Open Source Summit India 2026

What if every repository in your organisation inherited security, compliance and AI-driven automation the moment it adopted your CI/CD pipeline - with zero extra configuration?

In this session, I'll walk through a fully reusable, open-source-first CI/CD pipeline system built on GitHub Actions/GitLab CI that enforces security and quality gates end-to-end. We'll cover how secret scanning, OWASP Dependency Check, OWASP Dependency-Track, OSV Scanner for container images and SonarQube - community edition for SAST are wired together as non-negotiable pipeline steps - not afterthoughts. I'll demonstrate how Dependabot, Projen and how strict controls actively prevent supply chain attacks before they happen.

Beyond security, the pipeline handles semantic versioning, Cloud deployments, package publishing, artifact management and test report hosting - all reusable across multiple repos.

The talk concludes with the AI layer: using LLMs to auto-generate changelogs, trigger SonarQube self-healing agents and track deployment history for incident response. Attendees will leave with a practical blueprint for adopting OSS tools to build pipelines that are secure, intelligent and built to scale.