Merge pull request #8 from atulgoel126/main-week3-day1-2 #36

	name: CI/CD Pipeline

	on:
	push:
	branches:
	- main
	- main-week2-day5-6
	pull_request:
	branches:
	- main

	permissions:
	contents: read
	packages: write

	jobs:
	build:
	runs-on: ubuntu-latest
	environment: dev
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: '20'

	- run: npm ci
	- run: npm run build
	- run: npm test

	- name: CDK Synth
	run: npm run cdk-synth
	env:
	CDK_DEFAULT_ACCOUNT: ${{ vars.AWS_ACCOUNT_ID }}
	CDK_DEFAULT_REGION: ${{ vars.AWS_DEFAULT_REGION }}

	security-scan:
	needs: build
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	# Checkov scan
	- uses: bridgecrewio/checkov-action@v12
	with:
	directory: .
	framework: all
	soft_fail: true # Don't fail pipeline but report issues

	# Trivy scan for container
	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'table'
	exit-code: '1'
	ignore-unfixed: true
	severity: 'CRITICAL,HIGH'
	#
	docker:
	needs: security-scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Login to GitHub Container Registry
	uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Build and push
	uses: docker/build-push-action@v5
	with:
	push: true
	tags: ghcr.io/${{ github.repository }}:latest

Provide feedback