h4kops/nodejs-devsecops repository overview

Node.js DevSecOps Pipeline Image

This Docker image contains a simple Express-based Node.js application used to demonstrate a complete DevSecOps CI/CD pipeline.

The image is automatically built and pushed through a GitHub Actions workflow that includes multiple security checks before deployment.

Pipeline Security Controls: • Code quality checks using ESLint • Static Application Security Testing (Semgrep) • Secrets detection with TruffleHog • Dependency vulnerability scanning using npm audit • Dockerfile security linting with Hadolint • Container image scanning with Trivy • SBOM generation for dependency traceability

Pipeline Flow: Code Push → CI Checks → Security Scans → Docker Build → Docker Hub Push → Image Scan → Deployment

This project demonstrates how security can be integrated directly into CI/CD pipelines following DevSecOps best practices.

GitHub Repository: https://github.com/cloud-with-preetham/nodejs-devsecops-pipeline⁠