This repository demonstrates an Enterprise DevSecOps CI/CD Pipeline built using GitHub Actions, Docker, Kubernetes, and Amazon EKS.
The goal of this project is to implement a production-inspired DevSecOps workflow by integrating automated security scanning, static code analysis, testing, containerization, image scanning, Software Bill of Materials (SBOM) generation, and Kubernetes deployment.
The pipeline follows Shift Left Security, ensuring security checks are performed throughout the Software Development Lifecycle (SDLC) before deployment.
- Automated GitHub Actions CI/CD Pipeline
- Secret Detection using Gitleaks
- Infrastructure Security Scanning using Checkov
- Filesystem Vulnerability Scanning using Trivy
- Client & Server Linting
- Automated Unit Testing
- SonarQube Static Code Analysis
- SonarQube Quality Gate Validation
- Multi-stage Docker Build
- Docker Image Vulnerability Scanning
- Software Bill of Materials (SBOM) Generation
- Docker Hub Image Publishing
- Automatic Kubernetes Manifest Update
- Kubernetes Deployment to Amazon EKS
- Deployment Rollout Verification
graph LR
A[Developer] -->|Git Push| B[GitHub Repository]
B --> C[CI/CD Pipeline]
C --> D[SonarQube SAST]
C --> E[Trivy Container Scan]
D --> F{Security Gate Pass?}
E --> F
F -->|Yes| G[Docker Hub / ECR]
G --> H[Kubernetes Deployment]
Developer Push (QA Branch)
│
▼
GitHub Actions Trigger
│
▼
Gitleaks Secret Scan
│
▼
Checkov Security Scan
├── Terraform
├── Kubernetes
└── Docker
│
▼
Trivy Filesystem Scan
├── Client
└── Server
│
▼
Client & Server Lint
│
▼
Client & Server Tests
│
▼
SonarQube Analysis
│
▼
Client Build
│
▼
Multi-stage Docker Build
│
▼
Trivy Image Scan
│
▼
SBOM Generation
│
▼
Push Docker Image
│
▼
Update Kubernetes Manifest
│
▼
Deploy to Amazon EKS
│
▼
Verify Deployment
The complete CI/CD workflow is implemented using GitHub Actions.
This project follows a simple environment-based branching strategy.
| Branch | Purpose |
|---|---|
| main | Production Environment |
| qa | QA / Staging Environment |
The QA pipeline performs:
- Secret Scanning
- Security Validation
- Linting
- Unit Testing
- SonarQube Analysis
- Docker Build
- Docker Image Scan
- SBOM Generation
- Docker Image Push
- Kubernetes Deployment to QA Cluster
A separate production deployment workflow is included for production releases after QA validation.
Scans the Git repository for accidentally committed:
- Secrets
- API Keys
- Tokens
- Passwords
- AWS Credentials
Infrastructure as Code (IaC) security scanning for:
- Terraform
- Kubernetes Manifests
- Dockerfile
Scans the client and server source code for:
- Vulnerabilities
- Misconfigurations
- Security Issues
Runs linting on both client and server applications.
Runs application test cases before deployment.
Performs:
- Static Code Analysis
- Bugs Detection
- Code Smells
- Security Hotspots
- Maintainability Analysis
The Quality Gate validates the project before continuing.
A secure multi-stage Docker build is used to produce a lightweight production image.
Security best practices include:
- Multi-stage Build
- Alpine Images
- Production Dependencies Only
- Non-root User
- Reduced Attack Surface
The generated Docker image is scanned before publishing.
Checks include:
- Critical Vulnerabilities
- High Vulnerabilities
SBOM files are generated for:
- Source Code
- Docker Image
This improves software supply chain transparency.
Images are published using:
- Commit SHA Tag
- Latest Tag
The deployment manifest is automatically updated with the latest Docker image tag before deployment.
The application is deployed using:
- GitHub OIDC Authentication
- AWS IAM Role
- kubectl
- Kubernetes Manifests
Deployment verification is automatically performed after rollout.
This project uses a multi-stage Docker build.
Highlights:
- Frontend Build Stage
- Backend Runtime Stage
- Production Dependencies
- Non-root User
- Lightweight Alpine Images
- Optimized Image Size
Deployment uses the following Kubernetes resources.
- Deployment
- Service
- Ingress
Separate manifests are maintained for:
- QA
- Production
.
├── .github/
│ └── workflows/
│ ├── qa-cicd.yml
│ └── prod-cd.yaml
│
├── client/
│
├── server/
│
├── k8-manifests/
│ ├── qa/
│ │ ├── app-deployment.yaml
│ │ ├── app-svc.yaml
│ │ └── app-ingress.yaml
│ │
│ └── prod/
│ ├── app-deployment.yaml
│ ├── app-svc.yaml
│ └── app-ingress.yaml
│
├── docs/
│ ├── architecture.png
│ └── screenshots/
│ ├── github-actions-pipeline.png
│ ├── sonarqube-dashboard.png
│ ├── trivy-report.png
│ └── deployment.png
│
├── Dockerfile
├── sonar-project.properties
├── .gitignore
└── README.md
This project was successfully developed and tested as an end-to-end DevSecOps learning project.
The AWS learner account originally used to host the Amazon EKS cluster and related cloud resources has since expired after the available credits were exhausted. As a result, the deployment stage cannot currently be demonstrated.
The repository still contains the complete implementation of:
- GitHub Actions workflows
- Docker configuration
- Kubernetes manifests
- Security scanning
- CI/CD automation
- Deployment logic
- Helm Charts
- ArgoCD GitOps Deployment
- Prometheus Monitoring
- Grafana Dashboards
- Horizontal Pod Autoscaler
- Slack Notifications
- Canary Deployment
- Blue/Green Deployment
- Terraform Infrastructure Provisioning
DevOps & Cloud Engineer
📧 Email: gaurav.bhardwaj4@hotmail.com
🔗 LinkedIn: https://www.linkedin.com/in/YOUR-LINKEDIN
💻 GitHub: https://github.com/Gauravbhardwajdev
If you found this project useful, consider giving it a ⭐ on GitHub.