A complete CI/CD pipeline with security gates and day-one observability — build, SAST, container security scan, deploy to Kubernetes, Prometheus + Grafana monitoring.
Checkout → Build → SAST (SonarQube) → Docker Build → Trivy Scan → Push → Deploy (K8s) → Smoke Test
Security gates are hard failures — CRITICAL CVEs and SonarQube quality gate failures block the pipeline.
# Start SonarQube + supporting infra
docker compose -f docker-compose.infra.yml up -d
# Configure Jenkins with the Jenkinsfile
# Point it at this repoJenkins · SonarQube · Trivy · Docker · Kubernetes · Prometheus · Grafana
| Metric | Value |
|---|---|
| Pipeline stages | 8 |
| Security gates | SonarQube + Trivy |
| CRITICAL CVE policy | Hard fail |
| Commit to monitored deploy | < 12 minutes |