State government automates Checkmarx scanning across 400 applications

The project

This state government IT department is responsible for over 400 applications, developed and maintained by agencies throughout the state and hosted in GitLab CI. The department wanted Checkmarx integrated into the development lifecycle to support consistent, structured static application security testing. The complication: every agency manages its projects differently, with no standardized methodology, so onboarding everyone at once was impossible.

Winmill worked with the department to build Checkmarx-GitLab, a Docker-based .NET Core application that automates a Checkmarx scan pipeline whenever developers commit code to designated projects. The application listens for changes through GitLab webhooks, kicks off the scan, and logs a summary back into GitLab when it completes.

The challenges

• Gradual rollout without redeployment. Agencies had to be introduced into automated scanning one at a time, without redeploying the application for every addition.
• Results where developers already work. Scan findings had to reach developers without new tools or onerous processes that would discourage adoption.
• Speed under constant change. With most of the portfolio in active development, the pipeline had to respond immediately to incoming code changes, and it couldn’t stop responding even under heavy load.

The solution

Checkmarx-GitLab runs on rules defined in a configuration file, so the department introduces new applications into the scanning architecture in a controlled way with a simple file change rather than a code redeployment. The configuration also sets vulnerability count limits that automatically open a GitLab ticket when exceeded.

Scan summaries come back to developers as GitLab comments and tickets, in the environment they already use every day. And the application completes scan requests almost immediately by running scans in parallel, using Docker to spread work across multiple hosts and modern .NET Core task management to do it safely. When the department needs more capacity, it adds Checkmarx scanning engines; the application itself doesn’t change.

The results

• Portfolio-wide visibility. The department now has clear source code assessments for all applications in its portfolio.
• Feedback in the developer’s workflow. Developers see scan summaries posted back to GitLab and confirm their checked-in code is secure, while management reviews trends in Checkmarx or a preferred security portal through configurable REST endpoints.
• Onboarding with a text editor. Adding an application to automated scanning takes a JSON configuration change, no recompile required.
• A security history for every application. Because every commit is scanned, the department can see when a vulnerability was introduced, how quickly it was resolved, and how often it gets reintroduced across the portfolio.