand the bootstrap prompt to your AI coding agent.

Which AI agents support DevSecOps CI Pipeline (Gitleaks, Semgrep, CodeQL, Trivy, SBOM)?

The kit's rules are automatically transpiled into 6 native formats: Cursor (.cursor/rules/*.mdc), Claude Code (CLAUDE.md), GitHub Copilot (.github/copilot-instructions.md), Cline (.clinerules), OpenAI Codex (CODEX.md), and Antigravity (.agents/rules/*.md).

What security invariants are enforced in DevSecOps CI Pipeline (Gitleaks, Semgrep, CodeQL, Trivy, SBOM)?

The kit enforces zero plaintext credentials via Gitleaks, parameterized queries, and resource-level authorization policies.

Verified Complete Kit v1.0.0

DevSecOps CI Pipeline (Gitleaks, Semgrep, CodeQL, Trivy, SBOM)

Stack-agnostic, drop-in GitHub Actions DevSecOps workflow pipeline: automated Gitleaks secrets audit, Semgrep SAST, GitHub CodeQL, Aqua Trivy container/filesystem CVE scanner, Syft CycloneDX SBOM generation, and Dependabot.

{'name': 'YAML / Bash', 'version': '1.0', 'registry': 'github.com/actions'} {'name': 'GitHub Actions', 'version': 'v4', 'registry': 'github.com/actions'}

Agent Bootstrapping

Pre-Wired Rules

Single-source rules compiled to 6 native agent dialects. Transpiled deterministically from rules/source/.

• .cursor/rules/*.mdc

• CLAUDE.md

• .agents/rules/*.md

• .clinerules & CODEX.md

Security Guardrails

Automated Scanners

Invariants asserted in CI before merge. Scanned by Gitleaks and Semgrep AST checkers.

Standard Security Scan Protocol Enabled

Docker Scaffolding

Turnkey Containers

Runnable containers with pre-wired environment variables, healthchecks, and dependency locks.

docker compose up -d

Agent Bootstrap Prompt

Feed this exact prompt into Claude Code, Cursor, Copilot, or Antigravity to anchor the agent:

You are building with the DevSecOps CI Pipeline (Gitleaks, Semgrep, CodeQL, Trivy, SBOM) kit. Follow rules in AGENTS.md, DESIGN.md tokens, and steps/agent-build-steps.md.