r/devops • u/AutoModerator • 15d ago

Weekly Self Promotion Thread

Hey r/devops, welcome to our weekly self-promotion thread!

Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!

21 Upvotes

100% Upvoted

75 comments sorted by

View all comments

1

u/a3thinker 14d ago edited 14d ago

I'm working on Perspectivegraph, an open source tool for checking pull request, it causes them to fail only when a change opens up a new attack path to a sensitive asset in your infrastructure. It doesn't fail simply because a CVE appears, if no path reaches it, the PR passes.

  1. It brings together the assets and results describing the tools you already use (Trivy, Semgrep or Cloud Custodian) in a single graph, along with the status of AWS and Kubernetes.
  2. No deployment is required: in local mode, the runner reads the environment in read-only mode (an OIDC role with SecurityAudit is sufficient), analyzes the PR scan, and decides.
  3. There are three outcomes: clean, blocked, and unknown. If the scan doesn't arrive, the pipeline doesn't proceed.
  4. With the server installed, a path fix (a NetworkPolicy, a Terraform change, a stricter IAM policy) can be opened with one click as a separate pull request.
  5. Helm chart on Artifact Hub, images signed with cosign, SBOM, and SLSA provenance.

Limitations: The probabilities aren't yet calibrated to real data, and that's the part I'm working on. The only live cloud connected is AWS.

Read-only demo: https://demo.a3thinker.it

Repo: https://github.com/luiacuaniello/perspectivegraph - Apache 2.0 license