🚀 DevSecOps CI/CD Pipeline Template

Reusable DevSecOps pipeline template with GitHub Actions, automated security scanning, testing, and multi-platform deployment

🎯 Overview

This repository provides a complete DevSecOps CI/CD pipeline template that can be easily integrated into any JavaScript/Node.js project. The pipeline implements industry best practices for security, testing, and deployment automation.

🌟 Key Features

• 🛡️ Automated Security Auditing - Dependency scanning and vulnerability detection
• 🧪 Comprehensive Testing Pipeline - Unit, integration, and coverage testing
• 🏗️ Multi-stage Build Process - Optimized builds with artifact management
• 🚀 Multi-Platform Deployment - Vercel, GitHub Pages, and custom targets
• 📊 Performance Monitoring - Build metrics and deployment tracking
• 🔒 Security Headers - CSP, HSTS, and modern security implementations
• 🔄 Reusable Workflows - Easy integration into existing projects

🏗️ Pipeline Architecture

graph TD
    A[📥 Trigger: Push/PR] --> B[🔍 Security Audit]
    B --> C[🧹 Code Quality Check]
    C --> D[🧪 Run Tests]
    D --> E[📊 Coverage Report]
    E --> F[🏗️ Build Application]
    F --> G[📦 Create Artifacts]
    G --> H{Branch?}
    H -->|main| I[🚀 Production Deploy]
    H -->|PR| J[🔍 Preview Deploy]
    I --> K[📋 Notifications]
    J --> K

Loading

🚀 Quick Start

1. Copy Pipeline Files

Copy these files to your project:

# Create workflow directory
mkdir -p .github/workflows

# Copy main pipeline
curl -o .github/workflows/ci-cd.yml https://raw.githubusercontent.com/iabreuIjam99/devsecops-pipeline-template/main/.github/workflows/ci-cd.yml

# Copy deployment workflow (optional)
curl -o .github/workflows/deploy.yml https://raw.githubusercontent.com/iabreuIjam99/devsecops-pipeline-template/main/.github/workflows/deploy.yml

2. Configure for Your Project

Update the pipeline configuration in .github/workflows/ci-cd.yml:

env:
  NODE_VERSION: '18'  # Change to your Node.js version
  BUILD_COMMAND: 'npm run build'  # Your build command
  TEST_COMMAND: 'npm run test:run'  # Your test command

3. Setup Deployment (Optional)

For Vercel deployment, add these secrets to your GitHub repository:

• VERCEL_TOKEN - Your Vercel token
• VERCEL_ORG_ID - Your Vercel organization ID
• VERCEL_PROJECT_ID - Your Vercel project ID

4. Customize Security Configuration

Copy and customize the security configuration:

curl -o vercel.json https://raw.githubusercontent.com/iabreuIjam99/devsecops-pipeline-template/main/vercel.json

📋 Pipeline Stages

🔍 Security Stage

• npm audit: Dependency vulnerability scanning
• ESLint: Code quality and security linting
• Risk Assessment: Configurable security thresholds

🧪 Testing Stage

• Unit Tests: Component and function testing
• Integration Tests: End-to-end workflow testing
• Coverage Reports: Test coverage analysis with artifacts

🏗️ Build Stage

• Production Build: Optimized application building
• Asset Optimization: Image and bundle optimization
• Artifact Management: Build output preservation

🚀 Deployment Stage

• Preview Deployments: PR-based preview environments
• Production Deployment: Main branch automatic deployment
• Multi-Platform: Support for Vercel, GitHub Pages, AWS, etc.

🛠️ Supported Technologies

Frontend Frameworks

• ✅ React (Vite, CRA, Next.js)
• ✅ Vue.js (Vite, Nuxt.js)
• ✅ Angular
• ✅ Svelte/SvelteKit
• ✅ Static Sites (HTML/CSS/JS)

Testing Frameworks

• ✅ Vitest
• ✅ Jest
• ✅ Cypress
• ✅ Playwright
• ✅ Testing Library

Deployment Platforms

• ✅ Vercel
• ✅ GitHub Pages
• ✅ AWS S3/CloudFront
• ✅ Netlify
• ✅ Azure Static Web Apps

🔧 Configuration Options

Environment Variables

Variable	Description	Default	Required
NODE_VERSION	Node.js version	18	No
BUILD_COMMAND	Build command	npm run build	No
TEST_COMMAND	Test command	npm run test:run	No
AUDIT_LEVEL	Security audit level	moderate	No

Security Configuration

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {"key": "X-Content-Type-Options", "value": "nosniff"},
        {"key": "X-Frame-Options", "value": "DENY"},
        {"key": "Strict-Transport-Security", "value": "max-age=31536000"}
      ]
    }
  ]
}

📊 Pipeline Metrics & Monitoring

The pipeline provides comprehensive metrics:

• ⏱️ Build Duration: Average execution time tracking
• 📈 Test Coverage: Coverage percentage reporting
• 🔒 Security Score: Vulnerability assessment results
• 📦 Bundle Size: Asset size optimization tracking
• 🚀 Deployment Status: Success/failure rates

🎯 DevSecOps Best Practices

✅ Implemented Practices

1. Shift-Left Security

   • Early vulnerability detection
   • Automated security scanning
   • Security-first pipeline design

2. Test Automation

   • Multi-level testing strategy
   • Coverage requirements
   • Automated test execution

3. Infrastructure as Code

   • Version-controlled pipelines
   • Reproducible environments
   • Environment parity

4. Continuous Integration

   • Automated builds
   • Quality gates
   • Fast feedback loops

5. Continuous Deployment

   • Automated deployments
   • Preview environments
   • Rollback capabilities

🔗 Example Implementations

React + Vite Project

# Minimal configuration for React/Vite
env:
  NODE_VERSION: '18'
  BUILD_COMMAND: 'npm run build'
  TEST_COMMAND: 'npm run test:run'

Next.js Project

# Configuration for Next.js
env:
  NODE_VERSION: '18'
  BUILD_COMMAND: 'npm run build'
  TEST_COMMAND: 'npm run test'

Vue.js Project

# Configuration for Vue.js
env:
  NODE_VERSION: '18'
  BUILD_COMMAND: 'npm run build'
  TEST_COMMAND: 'npm run test:unit'

📚 Documentation

• Setup Guide - Detailed setup instructions
• Configuration Reference - All configuration options
• Deployment Guide - Platform-specific deployment guides
• Troubleshooting - Common issues and solutions
• Examples - Real-world implementation examples

🤝 Contributing

Contributions are welcome! Please read our Contributing Guide for details on:

• Code of Conduct
• Development Process
• Pull Request Process
• Issue Reporting

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

🌟 Real-World Usage

This pipeline is actively used in production by:

• DevSecOps Portfolio: Live Demo | Source
• Enterprise Projects: Multiple client implementations
• Open Source Projects: Community adoptions

📞 Support & Contact

• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Email: Contact Form

---

Created by: Isai Abreu | DevSecOps Engineer Jr
License: MIT | Version: 1.0.0

🚀 Ready to implement DevSecOps in your projects? Start with this template and customize for your needs!