From b41c09403950b20c1b1750268f5ff0a3096e0f27 Mon Sep 17 00:00:00 2001 From: Ameerul Mujahidin Date: Sat, 20 Jun 2026 11:20:38 +0400 Subject: [PATCH 1/4] Add CI workflow for linting and Docker build --- .github/workflows/ci.yml | 43 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 00000000..2aa31836 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,43 @@ +# Goal: Build the image for DevBoard Frontend and Push to Docker Hub, after linting the code +name: CI + +on: + push: + branches: [master] + +jobs: + code-lint: + runs-on: ubuntu-latest + steps: + - name: Checkout Code + uses: actions/checkout@v7 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: 20 + cache: "npm" # Automates dependency caching for faster builds + + - name: Install Dependencies + run: npm install + + - name: Run Lint (Biome) + run: npm run lint + + build-and-push: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v7 + + - name: Docker Setup [Login] + uses: docker/login-action@v4 + with: + username: ${{ vars.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Docker Build and Push + uses: docker/build-push-action@v7 + with: + push: true + tags: ${{ vars.DOCKERHUB_USERNAME }}/devboard-fe-master:latest From 16797933fc75123f6237802b92f0b9e28500d475 Mon Sep 17 00:00:00 2001 From: Ameerul Mujahidin Date: Sat, 20 Jun 2026 11:28:13 +0400 Subject: [PATCH 2/4] Remove code-lint job from CI workflow Removed code linting job from CI workflow. --- .github/workflows/ci.yml | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2aa31836..0582df8a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,24 +6,6 @@ on: branches: [master] jobs: - code-lint: - runs-on: ubuntu-latest - steps: - - name: Checkout Code - uses: actions/checkout@v7 - - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: 20 - cache: "npm" # Automates dependency caching for faster builds - - - name: Install Dependencies - run: npm install - - - name: Run Lint (Biome) - run: npm run lint - build-and-push: runs-on: ubuntu-latest steps: From adf34967a5ef93d90308abb4b9635cc5b280e2c1 Mon Sep 17 00:00:00 2001 From: ameertechy Date: Mon, 6 Jul 2026 18:24:42 +0400 Subject: [PATCH 3/4] Add PR trigger workflow --- .github/workflows/.pr-check.yml | 14 +++++++ .github/workflows/code-quality.yml | 43 ---------------------- .github/workflows/code-tests.yml | 38 ------------------- .github/workflows/dast.yml | 24 ------------ .github/workflows/dependency-scan.yml | 47 ------------------------ .github/workflows/deploy.yml | 28 -------------- .github/workflows/devsecops.yml | 53 --------------------------- .github/workflows/docker-push.yml | 31 ---------------- .github/workflows/docker-scans.yml | 44 ---------------------- .github/workflows/matrix.yml | 33 ----------------- .github/workflows/secret-scanning.yml | 20 ---------- .github/workflows/sonar-scan.yml | 19 ---------- 12 files changed, 14 insertions(+), 380 deletions(-) create mode 100644 .github/workflows/.pr-check.yml delete mode 100644 .github/workflows/code-quality.yml delete mode 100644 .github/workflows/code-tests.yml delete mode 100644 .github/workflows/dast.yml delete mode 100644 .github/workflows/dependency-scan.yml delete mode 100644 .github/workflows/deploy.yml delete mode 100644 .github/workflows/devsecops.yml delete mode 100644 .github/workflows/docker-push.yml delete mode 100644 .github/workflows/docker-scans.yml delete mode 100644 .github/workflows/matrix.yml delete mode 100644 .github/workflows/secret-scanning.yml delete mode 100644 .github/workflows/sonar-scan.yml diff --git a/.github/workflows/.pr-check.yml b/.github/workflows/.pr-check.yml new file mode 100644 index 00000000..d4344d7d --- /dev/null +++ b/.github/workflows/.pr-check.yml @@ -0,0 +1,14 @@ +name: PR Check + +on: + pull_request: + branches: [master] + +jobs: + check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Print PR branch + run: echo "PR check running for branch: ${{ github.head_ref }}" + diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml deleted file mode 100644 index e8e52f91..00000000 --- a/.github/workflows/code-quality.yml +++ /dev/null @@ -1,43 +0,0 @@ -# Goal - I have to do SAST for my Code - -name: Code Quality - -on: - workflow_call: # you can call this workflow before/after any other workflow - -jobs: - sast: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Setup NodeJs - uses: actions/setup-node@v6 - with: - node-version: '20' - cache: npm - cache-dependency-path: frontend/package-lock.json - - - name: Install npm Packages - run: npm install --legacy-peer-deps - working-directory: frontend - - - name: Run Linter - run: npm run lint - working-directory: frontend - - - name: Setup Go - uses: actions/setup-go@v6 - with: - go-version: '1.23' - go-version-file: 'go.mod' - cache-dependency-path: go.sum - - - name: Run Go Formatter - run: go fmt - working-directory: backend - - - name: Run Go Vet - run: go vet - working-directory: backend \ No newline at end of file diff --git a/.github/workflows/code-tests.yml b/.github/workflows/code-tests.yml deleted file mode 100644 index bd297060..00000000 --- a/.github/workflows/code-tests.