You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
docs: convert pipeline, SAST, DAST, IAST and pre-commit diagrams to Mermaid (#89) - #119
First step toward "diagram as code": converts five of the static PNG diagrams into Mermaid blocks on the corresponding current-version pages. Mermaid renders natively in GitHub Markdown and keeps diagrams versionable and reviewable alongside the text.
One commit per diagram:
Commit
Diagram (PNG source)
Page
docs(pre-commit)
pre-commit.png
2-2-1-1-Pre-commit.md
docs(sast)
sast_scanning.png
2-3-1-1-Static-Application-Security-Testing.md
docs(dast)
dast_scanning.png
2-4-2-Dynamic-Application-Security-Testing.md
docs(iast)
iast_analysis.png
2-4-1-Interactive-Application-Security-Testing.md
docs(overview)
Pipeline-view.png
0-2-Overview.md (new "The secure pipeline at a glance" section)
Notes
These PNGs were no longer referenced from current-version (only from old-versions/V0.3), so the Mermaid diagrams are added to the current pages rather than swapped in place. The PNG files are left untouched so old-versions links keep working.
The pipeline diagram replaces vendor logos with vendor-neutral stage names (SAST, SCA, IaC scanning, etc.), consistent with the guideline's tooling-agnostic approach. Findings are routed to Central Vulnerability Management at the CI/CD stage level to keep the diagram readable.
All blocks were validated with mermaid.parse and rendered with mermaid-cli to check layout.
@irish1986 — you mentioned you had WIP for this; happy to reconcile with your changes or follow up with the remaining diagrams (DevSecOps-cycle, DevSecOps-pipeline, devsecops-pillars, DevOps-vs-DevSecOps, container-scanning diagrams) in a next PR.
Converts the pre-commit.png flow (working directory -> staging -> pre-commit
hooks -> local repo -> remote repo, with the issue/no-issue loop) into a
version-controlled Mermaid flowchart on the current-version Pre-commit page.
Refs OWASP#89
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Converts dast_scanning.png (scanner sends a SQL payload, target returns a
SQL error) into a Mermaid sequence diagram on the current-version DAST page.
Refs OWASP#89
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Converts Pipeline-view.png into a Mermaid flowchart on the current-version
Overview page: application and infrastructure CI/CD pipelines, the gates
between them, deployments to staging/production, continuous scanning of the
registry and environments, and all findings flowing to central vulnerability
management. Vendor logos are replaced by vendor-neutral stage names.
Refs OWASP#89
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Register a mermaid custom fence in pymdownx.superfences so MkDocs Material
renders the new diagram-as-code blocks instead of showing them as source.
Verified with a local mkdocs build: all five pages render SVGs.
Refs OWASP#89
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
White text on the blue and orange nodes was below the 4.5:1 WCAG AA ratio;
default dark text gives 6.4:1 and 6.9:1.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…n point
A SQL error alone does not prove injection; the note now says it suggests
an injection point that needs verification.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
mkdocs.yml now uses the !!python/name tag required by the pymdownx
Mermaid superfence, which the default safe loader rejects. --unsafe
still validates syntax but tolerates custom tags.
Refs OWASP#89
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Align diagram labels with risk-based security gate policy
current-version/0-Intro/0-2-Overview.md:51
The No vulnerability labels here and on lines 41 and 49 imply that every finding blocks promotion; No issue on line 51 suggests the same. This conflicts with the risk-based gates, baselines, and accepted exceptions described in current-version/2-Process/2-3-Build/2-3-5-Security-Gates.md:11–14. Label these transitions as passing the security policy so the diagram stays consistent with that guidance.
🧠 Review effort: Balanced
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #89
Summary
First step toward "diagram as code": converts five of the static PNG diagrams into Mermaid blocks on the corresponding
current-versionpages. Mermaid renders natively in GitHub Markdown and keeps diagrams versionable and reviewable alongside the text.One commit per diagram:
docs(pre-commit)pre-commit.png2-2-1-1-Pre-commit.mddocs(sast)sast_scanning.png2-3-1-1-Static-Application-Security-Testing.mddocs(dast)dast_scanning.png2-4-2-Dynamic-Application-Security-Testing.mddocs(iast)iast_analysis.png2-4-1-Interactive-Application-Security-Testing.mddocs(overview)Pipeline-view.png0-2-Overview.md(new "The secure pipeline at a glance" section)Notes
current-version(only fromold-versions/V0.3), so the Mermaid diagrams are added to the current pages rather than swapped in place. The PNG files are left untouched soold-versionslinks keep working.mermaid.parseand rendered withmermaid-clito check layout.@irish1986 — you mentioned you had WIP for this; happy to reconcile with your changes or follow up with the remaining diagrams (
DevSecOps-cycle,DevSecOps-pipeline,devsecops-pillars,DevOps-vs-DevSecOps, container-scanning diagrams) in a next PR.cc @Ali-Yazdani