From CI/CD to AI-Powered DevSecOps: Teaching a Local LLM to Analyze Security Reports

In the previous

The Flow:

• Build application


• SonarQube analysis


• Quality Gate validation


• Docker build


• Trivy security scan


• Upload reports to Nexus


• Trigger AI workflow


• Download report dynamically


• Ask local LLM to analyze findings


• Send AI-generated recommendations

The AI component in this setup answers the "What if's" questions that I had before. Before I move to the setup, I want to justify why I added the layer of AI . Let's be fair to the security guys here - Security reports can be long and noisy. It can have dozens of CVE's, dependent vulnerabilities and what not. Having them accountable for any miss sounds unfair. Here's where AI can help, It's like telling someone "read this report and give me the top 10 things i should be worried about in 10 seconds".

Sneak Peak of the setup:

1. Ran ollama locally using its docker image. Locally, because i wanted to avoid external API's and also because of poverty (😂)


2. Setup n8n also locally using its docker image. This is where we orchestrate the entire process using workflows.
   
   
   
   
   • The jenkins job calls the webhook that n8n listens on.
   
   
   • N8n kicks off the workflow by : Fetching the trivy report -> The next step is to prepare the AI prompt -> Send to Ollama and transform the response -> Send the report via email
   
   
   
   

This is how my workflow looks in n8n UI:

Further improvement is to train our LLM to be a junior SRE.