pipeline-securitylisted

# Pipeline Security Configuration Security scanning configuration templates for CI/CD pipelines. This skill provides templates for Semgrep (SAST) and TruffleHog (secret scanning) and mappings for multiple CI/CD providers. <HARD-RULES> ## HARD-RULES - Non-Negotiable Requirements These rules MUST be followed in every generated configuration. Violation of any rule makes the output non-compliant. 1. Semgrep MUST always include `p/owasp-top-ten` config for every language 2. Semgrep MUST always include `p/security-audit` config for every language 3. Semgrep MUST always include `p/secrets` config for every language 4. TruffleHog MUST use `--results=verified,unknown` flag 5. Each Semgrep step MUST have two passes: - **Soft pass**: generates SARIF report, does NOT fail the build (`|| true`) - **Hard pass**: fails on `--severity=ERROR` and `--severity=WARNING` with `--error .` 6. Each detected language MUST get its own separate Semgrep step 7. Framework-specific Semgrep rulesets MUST be added when the framework is detected in project dependencies </HARD-RULES> ## Security Components ### TruffleHog - Secret Scanning (Universal) TruffleHog is language-agnostic. One step per pipeline. **Image:** `trufflesecurity/trufflehog:latest` **Logic:** The step must detect whether it is running in a PR context or a regular commit context: - **PR context**: scan full git history, output JSON report, then re-run with `--fail` - **Commit context**: scan since last commit (`HEAD~1`), out