Self-directed
filmapp — DevSecOps Pipeline
A React and TypeScript application whose real artefact is its pipeline: every security gate runs before an image reaches the registry.
- Discipline
- DevSecOps
- Gates
- Quality · Dependency · Image
- Enforcement
- Blocking
- React
- TypeScript
- Jenkins
- SonarQube
- OWASP Dependency-Check
- Trivy
- Docker
- Kubernetes
Sheet B
Specification
What it is
A streaming-app demo built with React and TypeScript, wrapped in a Jenkins pipeline that treats security checks as build-blocking conditions rather than advisory reports.
The gates
SonarQube runs a quality gate over the source. OWASP Dependency-Check audits the dependency tree against known advisories. Trivy scans the filesystem and then the built image.
All three run before the image is pushed (see note 2). Any of them can fail the build, and a failed build produces no artefact (see note 1).
Rollout
A passing build produces a tagged image and a Kubernetes rollout. The deployment step is intentionally unremarkable — by the time it runs, the interesting decisions have already been made and enforced upstream.
Sheet C
Notes
3 items
Sheet D
Revisions
What I would change
- 01Add SBOM generation and retention, so what shipped can be re-examined when a CVE lands after release rather than only before it.
- 02Pin base images by digest instead of tag. A moving tag quietly undermines the guarantee the scan stage exists to provide.