Weekend Project: DevSecOps Intro🛠️

Github Actions...

Project: Secure Your Code with GitHub Actions

By the end of this project you will know:

• What are Github Actions

• Why we use them

• How to set up a GitHub Action that uses an open-source tool (Gitleaks) to automatically scan the code in your repository for potential security issues.

This project encapsulates DevSecOps at its very core… “How can we inject security into the Development Pipeline?” Now of course, DevSecOps is a huge umbrella term that takes years to master but it’s projects like this that are going to put you on a really good path for learning and get you thinking in all the right ways.

Here’s a super high-level of what we are trying to achieve here from a Github point of view:

The year is almost over

There’s still time for one more project you can complete over a weekend with just a few spare hours. If you want to know the basic of Github, I recommend checking out this chapter from my book - What is Github?

What are Github Actions?

GitHub Actions let you automate tasks directly within your GitHub repositories. Think of them as mini-robots (Runners) that perform specific jobs for you, like running tests, deploying code, or checking for vulnerabilities.

How do they work?

They use workflows, which are like recipes made up of individual steps (called jobs). These workflows run automatically when specific events happen - like when you push code or open a pull request - or on a schedule.

I’ve put together this diagram to help digest it:

Real-life Example

Let’s say you’re working on a website. GitHub Actions could:

• Test your website code every time you make changes.

• Deploy the updated version to the cloud if the tests pass.

• Run a security scan to make sure there are no vulnerabilities.

Why use GitHub Actions?

• Saves time by automating repetitive tasks.

• Reduces human error with consistent workflows.

• Helps integrate security into your workflow

Project Time

Okay, hopefully by now you have a decent grasp of what Github Actions are conceptually. Let’s put that knowledge to good use and create our own Github Action.

Step One: Installing what you need

First, we need Git:

For most Ubuntu and Debian-based distro’s, you want to run:

sudo apt-get install git

For Windows, the set-up wizard will do most of the work and guide you through the setup process, it’s really simple! - Download Here

For macOS, Install homebrew, if you don't already have it, then:

brew install git

Next, you need to sign up for a GitHub account which can be done here: github.com

---

Step Two: Repository set-up

I have a feeling most of my readers will know how to do this already and I don’t want to waste your time.

I'm going to link another article of mine here. It takes you right from creating a Github account to making your first PR

• Click me to get setup with Git and make your first PR

But effectively at this point you should have:

• A new Repo on Github

• README.MD File

• Cloned locally

• A new branch created ready to add files - Like this:

Here’s where it gets interesting…

Step Three: Let’s create our first Github Action - I’ll include a link to my Github here (I’ve created a new one for substack projects)