U.S. Air Force

Background

The United States Air Force operates software development and delivery environments supporting a wide range of mission systems. GitSimple has supported multiple Air Force programs, delivering DevSecOps platform engineering and sustainment across secure environments. Specific program names and organizational designations are withheld.

The Need

Air Force software teams are asked to deliver capability quickly while meeting security and compliance requirements that leave little margin for error. Across these environments, security review frequently happened late in the lifecycle, which meant vulnerabilities surfaced close to deployment or after it, when remediation is most disruptive and most expensive.

The programs GitSimple supported needed GitLab environments implemented and tuned for scale, integrated with dedicated container security and artifact management tooling rather than running as disconnected point solutions. Standing up the individual tools was the straightforward part. Making them operate as a single governed pipeline, with enforcement built into the path to production, was the harder requirement, and it needed engineers who understood both the platform and the constraints of the environments it ran in.

What We Did

• Implemented and optimized GitLab environments sized and configured to each program’s requirements (500+ GitLab Ultimate users)
• Integrated Anchore for container vulnerability scanning and SBOM generation, embedding security analysis directly into pipeline workflows
• Integrated JFrog for artifact management, establishing controlled artifact flow across build, scan, and deployment stages
• Configured security gates to evaluate builds before deployment rather than relying on downstream review
• Delivered ongoing support and maintenance across environments, including upgrades, configuration management, and platform health
• Advised on continued optimization as adoption scaled and program requirements evolved

The Result

Embedding scanning and artifact governance directly into GitLab pipelines shifted security review substantially earlier in the lifecycle. Programs identified 20% more vulnerabilities prior to deployment, catching issues while they remained inexpensive to remediate instead of discovering them in production. Consolidating onto an integrated, properly configured toolchain also produced a high level of cost savings, reducing duplicated tooling and the manual effort previously required to carry code from commit through security review to deployment.