---
name: devsecops-devsecops-bp-ci-toolchain
title: Best practices in continuous integration toolchain
description: The implementation of continuous integration (CI) toolchain DevSecOps follows these practices.
last-updated: 2024-02-22
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/devsecops?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Best practices in continuous integration toolchain
{: #practices-ci-toolchain}

The implementation of continuous integration (CI) toolchain DevSecOps follows these practices.
{: shortdesc}

* Runs a static code scanner on the application repositories to detect secrets in the application source code and vulnerable packages that are used as application dependencies.
* Builds a container image on every Git commit, setting a tag based on build number, timestamp, and commit ID for traceability.
* Tests the Dockerfile before the image creation.
* Stores the built image in a private image registry.
* Automatically configures access permissions for target cluster deployment by using API tokens to revoke.
* Scans the container image for security vulnerabilities.
* Adds a Docker signature upon successful completion.
* Automatically inserts the built-image tag into the deployment manifest.
* Uses an explicit namespace, in the cluster, to insulate each deployment (`kubectl delete namespace` command).
* Automatically builds, validates, and deploys any code that is merged into the target Git repository branch to the Kubernetes cluster.