Factory
Security checks a product gets from the delivery kit
· Toolkit · 2 min read
On 19 October 2026 we moved three checks from our products' own pipelines into the delivery kit: a secret scan, a NuGet dependency check, and a check of the addresses that must stay closed after a deploy. A product started from Reputo's pipeline has all three from its first pipeline. The kit's frontend gate already ran npm audit.
Three checks in the kit
Delivery kit 1.1.0 adds a component, secret-scan, that runs gitleaks over the commits a pipeline brings: the merge request's, or a branch's since its previous head. It needs no other job, so it never waits for the build or holds it back. The dotnet-test component now runs dotnet list package --vulnerable --include-transitive right after its restore and fails on a high or critical advisory. It reuses that restore, so the scan adds seconds, not a second restore. Turning it off takes an input, vulnerability_scan: false, which the kit's documentation allows only with a dated reason in the product's pipeline.
Version 1.2.0, released the same day, gives the deploy component an input closed_urls: addresses that must answer 401, 403 or 404 once the deploy is done. A 2xx or 3xx answer fails the check at once, without retries.
Adopted on release day
Reputo and Leadgener moved to 1.1.0 that afternoon. Both pipelines ran the secret scan and the NuGet scan, and neither scan found anything.
That evening, on delivery kit 1.3.0, both products set closed_urls for three addresses: the identity server's admin console, its master realm and the Swagger page. Every deploy now proves that they stay closed: Reputo's dev deploy at 17:43 UTC and Leadgener's at 17:47 UTC logged all three as closed (404).
The check lives in the kit and the rules do not, by design: what closes an address differs by product (a gateway rule, the API's own settings), while whether it is closed is the same question everywhere. A product started from Reputo's pipeline inherits the three addresses, so its first deploy fails if anything that closes them is missing.