How ahsanmustafa11-a/github-action-python-3tier works
This repository presents a GitHub Actions DevSecOps pipeline for building, scanning, publishing, deploying, and dynamically testing a three-tier library application. The README documents the pipeline stages and tools; workflow implementations were not sampled, so stage ordering follows that documentation rather than inspected workflow calls. The sampled runtime shows browser CRUD and dashboard requests through Nginx to Flask and MySQL. Deployment wiring and some tool integrations are documented but not verified in source.
Main entry points: lint.yml Code lint · frontend-lint.yml Frontend lint · gitleaks.yml Secret scan · sast.yml SAST scan
Components 20
CI security pipeline
- Code lint
.github/workflows/lint.yml - Frontend lint
.github/workflows/frontend-lint.yml - Secret scan
.github/workflows/gitleaks.yml - SAST scan
.github/workflows/sast.yml - Dependency scan
.github/workflows/sca.yml - Dockerfile lint
.github/workflows/docker-Hadolint-Login-push.yml - Code analysis
.github/workflows/sonarqube.yml
Image delivery
- Image build
.github/workflows/docker-build-scan-push.yml - Image scan
.github/workflows/trivy-image.yml - Docker Hub
- EC2 deployment
.github/workflows/deploy.yml - DAST scan
.github/workflows/dast.yml - OWASP ZAP
Library application
- Library interface
frontend/js/app.js
Application runtime
- Reverse proxy
nginx/default.conf - Flask API
backend/app.py - MySQL library
database/init.sql
Other components
- Developer
- GitHub push
- Library user
Connections 18
- Developer → GitHub push: pushes code
- GitHub push → Code lint: triggers
- Code lint → Frontend lint: then lint
- Frontend lint → Secret scan: then scan
- Secret scan → SAST scan: then scan
- SAST scan → Dependency scan: then scan
- Dependency scan → Dockerfile lint: then lint
- Dockerfile lint → Image build: then build
- Image build → Image scan: then scan
- Image scan → Code analysis: then analyze
- Code analysis → Docker Hub: pushes image
- Docker Hub → EC2 deployment: provides image
- EC2 deployment → DAST scan: then test
- DAST scan → OWASP ZAP: uses scanner
- Library user → Library interface: uses
- Library interface → Reverse proxy: requests API
- Reverse proxy → Flask API: routes requests
- Flask API → MySQL library: reads and writes