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: Code Tests - -on: - workflow_call: - -jobs: - test: - # Github runner - runs-on: ubuntu-latest - steps: - - name: Checkout Code - uses: actions/checkout@v7 - - - name: Setup Go - uses: actions/setup-go@v6 - with: - go-version: '1.23' - go-version-file: 'go.mod' - cache-dependency-path: go.sum - - - name: Setup NodeJs - uses: actions/setup-node@v6 - with: - node-version: '20' - cache: npm - cache-dependency-path: frontend/package.json - - - name: Install Dependencies - run: npm install --legacy-peer-deps - working-directory: frontend - - - name: Run Tests - run: npm run test - working-directory: frontend - - - name: Run Tests - run: go test - working-directory: backend \ No newline at end of file diff --git a/.github/workflows/dast.yml b/.github/workflows/dast.yml deleted file mode 100644 index c9755909..00000000 --- a/.github/workflows/dast.yml +++ /dev/null @@ -1,24 +0,0 @@ -# Goal - To ensure my running application is free from OWASP top 10 security issues -name: OWASP ZAP DAST Scan - -on: - workflow_call: - -jobs: - scan: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Wait for services to be healthy - run: | - timeout 60s sh -c 'until curl -s http://${{ secrets.EC2_HOST }}:8080 > /dev/null; do sleep 2; done' - - - name: OWASP ZAP Baseline Scan - uses: zaproxy/action-baseline@v0.14.0 - with: - token: ${{ secrets.GITHUB_TOKEN }} - target: 'http://${{ secrets.EC2_HOST }}:8080' - fail_action: false - allow_issue_writing: false \ No newline at end of file diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml deleted file mode 100644 index 578228e6..00000000 --- a/.github/workflows/dependency-scan.yml +++ /dev/null @@ -1,47 +0,0 @@ -# Goal - I have to ensure the packages & dependencies have been audited for Security - -name: Dependecy scan - -on: - workflow_call: - -jobs: - dependency-scan: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Setup Go - uses: actions/setup-go@v6 - with: - go-version: 1.22 - go-version-file: 'go.mod' - cache-dependency-path: go.sum - - - name: Install Govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 - - - name: GoVulncheck - continue-on-error: true - run: govulncheck ./... > govulncheck-report.txt - working-directory: backend - - - name: Setup Node - uses: actions/setup-node@v6 - with: - node-version: '20' - cache: npm - cache-dependency-path: frontend/package-lock.json - - - name: Run Dependency Scan for Node - run: npm audit - working-directory: frontend - - - name: Upload Report to Artifacts - if: always() # Ensures report uploads even if tests fail - uses: actions/upload-artifact@v4 - with: - name: dependency-scan-report - path: reports/dependency-report.txt - retention-days: 5 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml deleted file mode 100644 index 622de0b3..00000000 --- a/.github/workflows/deploy.yml +++ /dev/null @@ -1,28 +0,0 @@ -# Goal: To deploy the built images from CI Steps once the CI Worklow is Succeeded - -name: CD - -on: - workflow_call: - -jobs: - deploy: - - runs-on: self-hosted - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Copy Example Env to main env - run: cp .env.example .env - - - name: Docker Setup [Login] - uses: docker/login-action@v4 - with: - username: ${{ vars.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Deploy the containers with Docker Compose - run: | - docker compose pull - docker compose up -d diff --git a/.github/workflows/devsecops.yml b/.github/workflows/devsecops.yml deleted file mode 100644 index 15c4a12d..00000000 --- a/.github/workflows/devsecops.yml +++ /dev/null @@ -1,53 +0,0 @@ -# Goal - To Run End to End DevSecOps CI Pipeline - -name: DevSecOps - -on: - push: - branches: [master] - -jobs: - - ## ---- CI ---- - # Code Stage - code-quality: - uses: ./.github/workflows/code-quality.yml - - # Secret Scanning - secret-scanning: - uses: ./.github/workflows/secret-scanning.yml - - # Dependency Checks - dependency-checks: - uses: ./.github/workflows/dependency-scan.yml - - # Docker Checks - docker-checks: - uses: ./.github/workflows/docker-scans.yml - secrets: inherit - - # SonarQube - sonar-qube: - uses: ./.github/workflows/sonar-scan.yml - secrets: inherit - - # Code Tests - code-tests: - uses: ./.github/workflows/code-tests.yml - - # push-to-docker-hub: - docker-push: - uses: ./.github/workflows/docker-push.yml - needs: [code-quality,code-tests,sonar-qube,docker-checks,dependency-checks,secret-scanning] - secrets: inherit - - ## ---- CD ----- - deploy: - needs: [docker-push] - uses: ./.github/workflows/deploy.yml - secrets: inherit - - dast-scan: - needs: [deploy] - uses: ./.github/workflows/dast.yml - secrets: inherit \ No newline at end of file diff --git a/.github/workflows/docker-push.yml b/.github/workflows/docker-push.yml deleted file mode 100644 index c46f88fe..00000000 --- a/.github/workflows/docker-push.yml +++ /dev/null @@ -1,31 +0,0 @@ -# Goal Push the images to DockerHub -name: Docker Push - -on: - workflow_call: - -jobs: - frontend: - # Github runner - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - folders: ['backend','frontend'] - steps: - - name: Checkout Code - uses: actions/checkout@v7 - - - name: Docker Setup [Login] - uses: docker/login-action@v4 - with: - username: ${{ vars.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Docker Build and Push - uses: docker/build-push-action@v7 - with: - context: ./${{ matrix.folders}} - push: true - tags: ${{ vars.DOCKERHUB_USERNAME }}/devboard-${{ matrix.folders}}:latest - \ No newline at end of file diff --git a/.github/workflows/docker-scans.yml b/.github/workflows/docker-scans.yml deleted file mode 100644 index 5ad07018..00000000 --- a/.github/workflows/docker-scans.yml +++ /dev/null @@ -1,44 +0,0 @@ -# Goal - Ensure the docker files and Docker images are security Tested - -name: Docker Scan - -on: - workflow_call: - -jobs: - docker-file-lint-and-scan: - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - folders: ['backend','frontend'] - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: ${{ matrix.folders}} Dockerfile Lint - uses: hadolint/hadolint-action@v3.1.0 - with: - dockerfile: ${{ matrix.folders}}/Dockerfile - - - name: Docker Setup [Login] - uses: docker/login-action@v4 - with: - username: ${{ vars.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - - name: Docker Build ${{ matrix.folders}} - run: docker build -t ${{ vars.DOCKERHUB_USERNAME }}/devboard-${{ matrix.folders }}:latest . - working-directory: ${{ matrix.folders}} - - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@v0.36.0 - continue-on-error: true - with: - image-ref: ${{ vars.DOCKERHUB_USERNAME }}/devboard-${{ matrix.folders }}:latest - format: 'table' - exit-code: '1' - ignore-unfixed: true - vuln-type: 'os,library' - severity: 'CRITICAL' - diff --git a/.github/workflows/matrix.yml b/.github/workflows/matrix.yml deleted file mode 100644 index 84a161ca..00000000 --- a/.github/workflows/matrix.yml +++ /dev/null @@ -1,33 +0,0 @@ -# Goal To install multiple versions of Go and do linting for multiple versions -name: Go Linter - -on: - workflow_dispatch: - -jobs: - code-format: - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - go: ['1.22','1.23','1.24'] - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: Setup Go - uses: actions/setup-go@v6 - with: - go-version: ${{ matrix.go }} - go-version-file: 'go.mod' - cache-dependency-path: go.sum - - - name: Run Go Formatter - run: go fmt - working-directory: backend - - - name: Run Go Vet - run: go vet - working-directory: backend - - \ No newline at end of file diff --git a/.github/workflows/secret-scanning.yml b/.github/workflows/secret-scanning.yml deleted file mode 100644 index 9a749796..00000000 --- a/.github/workflows/secret-scanning.yml +++ /dev/null @@ -1,20 +0,0 @@ -# Goal - To ensure no secrets have been leaked in the code - -name: Secrets Scanning - -on: - workflow_call: - -jobs: - scan-secrets: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - with: - fetch-depth: 0 - - - name: GitLeaks Scanner - uses: gitleaks/gitleaks-action@v3 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml deleted file mode 100644 index e15dadf3..00000000 --- a/.github/workflows/sonar-scan.yml +++ /dev/null @@ -1,19 +0,0 @@ -# Goal - to check whether the application code coverage doesn't have security threats/issues - -name: Sonar Qube Scan - -on: - workflow_call: - -jobs: - sonar-scanner: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v7 - - - name: SonarQube Scan - uses: SonarSource/sonarqube-scan-action@v8.2.0 - env: - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} \ No newline at end of file From dce531532b95df099dfddd3b58604a8b7c5dc15e Mon Sep 17 00:00:00 2001 From: Ameerul Mujahidin Date: Mon, 6 Jul 2026 18:28:10 +0400 Subject: [PATCH 4/4] Rename pr-check.yml workflow file --- .github/workflows/{.pr-check.yml => pr-check.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{.pr-check.yml => pr-check.yml} (100%) diff --git a/.github/workflows/.pr-check.yml b/.github/workflows/pr-check.yml similarity index 100% rename from .github/workflows/.pr-check.yml rename to .github/workflows/pr-check.yml