DepWarden Client CI/CD Build Gating Setup (Delivery)

DepWarden Client CI/CD Build Gating Setup (Delivery)

1. 01

   Create a DepWarden account and select the Team plan

   Navigate to the pricing page and choose Team ($99/mo) to access 10,000 scans/month, 100 projects, and SAST. This tier supports build gating for client pipelines.

2. 02

   Add a new project for the client

   In the dashboard, click 'Add Project' and enter the client's repository details. Ensure the project is linked to the correct registry (npm, PyPI, Maven) based on the client's stack.

3. 03

   Configure dependency manifest scanning

   Upload or point DepWarden to the client's package-lock.json, requirements.txt, or pom.xml. Verify that the parser correctly identifies all dependencies and their versions.

4. 04

   Set build gating thresholds

   In the project settings, define severity thresholds (e.g., fail builds on critical or high CVEs). Use the OSV.dev integration to cross-reference findings against the public advisory database.

5. 05

   Integrate DepWarden CLI into the client's CI/CD pipeline

   Generate an API token from the account settings and add the DepWarden CLI command to the client's build script. Test the integration in a staging environment to confirm gating works as expected.

6. 06

   Enable typosquatting detection

   Turn on typosquatting detection for npm and PyPI packages. DepWarden uses Damerau-Levenshtein edit-distance matching to flag look-alike package names that could be malicious.

7. 07

   Configure report delivery

   Set up automated report generation in HTML, PDF, Excel, or CSV formats. Schedule reports to be emailed to the client's security contact after each scan or on a weekly basis.

8. 08

   Document the workflow for the client

   Prepare a handoff guide that explains how to read the reports, interpret severity levels, and adjust gating thresholds. Include instructions for adding new projects or updating dependencies.