created terraform

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI
+name: CI Pipeline
 
 on:
   push:
@@ -7,35 +7,99 @@ on:
       - 'k8s/**'
       - 'docs/**'
       - '**/*.md'
+      - terraform/**
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  REGISTRY: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION }}.amazonaws.com
 
 jobs:
-  build-and-push:
+  security:
+    name: Security Gate
     runs-on: ubuntu-latest
+
     steps:
       - uses: actions/checkout@v4
 
-      - uses: docker/setup-buildx-action@v4
+      - name: Gitleaks
+        uses: gitleaks/gitleaks-action@v2
 
-      - uses: docker/login-action@v4
-        if: ${{ vars.DEPLOY_ENABLED == 'true' }}
+      - name: Hadolint Backend
+        uses: hadolint/hadolint-action@v3.1.0
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          dockerfile: backend/Dockerfile
 
-      - name: Build and push backend
-        uses: docker/build-push-action@v7
+      - name: Hadolint Frontend
+        uses: hadolint/hadolint-action@v3.1.0
         with:
-          context: ./backend
-          push: ${{ vars.DEPLOY_ENABLED == 'true' }}
-          tags: |
-            ${{ secrets.DOCKERHUB_USERNAME != '' && format('{0}/skillpulse-backend:latest', secrets.DOCKERHUB_USERNAME) || 'skillpulse-backend:latest' }}
-            ${{ secrets.DOCKERHUB_USERNAME != '' && format('{0}/skillpulse-backend:{1}', secrets.DOCKERHUB_USERNAME, github.sha) || format('skillpulse-backend:{0}', github.sha) }}
+          dockerfile: frontend/Dockerfile
 
-      - name: Build and push frontend
-        uses: docker/build-push-action@v7
+      - name: Setup Go
+        uses: actions/setup-go@v5
         with:
-          context: ./frontend
-          push: ${{ vars.DEPLOY_ENABLED == 'true' }}
+          go-version-file: backend/go.mod
+          cache: true
+
+      - name: Run govulncheck
+        run: |
+          cd backend
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+  build-scan-push:
+    name: Build, Scan & Push
+    runs-on: ubuntu-latest
+    needs: security
+
+    strategy:
+      fail-fast: false
+      matrix:
+        service: [backend, frontend]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Set TAG
+        run: echo "TAG=${GITHUB_SHA:0:7}" >> $GITHUB_ENV
+
+      - name: Configure AWS (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Login to ECR
+        uses: aws-actions/amazon-ecr-login@v2
+
+      - name: Build image
+        uses: docker/build-push-action@v6
+        with:
+          context: ./${{ matrix.service }}
+          load: true
+          push: false
           tags: |
-            ${{ secrets.DOCKERHUB_USERNAME != '' && format('{0}/skillpulse-frontend:latest', secrets.DOCKERHUB_USERNAME) || 'skillpulse-frontend:latest' }}
-            ${{ secrets.DOCKERHUB_USERNAME != '' && format('{0}/skillpulse-frontend:{1}', secrets.DOCKERHUB_USERNAME, github.sha) || format('skillpulse-frontend:{0}', github.sha) }}
+            ${{ env.REGISTRY }}/skillpulse-${{ matrix.service }}:${{ env.TAG }}
+            ${{ env.REGISTRY }}/skillpulse-${{ matrix.service }}:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Trivy Scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ env.REGISTRY }}/skillpulse-${{ matrix.service }}:${{ env.TAG }}
+          format: table
+          severity: CRITICAL,HIGH
+          exit-code: 1
+          ignore-unfixed: true
+
+      - name: Push Images
+        run: |
+          IMAGE=$REGISTRY/skillpulse-${{ matrix.service }}
+          docker push $IMAGE:$TAG
+          docker push $IMAGE:latest

.github/workflows/code-quality-check.yml

@@ -0,0 +1,59 @@
+name: Go lint
+
+on: 
+    push:
+        branches: [main,feat/dev]
+    workflow_dispatch:
+    #pull_request:
+    #branches:[feat/dev]
+     # 
+jobs:
+    validate:
+        runs-on: ubuntu-latest
+        strategy:
+            fail-fast: false
+            matrix:
+                go-version: ["1.26"]
+        defaults:
+            run:
+                working-directory: ./backend
+        steps:
+            - name: checkout code
+              uses: actions/checkout@v4
+
+            - name: setup Go ${{ matrix.go-version}}
+              uses: actions/setup-go@v5
+              with:
+                go-version: ${{ matrix.go-version}}
+                cache: true
+                cache-dependency-path: backend/go.sum
+
+            - name: verify dependencies
+              run: go mod verify
+
+            - name: download dependencies
+              run: go mod download
+
+            - name: run go fmt check
+              run: |
+                if [ -n "$(gofmt -l .)" ]; then
+                  echo "Go files must be formatted with gofmt"
+                  gofmt -l .
+                  exit 1
+                fi
+
+            - name: run go vet
+              run: go vet ./...
+
+            - name: run staticcheck
+              run: |
+                go install honnef.co/go/tools/cmd/staticcheck@latest
+                staticcheck ./...
+
+            - name: run golangci-lint
+              # Skip golangci-lint for Go 1.26 due to compatibility issues
+              if: matrix.go-version != '1.26'
+              uses: golangci/golangci-lint-action@v4
+              with:
+                version: latest
+                working-directory: backend

