DevSecOps CI/CD Pipeline Pipeline with GitHub Actions

📌 Project Overview

This repository demonstrates a DevSecOps CI/CD pipeline for a Node.js Express application. It focuses on the "Shift-Left" security, ensuring that security and quality checks are integrated deep into the automated workflow.

The application serves a simple /health endpoint, while the infrastructure provides a robust pipeline that automates everything from unit testing to security-hardened container deployments.

---

---

Pipeline Diagram

---

🛠️ Tech Stack

• Backend: Node.js (v18+) & Express
• Containerization: Docker & Multi-stage builds
• CI/CD: GitHub Actions
• Security: Trivy (Shift-Left Vulnerability Scanning)
• Testing: Node.js Test Runner & Smoke Tests

---

PR Pipeline

Main Branch Pipeline

Scheduled Health Check

Dependency Review

🚀 Getting Started

1. Running Locally

Ensure you have Node.js installed on your machine.

1. Install dependencies:

   npm install

2. Start the application:

   npm start

3. Verify the endpoint: Open http://localhost:3000/health in your browser.

---

2. Running with Docker

This project uses multi-stage builds and non-root user isolation for security.

1. Build the image:

   docker build -t node-app .

2. Run the container:

   docker run -p 3000:3000 node-app

3. Check health:

   curl http://localhost:3000/health