STAGE 00 · git init
DevSecOps engineer. This page is a build log — every section is a stage a commit passes through. By the footer, you've watched a release go from raw code to production.
Most pipelines ship fast or ship safe. Rarely both. I build the ones that do both — from lint to production, with a scan and a signature at every gate in between.
Real repos, real logs. Each card is a release — drag or scroll right to follow the build from v0.1 to v1.0.
NTI capstone project — the first commit. Where the pipeline started.
Spring PetClinic source + lightweight Kubernetes manifests — Secret, MySQL, deployment, HPA.
Three-tier app fronted by TLS ingress — served over HTTPS end to end.
Kubernetes hardening — cluster policy, RBAC, and security practices baked in.
Cosign + SBOM generation — images signed and attested before they ever reach the registry.
FastAPI + Nginx + Helm. Six gates: lint → SonarCloud → SBOM → scan → sign → GitOps deploy.
Skills aren't a logo grid — they're a pipeline. Grouped by phase, the way a build actually runs.
A real repo, a real six-stage pipeline. Before → decision → after.
FastAPI backend, static Nginx frontend, Postgres. docker-compose up shipped a working app, but everything ran as one process on one host — no scan, no signature, no drift detection. A bad image was indistinguishable from a good one.
Lint with ruff, SAST with bandit, dependency check with safety, image scan with trivy, SBOM via syft, sign with cosign. Deploy through a Helm chart to Minikube, reconciled by ArgoCD. Any gate fails, the build stops.
Helm releases pin to image digests. ArgoCD reconciles on schedule; manual kubectl apply drift gets overwritten on the next sync. Nothing runs in the cluster that wasn't scanned, signed, and attested.
The repo, the chart, the scan commands, and the Cosign workflow are all public. github.com/KarimKhaledMhammed/devops_pipeline_pirates ↗
Certifications as checks. Mentoring as an ongoing job.
