You click Create in the left menu and then select the Choose button for the Secured Quarkus Service Software Supply Chain GPT.

You keep the default values and click the Next button on the first two forms.

Before you click the Review button on the third form, you show the team that Verify Commits is set to enabled in this form.

This is because this GPT is using the Trusted Artifacts Signer to verify that code commits are signed.

You click the Review button.

After quickly reviewing the summary and seeing that everything looks great, you proceed to click the Create button.

The secure GPT executes successfully, you seize this moment to explain the value of using GPTs in this scenario.

"This environment," you explain, "is created with all the security guardrails we discussed. What’s fantastic about Golden Path Templates is that the enhancements in the security pipeline are entirely transparent to our developer. This means they won’t impact how he codes or builds applications."

"To trigger our secure build pipeline, let’s open VSCode and make a small change to the documentation.", you say.

You click on the Open Component in Catalog link.

You find and click on the OpenShift Dev Spaces (VSCode) link.

OpenShift Dev Spaces then begins creating your workspace, just like before.

After waiting a few minutes for OpenShift Dev Spaces to finish setting up your workspace, you’re presented with your IDE.

You click the button Yes, I trust the authors.

"For the purpose of this demo, updating the documentation will be enough to trigger the new build pipeline" you explain.

You expand the docs folder and open the markdown file index.md.

At the document’s end, you add: "Build pipeline integrated with security tools."

You click on the Hamburger button (three horizontal bars) on the top left of your screen and select Terminal → New Terminal

Before you start committing your code, you confirm the Gitsign git config.

"As you see, our development environment has been configured for Gitsign", you explain.

Run the below command on the VS Code terminal to view the Gitsign global git config:

git config --global --list

To begin commiting your code to the repository, run the following command to add your changes to staging:

git add .

Run the next command to commit your changes:

git commit -m "Doc Update"

You will notice that you receive an error message that states error opening browser: exec: "xdg-open": executable file not found in $PATH. This is because our VS Code terminal is trying to open a browser window to obtain your credentials for signing but is unable to as it is running as a container.

However, Gitsign allows you to provide your signing credentials by copying and pasting the url it outputs into a separate browser window.

Copy and paste the url into a new browser tab/window and hit enter.

The browser will prompt you for your credentials. Enter {developer_cluster_devspaces_user} for the username and {developer_cluster_devspaces_user_password} for the password.

You will then be redirected to another page that will present a verification code. Copy this code into your clipboard.

Return to Dev Spaces and paste this code into the waiting prompt in the VS Code terminal and hit enter:

Enter verification code:

If successful, you should receive a successful commit message:

Push the code to the repository with the below command:

git push

This action sets the build pipeline into motion.

You switch back to the Developer Hub and select the CI tab from the top menu, and expand the pipeline view to show the team that pipeline execution is in progress.

You wait a few minutes until the build pipeline execution is complete, before you start explaining the security enhancements made to the build pipeline.

"Remember the build process we used for the insecure application? We’ve now added six new tasks to the pipeline, incorporating the security recommendations I outlined earlier."

"The first task after cloning our git repo, is ensuring the source code modifications were made by a trusted sourc," you explain.

"This task will only succeed if it can verify a trusted signature on the last commit that triggered the pipeline. This is the signature we provided using GitSign when we committed the code from Dev Spaces."

You then click on the task verify-commit and pull up the logs.

"Here in the log, you can see the user we used and the comment we provided when we made the last code change.”

"The verify-commit task executes the command git verify-commit to verify that the signature is valid, before the pipeline moves to the next task." you point out.

"After we package the code, running a static analysis to detect any potential bugs or code style violations is a good idea."

I’ve setup a task called scan-source task, we utilize a tool called SonarQube to analyze the source code and provide reports based on its quality.

"We can view the scan results from the pipeline logs as we did before, or we could log in to SonarQube to get an in-depth report."

"Let’s look at the SonarQube report this time," you decide.

To access SonarQube, you use the following link:

You click on the project link in the SonarQube Dashboard.

"Our application has passed the validation test by SonarQube, with a few minor issues," you observe.

"I do recommend that you look into those issues nevertheless."