🚀 DevSecOps CI/CD Pipeline with GitHub Actions

A comprehensive DevSecOps implementation showcasing a complete CI/CD pipeline with integrated security scanning, code quality analysis, and automated deployment using GitHub Actions, SonarCloud, and Kubernetes.

🏗️ Pipeline Architecture

This DevSecOps pipeline implements a comprehensive security-first approach with the following stages. For comprehensive pipeline documentation and workflow details .github/workflows/README.md

🔄 Pipeline Flow

1. Source Control - Developer commits trigger the pipeline
2. Pre-Build Security - Secrets scanning (Gitleaks) and dependency/IaC scanning (Trivy FS)
3. Code Validation - Unit testing with comprehensive test coverage
4. Static Code Quality - SonarCloud analysis with quality gate enforcement
5. Build & CI Artifacts - Application build and artifact upload
6. Container Build & Security - Docker image creation with Trivy image scanning and pushing to GHCR
7. Continuous Delivery - Automated Kubernetes manifest updates for GitOps deployment

🎮 Application Overview

🚀 Getting Started

Tech Stack

This project features a modern React-based Tic-Tac-Toe game built with:

• React 18 with TypeScript for type safety
• Tailwind CSS for responsive styling
• Vite for fast development and optimized builds
• Vitest for comprehensive unit testing
• ESLint for code quality enforcement

🔧 Getting Started

Prerequisites

• Node.js (v18 or higher)
• npm or yarn
• Docker (for containerization)
• kubectl (for Kubernetes deployment)

📦 Installation

1. Clone the repository:

   git clone https://github.com/atkaridarshan04/devsecops-github-actions.git
   cd devsecops-github-actions

2. Install dependencies:

   npm install
   # or
   yarn install

3. Start the development server:

   npm run dev
   # or
   yarn dev

4. Open your browser and navigate to:

   http://localhost:5173
   

🏗️ Building for Production

To create a production build:

npm run build
# or
yarn build

The build artifacts will be stored in the dist/ directory.

🧪 Running Tests

Execute the test suite:

npm test
# or
yarn test

🐳 Docker Deployment

Build and run the application using Docker:

# Build the Docker image
docker build -t tic-tac-toe-app .

# Run the container
docker run -p 80:80 tic-tac-toe-app

Implementation Steps

1. Clone Repository

git clone https://github.com/atkaridarshan04/devsecops-github-actions.git
cd devsecops-github-actions

---

2. SonarCloud Setup

Step 1: Create SonarCloud Project

1. Navigate to SonarCloud and create a new project:

2. Configure new code definition - Select "Previous version" for projects following regular versions or releases.

---

Step 2: Generate Authentication Token

1. Go to Security settings in your SonarCloud account:

2. Generate a new token with appropriate permissions for your CI/CD pipeline.

---

Step 3: Configure Project and Organization Keys

Project Key Configuration:

Organization Key Setup:

Step 4: Project Information Overview

The project information page shows:

• Quality Gate: Sonar way (default)
• Quality Profiles: CSS and TypeScript using Sonar way
• Project Key: atkaridarshan04-devsecops-github-actions
• Organization Key: atkaridarshan04-devsecops-github-actions

---

Step 5: Configure sonar-project.properties

Ensure to update your sonar-project.properties file with the correct project and organization configurations.

---

Step 6: Disable Automatic Analysis for CI/CD

Important: For CI/CD integration, disable automatic analysis:

1. Go to Administration → Analysis Method
2. Disable Automatic Analysis
3. Select "With GitHub Actions" for CI integration

Note: Let the project run with automatic analysis initially to establish a baseline, then disable it for CI/CD integration to avoid conflicts.

---

3. GitHub Token & Secrets Setup

Create GitHub Personal Access Token

• Go to Settings → Developer settings → Personal access tokens → Tokens (classic)
• Generate new token with permissions:
  • contents: write (for updating Kubernetes manifests)
  • packages: write (for pushing to GitHub Container Registry)
  • actions: read (for workflow access)

Add Repository Secrets

• Go to your repository Settings → Secrets and variables → Actions
• Add the following secrets:

  SONAR_TOKEN=your_sonarcloud_token_here
  GH_TOKEN=your_github_personal_access_token
  

---

4. Run Pipeline

Make a change and push to main branch or start the workflow manually

Monitor execution in GitHub Actions tab and verify all security scans pass.

5. Verify Analysis Results

Head over to SonarCloud to review the analysis results.

---

6. Kubernetes Deployment

You can further configure GitOps deployment using ArgoCD or FluxCD to automate application deployment to your Kubernetes cluster.

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

---

Built with ❤️ for DevSecOps Excellence
⭐ Star this repository if you find it helpful!