← BACK TO PROJECT
DEVSECOPS
DOCS: PIPELINEFORGE

ENGINEERING
DOCS

01. Image Optimization

Multi-stage distroless builds to achieve 99.3% reduction (1.1GB → 8MB).

Dockerfilebuild-stage > final-stage
# Stage 1: Build
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /pipelineforge ./cmd/server
# Stage 2: Distroless Final
FROM gcr.io/distroless/static-debian11
COPY --from=builder /pipelineforge /
USER nonroot:nonroot
EXPOSE 8080
ENTRYPOINT ["/pipelineforge"]

02. Security Gates (CI)

GitHub Actions pipeline integrating Trivy for severe vulnerability scanning before push.

.github/workflows/ci.ymlbuild-and-scan job
name: DevSecOps Pipeline
on: [push, pull_request]

jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - name: Build image
        run: docker build -t rounakneema/pipelineforge:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'rounakneema/pipelineforge:${{ github.sha }}'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
TERMINAL TRACE // TRIVY SCAN
$ trivy image rounakneema/pipelineforge:a1b2c3d
2026-09-25T10:12:33.123Z  INFO  Vulnerability scanning enabled
2026-09-25T10:12:35.456Z  INFO  Detected OS: debian
2026-09-25T10:12:35.456Z  INFO  Detecting vulnerabilities...

rounakneema/pipelineforge:a1b2c3d (debian 11.7)
================================================
Total: 0 (HIGH: 0, CRITICAL: 0)

[SUCCESS] No critical or high vulnerabilities found.

03. GitOps & K8s Definitions

Zero-downtime rolling updates and Horizontal Pod Autoscaling.

deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pipelineforge
spec:
  replicas: 3
  selector:
    matchLabels:
      app: pipelineforge
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    metadata:
      labels:
        app: pipelineforge
    spec:
      containers:
        - name: app
          image: rounakneema/pipelineforge:latest
          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"
            limits:
              cpu: "250m"
              memory: "256Mi"
          readinessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 5
hpa.yaml
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: pipelineforge-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: pipelineforge
  minReplicas: 3
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80

04. Load Validation

k6 load testing trace confirming SLA under 500 VUs.

$ k6 run loadtest.js --vus 500 --duration 1m

          /\      |‾‾| /‾‾/   /‾‾/   
     /\  /  \     |  |/  /   /  /    
    /  \/    \    |     (   /   ‾‾\  
   /          \   |  |\  \ |  (‾)  | 
  / __________ \  |__| \__\ \_____/ .io

  execution: local
     script: loadtest.js
     output: -

  scenarios: (100.00%) 1 scenario, 500 max VUs, 1m30s max duration (incl. graceful stop):
           * default: 500 looping VUs for 1m0s (gracefulStop: 30s)

     ✓ status is 200
     ✓ latency is < 50ms

     checks.........................: 100.00% ✓ 145020      ✗ 0    
     data_received..................: 21 MB   340 kB/s
     data_sent......................: 12 MB   190 kB/s
     http_req_duration..............: avg=3.2ms    min=1.1ms   med=2.8ms   max=45.2ms p(90)=4.8ms   p(95)=5.9ms 
     http_req_failed................: 0.00%   ✓ 0           ✗ 145020
     iterations.....................: 145020  2375.12/s
     vus............................: 500     min=500       max=500