SIT753 – DevSecOps CI/CD Pipeline

This repository contains the Node.js Goof demo app integrated with a Jenkins pipeline for SIT753 Task 8.1C / 8.2C.
It demonstrates GitHub–Jenkins integration, DevSecOps basics, vulnerability scanning, and email notifications.

---

Features

• GitHub → Jenkins webhook integration (auto builds on commit)
• Dependency installation (npm install)
• Automated test execution (npm test)
• Coverage report generation (npm run coverage)
• Vulnerability scanning (npm audit, snyk test)
• Email notifications with logs attached

---

Pipeline Stages

1. Checkout – Pulls latest code from GitHub
2. Install Dependencies – Installs required npm packages
3. Run Tests – Runs unit tests (continues even if they fail)
4. Generate Coverage Report – Generates code coverage results
5. NPM Audit (Security Scan) – Runs security scan for vulnerabilities
6. Email Notification – Sends build status and logs via email

---

Setup

Clone the Repo

git clone https://github.com/Arnold-Seb/8.2CDevSecOps.git

Install Dependencies

npm install

Jenkins Configuration

• Install required plugins: Pipeline Git Email Extension NodeJS
• Configure SMTP for email notifications
• Add Snyk API Token to Jenkins credentials (ID: snyk)
• Configure GitHub webhook for automatic builds
• Run the Pipeline

##Run the Pipeline .Commit & push → Jenkins auto-triggers → pipeline runs → email notification sent

Deliverables

• Part 1 – Task 1 (GitHub Integration) Demo video (30–45s): commit triggers Jenkins build, show console output

• Part 1 – Task 2 (DevSecOps Scan) Demo video (30–45s): scroll through Jenkins console output showing vulnerability scan

• Part 2 – Task 2 (Email Notification) Demo video (~1 min): show Jenkinsfile, run pipeline, show received email with log attachment

Email Notifications

• Emails include: Stage name, SUCCESS / FAILURE status, Build number + Jenkins job link, Console log attachment

DevSecOps

• Snyk integration via Jenkins credentials (ID: snyk)
• Reports vulnerabilities but does not fail the build (|| true used)
• Results appear in Jenkins console output + email

Coverage Report

• Generated with: npm run coverage