created terraform

.github/workflows/code-quality-check.yml

@@ -0,0 +1,91 @@
+name: Go Code Quality
+
+on:
+  workflow_call:
+
+jobs:
+  code-quality:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+
+      matrix:
+        go-version: ["1.21", "1.22", "1.23"]
+
+    steps:
+      # ==============================
+      # Checkout Repository
+      # ==============================
+
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      # ==============================
+      # Setup Go Environment
+      # ==============================
+
+      - name: Setup Go ${{ matrix.go-version }}
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      # ==============================
+      # Verify Go Installation
+      # ==============================
+
+      - name: Verify Go Version
+        run: go version
+
+      # ==============================
+      # Verify go.mod Exists
+      # ==============================
+
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: backend/go.mod
+          cache: true
+
+      # ==============================
+      # Install Dependencies
+      # ==============================
+
+      - name: Install Dependencies
+        run: |
+          go mod tidy
+          go mod download
+
+      # ==============================
+      # Format Check
+      # ==============================
+
+      - name: Run gofmt
+        run: |
+          test -z "$(gofmt -l .)"
+
+      # ==============================
+      # Static Analysis
+      # ==============================
+
+      - name: Run go vet
+        run: |
+          go vet ./...
+
+      # ==============================
+      # GolangCI Lint
+      # ==============================
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: latest
+
+      # ==============================
+      # Run Unit Tests
+      # ==============================
+
+      - name: Run Tests
+        run: |
+          go test ./... -v

.github/workflows/dependency-scan.yml

@@ -0,0 +1,97 @@
+name: Dependency Vulnerability Scan
+
+on:
+  workflow_call:
+
+jobs:
+  dependency-scan:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+
+      matrix:
+        go-version: ["1.21", "1.22", "1.23"]
+
+    steps:
+
+      # ==============================
+      # Checkout Repository
+      # ==============================
+
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      # ==============================
+      # Setup Go Environment
+      # ==============================
+
+      - name: Setup Go ${{ matrix.go-version }}
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      # ==============================
+      # Verify Go Installation
+      # ==============================
+
+      - name: Verify Go Version
+        run: go version
+
+      # ==============================
+      # Verify go.mod Exists
+      # ==============================
+
+      - name: Check go.mod
+        run: |
+          if [ ! -f go.mod ]; then
+            echo "go.mod file not found!"
+            exit 1
+          fi
+
+      # ==============================
+      # Install Dependencies
+      # ==============================
+
+      - name: Install Dependencies
+        run: |
+          go mod tidy
+          go mod download
+
+      # ==============================
+      # Run govulncheck
+      # ==============================
+
+      - name: Install govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run Dependency Vulnerability Scan
+        run: |
+          govulncheck ./...
+
+      # ==============================
+      # Run Trivy Filesystem Scan
+      # ==============================
+
+      - name: Run Trivy Filesystem Scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          exit-code: 1
+          ignore-unfixed: true
+          severity: CRITICAL,HIGH
+
+      # ==============================
+      # Upload Trivy Report (Optional)
+      # ==============================
+
+      - name: Upload Trivy Report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-dependency-report
+          path: trivy-results.sarif
+          if-no-files-found: ignore

.github/workflows/deploy-to-server.yml

@@ -0,0 +1,52 @@
+# this will deploy the safe / secure / tested app to Prod server
+name: Deploy To Server
+
+on: 
+    workflow_call:
+
+
+jobs:
+    deploy:
+        runs-on: ubuntu-latest
+        env:
+            DOCKERHUB_USER: ${{ vars.DOCKERHUB_USER }}
+            DOCKER_TAG: ${{ github.sha }}
+
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: SSH to Prod server & create app folder
+              uses: appleboy/ssh-action@v1.0.3
+              with:
+                host: ${{ secrets.EC2_SSH_HOST }}
+                username: ${{ secrets.EC2_SSH_USER }}
+                key: ${{ secrets.EC2_SSH_PRIVATE_KEY }}
+                script: |
+                 echo "Installing required packages & folders"
+                 sudo apt-get update && sudo apt-get install docker.io docker-compose-v2 -y
+                 sudo usermod -aG docker $USER
+                 mkdir -p devops
+
+            - name: Copy the docker-compose file
+              uses: appleboy/scp-action@v1
+              with:
+                host: ${{ secrets.EC2_SSH_HOST }}
+                username: ${{ secrets.EC2_SSH_USER }}
+                key: ${{ secrets.EC2_SSH_PRIVATE_KEY }}
+                source: docker-compose.yml
+                target: ~/devops
+
+            - name: SSH to Prod server & run the app
+              uses: appleboy/ssh-action@v1.0.3
+              with:
+                host: ${{ secrets.EC2_SSH_HOST }}
+                username: ${{ secrets.EC2_SSH_USER }}
+                key: ${{ secrets.EC2_SSH_PRIVATE_KEY }}
+                script: |
+                 echo "Running App"
+
+                 export DOCKERHUB_USER=${{ vars.DOCKERHUB_USER }}
+                 export DOCKER_TAG=${{ github.sha }}
+                 echo ${{ secrets.DOCKERHUB_TOKEN }} | docker login --username ${{ vars.DOCKERHUB_USER }} --password-stdin
+                 cd ~/devops && docker compose down && docker compose up -d --build --force-recreate --pull always

