building a DevSecOps pipeline