Halodoc Implements Zero-Trust Framework for SDLC Security with Jenkins Pipelines

Halodoc, a leading health-tech platform, has detailed its comprehensive zero-trust framework aimed at bolstering the security of its Software Development Life Cycle (SDLC) and mitigating supply chain risks. At the core of this architecture lies the Jenkins Pipeline, which functions as the primary Continuous Integration (CI) engine, orchestrating the journey of code from development to artifact creation. The framework is structured in layers, beginning with GitLab, which serves as the source code management and governance layer. Here, dependencies are meticulously declared and continuously audited. This initial layer is crucial for establishing a centralized control point for all software components. Halodoc emphasizes the strategic decision to centralize dependency declarations in a parent manifest, from which all services inherit, thereby ensuring consistency and control over the dependency graph. Jenkins Pipelines then take over, acting as the enforcement mechanism for the security policies defined in the governance layer. When a developer submits a merge request, it triggers a Jenkins Pipeline. This pipeline clones the service repository, resolves dependencies against the approved parent file, and initiates the CI/CD workflow. This process is designed with multiple security gates, ensuring that no code can become a deployable artifact without successfully passing these rigorous checks. Further enhancing security, the framework incorporates a Docker Build Stage where source code is compiled into OCI-compliant Docker images on a hardened foundation. A significant innovation is the implementation of an ISDP Cron Job—a scheduled security audit running within Jenkins. This job utilizes Trivy, a vulnerability scanner, to regularly audit the parent dependency files. By scanning these central manifests, Halodoc effectively scans every service simultaneously without needing to clone individual service repositories. This proactive approach ensures that vulnerabilities are identified and addressed promptly, preventing shadow dependencies and version drift across the platform. This multi-layered approach, with Jenkins Pipelines at its operational heart, underscores Halodoc's commitment to maintaining a secure and resilient software supply chain, where security is enforced at every stage of the development lifecycle.