After containerizing the Task Management API, the next stage of my DevOps capstone was automating the application build and delivery process.

The goal was to reduce manual work, introduce automated testing, build Docker images, and scan images for vulnerabilities before publishing them.

For this stage, I worked with GitHub Actions, Docker Hub, and Trivy.

  1. Understanding the CI/CD Architecture

The pipeline was designed to start whenever changes were pushed to the GitHub repository.

Architecture components

  • GitHub: Hosts the source code.
  • GitHub Actions: Automates the pipeline.
  • Pytest: Runs automated application tests.
  • Docker: Builds the application image.
  • Trivy:Scans the image for vulnerabilities.
  • Docker Hub:Stores the published image.
  • GitHub Secrets: Stores sensitive credentials.
  1. Preparing the GitHub Repository

I prepared the GitHub Actions workflow directory:

mkdir -p .github/workflows

The workflow configuration was placed inside:

.github/workflows/ci-cd.yml

  1. Configuring the GitHub Actions Workflow

I configured the workflow to automate the main CI/CD stages.

The pipeline was designed to:

  1. Check out the source code.
  2. Set up the required Python environment.
  3. Install project dependencies.
  4. Run automated tests.
  5. Build the Docker image.
  6. Scan the image using Trivy.
  7. Authenticate with Docker Hub.
  8. Publish the image.

This helped establish a repeatable process whenever new code was pushed.

  1. Configuring Automated Testing

I added an automated testing stage using Pytest.

The purpose was to ensure that application tests ran before the Docker image was published.

One important detail was using:

python -m pytest -q

This ensured that Python executed Pytest through the active interpreter and resolved the application module correctly in the project environment.

  1. Building the Docker Image

After the test stage, the workflow built the Docker image using the application's Dockerfile.

This ensured that the image could be recreated automatically from the source code.

  1. Integrating Trivy

I integrated Trivy into the workflow to scan the Docker image for known vulnerabilities.

The purpose of this stage was to identify potential security issues in the image before publishing it.

Image scanning is an important part of DevSecOps because an image that builds successfully is not necessarily a secure image.

  1. Managing Credentials with GitHub Secrets

The pipeline needed credentials to authenticate with Docker Hub.

Rather than placing credentials directly inside the workflow file, I configured GitHub Secrets.

The credentials were then referenced by the workflow during authentication.

This helped prevent sensitive information from being committed to the repository.

  1. Publishing the Docker Image

After the build and security stages, the workflow was configured to publish the image to Docker Hub.

This made the container image available for later deployment to Kubernetes.

  1. Understanding the Pipeline Flow

The most important lesson from this stage was understanding the dependency between pipeline stages.

Testing should happen before publishing. The image should be built before it can be scanned, and authentication is required before pushing it to a private registry.

This creates a more controlled application delivery process.