Enterprise Multibranch CI/CD Pipeline with SonarQube & Trivy
31 minAdvanced
This creates billable resources. Run it in a dev environment and destroy it when you finish. Set a budget alarm first.
Success criteria
0 of 4
What you are building#
What is an Automated Enterprise CI/CD Pipeline?#
Continuous Integration and Continuous Delivery (CI/CD) automates software delivery stages from initial developer code check-in to production deployment on EKS:
- Checkout & Unit Testing: Fetches code from GitHub and runs Pytest unit tests.
- SonarQube Quality Gate: Executes static code analysis to detect bugs, code smells, and security vulnerabilities. Blocks deployment if quality thresholds fail.
- Docker Multi-Stage Build: Compiles application image.
- Trivy Vulnerability Scan: Scans container layers for OS and dependency CVE vulnerabilities. Fails build if
CRITICALissues exist. - Amazon ECR Push: Tags image with Git SHA and
latest, pushing artifact to ECR. - Helm EKS Deployment: Triggers rolling update on EKS via Helm.
text
AUTOMATED MULTIBRANCH CI/CD PIPELINE
Developer (git push)
|
| GitHub Webhook Trigger
v
+-----------------------------------------------------------------------------------+
| JENKINS MULTIBRANCH PIPELINE (Jenkinsfile) |
| |
| [ Stage 1: Checkout Code ] |
| | |
| v |
| [ Stage 2: Pytest Unit Tests ] |
| | |
| v |
| [ Stage 3: SonarQube Static Analysis & Quality Gate ] |
| | (Quality Gate Passed ) |
| v |
| [ Stage 4: Multi-Stage Docker Build & Trivy CVE Security Scan ] |
| | (Zero CRITICAL CVEs ) |
| v |
| [ Stage 5: Tag & Push Container Image to Amazon ECR ] |
| | |
| v |
| [ Stage 6: Helm Upgrade Rolling Deployment to Amazon EKS ] |
+-----------------------------------------------------------------------------------+Steps#
Step 1: Push Code to GitHub Repository#
Terminal
git add .
git commit -m "feat: trigger enterprise multibranch CI/CD pipeline"
git push origin mainStep 2: Verify EKS Deployment Rollout Status#
Terminal
kubectl rollout status deployment/nti-django-app -n nti-devopsVerify it worked#
Terminal
kubectl rollout status deployment/nti-django-app -n nti-devopsExpected Output:
text
deployment "nti-django-app" successfully rolled outClean up#
Run this even if you did not finish. Everything above is destroyable, and an account full of half-built experiments is how a surprise bill starts.
Destructive — This removes real resources. Check which environment you are in first.
Terminal
terraform destroy -auto-approve
aws ecr list-images --repository-name <repo> --query 'imageIds[].imageTag'
aws ecr batch-delete-image --repository-name <repo> --image-ids imageTag=<tag>Cost of this lab: Free tier for the Jenkins instance itself; SonarQube wants 2 GB of RAM, so a $15/month) is realistic. ECR storage for the images the pipeline pushes is inside the free tier at this scale.t3.small (