This repo is used for testing DevSecOps practices and tool sets, and is used for demonstration purposes only. If there is a tool you would like to see added, please submit a Feature Request Issue with the details about the tool.
This repo contains both Azure Pipeline YAML files and GitHub Actions YAML files, for comparison purposes.
The application code is based on the Microsoft eShopOnWeb sample application. This is self-contained within the Application-Source-Code directory.
Warning This repo contains code that is purposefully vulnerable and insecure. Use at your own risk!
There are several directories that contain additional/other sample code, specific to infrastructure and security pipelines.
For example, the Infrastructure-Source-Code directory, contains ARM templates, Bicep templates, and Terraform code, that is not specific to the application source code itself. The Security-Source-Code directory, contains files that include credentials and secrets, again, not specific to the application source code itself.
The Threat-Modeling directory contains examples of threat-modeling-as-code tools, which is not related to the application source code.
The pipelines are grouped into the following categories:
The GitHub Action Workflows use the pipeline categories as a prefix, for grouping purposes.
The following YAML-based Azure DevOps (ADO) pipelines have been created and tested.
Note: The majority of these are based on Terraform code
The following YAML-based GitHub Actions (GHA) Workflows have been created and tested.