.github/workflows/devsecops-pipeline.yml

@@ -0,0 +1,46 @@
+name: DevSecOps End To End Pipeline
+
+on: 
+    push:
+        branches: 
+          - main
+          - feat/dev
+
+jobs:
+    # CI (Continous Integration with Security Scanning)
+    code-quality:
+        uses: ./.github/workflows/code-quality-check.yml
+
+    secrets-scan:
+        uses: ./.github/workflows/secret-scan.yml
+        secrets: inherit
+
+    dependency-scan:
+        uses: ./.github/workflows/dependency-scan.yml
+
+    docker-scan:
+        uses: ./.github/workflows/docker-lint.yml
+
+    # Build once the security scans and tests are complete
+    build:
+        needs: [code-quality, secrets-scan, dependency-scan, docker-scan]
+        uses: ./.github/workflows/docker-build-push.yml
+        secrets: inherit
+
+    tests:
+        uses: ./.github/workflows/tests.yml
+
+    # Image scan 
+    trivy:
+        needs: [build]
+        uses: ./.github/workflows/image-scan.yml
+        secrets: inherit
+
+
+    # CD : Deploy to Production 
+    deploy:
+        needs: [trivy]
+        uses: ./.github/workflows/deploy-to-server.yml
+        secrets: inherit
+
+

.github/workflows/docker-build-push.yml

@@ -0,0 +1,29 @@
+name: Docker Build & Push
+
+on: 
+    workflow_call:
+
+jobs:
+    build-and-push:
+        runs-on: ubuntu-latest
+
+        steps:
+
+            - name: Code Checkout
+              uses: actions/checkout@v4
+
+            - name: Login to Docker Hub
+              uses: docker/login-action@v3
+              with:
+                username: ${{ vars.DOCKERHUB_USER }}
+                password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+            - name: Build & Push to Docker Hub
+              uses: docker/build-push-action@v6
+              with:
+                context: .
+                push: true
+                tags: |
+                    ${{ vars.DOCKERHUB_USER }}/github-actions-app:${{ github.ref_name }}
+                    ${{ vars.DOCKERHUB_USER }}/github-actions-app:latest
+                    ${{ vars.DOCKERHUB_USER }}/github-actions-app:${{ github.sha}}

.github/workflows/docker-lint.yml

@@ -0,0 +1,25 @@
+name: Docker Lint
+
+on:
+  workflow_call:
+  pull_request:
+
+jobs:
+  docker-lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Lint Backend Dockerfile
+        run: |
+          docker run --rm \
+            -v ${{ github.workspace }}/backend/Dockerfile:/Dockerfile \
+            hadolint/hadolint hadolint --ignore DL3018 /Dockerfile      
+
+      - name: Lint Frontend Dockerfile
+        run: |
+          docker run --rm \
+            -v ${{ github.workspace }}/frontend/Dockerfile:/Dockerfile \
+            hadolint/hadolint hadolint --ignore DL3018 /Dockerfile

.github/workflows/image-scan.yml

@@ -0,0 +1,47 @@
+name: Image scanner
+
+on:
+  workflow_call: 
+    secrets:
+      DOCKER_USERNAME:
+        required: true
+      DOCKER_PASSWORD:
+        required: true
+
+jobs:
+  image-scanner:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          # FIXED: Swapped out mismatched names to match the inputs declared above exactly
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      # Note: Removed the manual Trivy installation apt steps since the action below handles it natively
+
+      - name: Scan Backend Image
+        uses: aquasecurity/trivy-action@v0.36.0 # Fixed the version prefix to prevent resolution errors
+        with:
+          image-ref: ${{ secrets.DOCKER_USERNAME }}/skillpulse-backend:latest
+          format: 'table'
+          exit-code: 1
+          severity: 'CRITICAL,HIGH'
+          trivyignores: .trivyignore
+
+      - name: Scan Frontend Image
+        uses: aquasecurity/trivy-action@v0.36.0 # Fixed all version prefix to prevent resolution errors
+        with:
+          image-ref: ${{ secrets.DOCKER_USERNAME }}/skillpulse-frontend:latest
+          format: 'table'
+          exit-code: 1
+          severity: 'CRITICAL,HIGH'
+
+      - name: Logout from Docker Hub
+        if: always()
+        run: docker logout