.github/workflows/dependency-scan.yml

@@ -0,0 +1,97 @@
+name: Dependency Vulnerability Scan
+
+on:
+  workflow_call:
+
+jobs:
+  dependency-scan:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+
+      matrix:
+        go-version: ["1.21", "1.22", "1.23"]
+
+    steps:
+
+      # ==============================
+      # Checkout Repository
+      # ==============================
+
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      # ==============================
+      # Setup Go Environment
+      # ==============================
+
+      - name: Setup Go ${{ matrix.go-version }}
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      # ==============================
+      # Verify Go Installation
+      # ==============================
+
+      - name: Verify Go Version
+        run: go version
+
+      # ==============================
+      # Verify go.mod Exists
+      # ==============================
+
+      - name: Check go.mod
+        run: |
+          if [ ! -f go.mod ]; then
+            echo "go.mod file not found!"
+            exit 1
+          fi
+
+      # ==============================
+      # Install Dependencies
+      # ==============================
+
+      - name: Install Dependencies
+        run: |
+          go mod tidy
+          go mod download
+
+      # ==============================
+      # Run govulncheck
+      # ==============================
+
+      - name: Install govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run Dependency Vulnerability Scan
+        run: |
+          govulncheck ./...
+
+      # ==============================
+      # Run Trivy Filesystem Scan
+      # ==============================
+
+      - name: Run Trivy Filesystem Scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          exit-code: 1
+          ignore-unfixed: true
+          severity: CRITICAL,HIGH
+
+      # ==============================
+      # Upload Trivy Report (Optional)
+      # ==============================
+
+      - name: Upload Trivy Report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-dependency-report
+          path: trivy-results.sarif
+          if-no-files-found: ignore

.github/workflows/deploy-to-server.yml

@@ -0,0 +1,52 @@
+# this will deploy the safe / secure / tested app to Prod server
+name: Deploy To Server
+
+on: 
+    workflow_call:
+
+
+jobs:
+    deploy:
+        runs-on: ubuntu-latest
+        env:
+            DOCKERHUB_USER: ${{ vars.DOCKERHUB_USER }}
+            DOCKER_TAG: ${{ github.sha }}
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: SSH to Prod server & create app folder
+              uses: appleboy/ssh-action@v1.0.3
+              with:
+                host: ${{ secrets.EC2_SSH_HOST }}
+                username: ${{ secrets.EC2_SSH_USER }}
+                key: ${{ secrets.EC2_SSH_PRIVATE_KEY }}
+                script: |
+                 echo "Installing required packages & folders"
+                 sudo apt-get update && sudo apt-get install docker.io docker-compose-v2 -y
+                 sudo usermod -aG docker $USER
+                 mkdir -p devops
+
+            - name: Copy the docker-compose file
+              uses: appleboy/scp-action@v1
+              with:
+                host: ${{ secrets.EC2_SSH_HOST }}
+                username: ${{ secrets.EC2_SSH_USER }}
+                key: ${{ secrets.EC2_SSH_PRIVATE_KEY }}
+                source: docker-compose.yml
+                target: ~/devops
+
+            - name: SSH to Prod server & run the app
+              uses: appleboy/ssh-action@v1.0.3
+              with:
+                host: ${{ secrets.EC2_SSH_HOST }}
+                username: ${{ secrets.EC2_SSH_USER }}
+                key: ${{ secrets.EC2_SSH_PRIVATE_KEY }}
+                script: |
+                 echo "Running App"
+
+                 export DOCKERHUB_USER=${{ vars.DOCKERHUB_USER }}
+                 export DOCKER_TAG=${{ github.sha }}
+                 echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login --username ${{ vars.DOCKERHUB_USER }} --password-stdin
+                 cd ~/devops && docker compose down && docker compose up -d --build --force-recreate --pull always

.github/workflows/devsecops-pipeline.yml

@@ -0,0 +1,46 @@
+name: DevSecOps End To End Pipeline
+
+on: 
+    push:
+        branches: 
+          - main
+          - feat/dev
+
+jobs:
+    # CI (Continous Integration with Security Scanning)
+    code-quality:
+        uses: ./.github/workflows/code-quality-check.yml
+
+    secrets-scan:
+        uses: ./.github/workflows/secret-scan.yml
+        secrets: inherit
+
+    dependency-scan:
+        uses: ./.github/workflows/dependency-scan.yml
+
+    docker-scan:
+        uses: ./.github/workflows/docker-lint.yml
+
+    # Build once the security scans and tests are complete
+    build:
+        needs: [code-quality, secrets-scan, dependency-scan, docker-scan]
+        uses: ./.github/workflows/docker-build-push.yml
+        secrets: inherit
+
+    tests:
+        uses: ./.github/workflows/tests.yml
+
+    # Image scan 
+    trivy:
+        needs: [build]
+        uses: ./.github/workflows/image-scan.yml
+        secrets: inherit
+
+
+    # CD : Deploy to Production 
+    deploy:
+        needs: [trivy]
+        uses: ./.github/workflows/deploy-to-server.yml
+        secrets: inherit
+
+