Welcome to InflectraCon 2020! Please enjoy Inflectra's partner presentation on common DevSecOps pipeline concepts and the integration of a typical pipeline with the Spira family of tools. The key takeaways are: - Explore foundational DevSecOps pipeline concepts, components, and functions. - Understand how the move to DevSecOps can help detect defects before production quickly and prevent continuous bugs. - Learn how you can jump-start your efforts and have a working pipeline on your project. The presentation is by the Inflectra Partner - Coveros. The companion video is available here https://www.youtube.com/watch?v=bTQJtr1Digw

1. Inflectra In Real Life
Integrating a
DevSecOps Pipeline
with the Spira Family
of Tools
@Inflectra | #InflectraCon

2. Hugo Sanchez
Managing Consultant • Coveros, Inc.

3. Hugo Sanchez
Managing Consultant • Coveros, Inc.

4. Quick Overview
▪ What is a DevSecOps Pipeline?
▪ Finding defects before production quickly
and preventing continuous bugs
▪ Integrating Spira with a Pipeline
▪ Jump-start your efforts to get a working
pipeline on your project

5. Our Sample Application
https://github.com/7ep/demo/
Built from the ground up using a variety of Agile
development best practices like BDD and TDD.

6. Our Sample Application
Testing includes: Unit tests, Database tests,
Acceptance Tests, Security static analysis, API
tests, UI BDD tests, UI tests, Security dependency
analysis, Performance tests and Mutation tests.
https://github.com/7ep/demo/

7. Application Artifacts in Spira
▪ Release
▪ Requirements
▪ Test Cases
▪ Test Runs
▪ Product QA Dashboard

8. DevSecOps
Development and Operations Tension:
▪ Development wants fast creation and innovation
▪ Operations wants bug-free, secure, and stable
systems
A pipeline is a set of tools, technologies, and
automated processes, enabling teams to
consistently build, test, and deploy software
meeting Quality & Security Requirements.

9. DevSecOps Pipelines
Delivery-focusedCode-focused Quality-focused
From Speed to No Surprises

10. DevSecOps Pipelines
Core components and functions:
▪ Continuous Integration Tools merge
code in a central repository
▪ Continuous Deployment Tools manage
configuration and infrastructure
▪ Continuous Testing Tools automate tests
▪ Automation Servers orchestrate pipelines

11. Incorporating Quality & Security Gates
Delivery-focusedCode-focused Quality-focused

12. Incorporating Quality & Security Gates

13. Incorporating Quality & Security Gates

14. Incorporating Quality & Security Gates

15. Our Demo Pipeline
Build and Integration
Quality Assurance & Staging

16. ▪ Code Repository - GitHub
▪ Build - Gradle
▪ Unit Tests – JUnit / JACOCO
▪ Database Tests – Executed with
JUnit
▪ Automated Acceptance Tests –
Cucumber
▪ Security: Static Analysis –
SonarQube
▪ Deploy to TEST – Deployed with
Tomcat
▪ API Tests – PyTest
▪ UI BDD Tests – Quick readiness
check, Behave (similar to
Cucumber, Gherkin syntax),
Selenium
▪ UI Tests – JUnit, html UnitTests and
Selenium
▪ Security: Dependency Analysis –
OWASP Dependency Check
▪ Performance Tests – JMeter
▪ Mutation Tests – PiTest
▪ Send Results to Spira – Python /
Jenkins Pipeline
▪ Build Documentation – Javadoc
Our Demo Pipeline

17. Integrating Spira
DevSecOps PipelineSpira
Release
• Requirements
• Test Cases
• Test Runs
• Product Dashboard
Release Decision
Build
Automated Tests
Deployment to TEST
Automated Tests
Analysis
Documentation
Update Spira
Deploy / Release
Trigger
Update
• Requirements
• Test Cases
• Test Runs
• Product Dashboard
Trigger

18. DevSecOps
Pipeline
Demo

19. Updated Artifacts in Spira
▪ Release
▪ Requirements
▪ Test Cases
▪ Test Runs
▪ Product QA Dashboard

20. Key Takeaways
▪ The move to DepSecOps is happening. Testing is
needed otherwise what ends up in production might not
reflect the level of quality you desire
▪ Quality is important on a pipeline because you don’t
want continuous bugs
▪ Pipelines enable rapid feedback (Defects) from your
customers and the ability to detect defects prior to
production quickly and fix them
▪ You already have a foundation with the Spira toolset
and we can integrate them for you

21. Coveros QuickStart Programs
DevSecOps Pipeline QuickStart
▪Includes installation, implementation, and training
Pipeline—Spira Tools Integration QuickStart
▪Includes implementation and training
SpiraTest Automation QuickStart
▪Includes consulting and implementation
www.coveros.com/QuickStarts

22. Coveros helps companies accelerate the
delivery of secure, reliable software using
agile methods
Agile/DevOps Transformations
Agile Software Development
Agile Testing & Automation
DevOps Engineering
DevSecOps
Agile, DevOps, DevSecOps,
Testing Training
Open Source Products

23. Coveros helps companies accelerate the
delivery of secure, reliable software with
agile methods
Agile/DevOps Transformations
Agile Software Development
Agile Testing & Automation
DevOps Engineering
DevSecOps
Agile, DevOps, DevSecOps,
Testing Training
Open Source Products

24. Hugo Sanchez
hugo.sanchez@coveros.com

25. Coveros, Inc.
+1 929.341.0139 • coveros.com

26. Thank You!