DEV Community

Aisalkyn Aidarova
Aisalkyn Aidarova

Posted on

WEEKEND HOMEWORK — Restaurant Company CI

#github #security #ci #devops

Goal: Practice Trivy, understand vulnerabilities and dependency trees, and create a GitHub Actions pipeline with 3 independent parallel jobs: Lint, SonarQube, and Trivy.

Part 1 — Trivy manual security scan

Go to the project:

cd ~/restaurant-company
pwd
Enter fullscreen mode Exit fullscreen mode

Run the normal vulnerability scan:

trivy fs --scanners vuln .
Enter fullscreen mode Exit fullscreen mode

Then include development dependencies:

trivy fs --scanners vuln --include-dev-deps .
Enter fullscreen mode Exit fullscreen mode

Answer in your homework:

1. What is Trivy?
2. What does "fs" mean?
3. What does "." mean?
4. What does "vuln" mean?
5. What is a CVE?
6. What is Severity?
7. What is the difference between HIGH and MEDIUM?
8. Why did our first scan show 0 vulnerabilities?
9. Why did the scan with --include-dev-deps find vulnerabilities?
10. Does "0 vulnerabilities" mean an application is 100% secure? Explain.
Enter fullscreen mode Exit fullscreen mode

Take a screenshot of the Trivy result.

Part 2 — Investigate the dependencies

Run:

npm ls nanoid
Enter fullscreen mode Exit fullscreen mode

Then:

npm ls postcss
Enter fullscreen mode Exit fullscreen mode

Students should identify the dependency chain:

Restaurant Company
        ↓
Vite
        ↓
PostCSS
        ↓
nanoid
Enter fullscreen mode Exit fullscreen mode

Answer:

1. What is a dependency?
2. What is a transitive dependency?
3. Why is nanoid installed in our project?
4. Which package brings PostCSS into the project?
5. Which package brings nanoid into the dependency tree?
Enter fullscreen mode Exit fullscreen mode

Take a screenshot of both commands.

Part 3 — Read the Trivy vulnerability report

From your scan, identify:

Library
CVE
Severity
Installed Version
Fixed Version
Enter fullscreen mode Exit fullscreen mode

Create a small report like:

Finding 1

Library:
CVE:
Severity:
Installed Version:
Fixed Version:


Finding 2

Library:
CVE:
Severity:
Installed Version:
Fixed Version:
Enter fullscreen mode Exit fullscreen mode

Then answer:

What does "Installed Version" mean?

What does "Fixed Version" mean?

If Trivy says a fixed version exists,
does that mean our project is already fixed?

Why should a DevOps Engineer care about dependency vulnerabilities?
Enter fullscreen mode Exit fullscreen mode

Part 4 — Create a new Git branch

Start from updated main:

git switch main
git pull origin main
Enter fullscreen mode Exit fullscreen mode

Create your homework branch:

git switch -c weekend-ci-homework
Enter fullscreen mode Exit fullscreen mode

Check:

git branch
git status
Enter fullscreen mode Exit fullscreen mode

Part 5 — Create GitHub Actions CI

Create/open:

mkdir -p .github/workflows
nano .github/workflows/ci.yml
Enter fullscreen mode Exit fullscreen mode

The pipeline must contain three separate jobs:

                   ┌──── LINT ────────┐
                   │                   │
PULL REQUEST ──────┼──── SONARQUBE ────┼──→ RESULTS
                   │                   │
                   └──── TRIVY ────────┘
Enter fullscreen mode Exit fullscreen mode

Requirements:

Trigger:
pull_request → main

Job 1:
Lint

Job 2:
SonarQube

Job 3:
Trivy
Enter fullscreen mode Exit fullscreen mode

These must be separate jobs, not three steps inside one job.

Part 6 — Explain Parallel Jobs

Answer in your own words:

1. What is a GitHub Actions job?

2. What is a runner?

3. What is the difference between a Job and a Step?

4. Why can Lint, SonarQube and Trivy run independently?

5. What does "parallel jobs" mean?

6. Why can parallel jobs make CI faster?

7. Does Lint need to wait for Trivy before starting?

8. Does Trivy need the SonarQube result before starting?
Enter fullscreen mode Exit fullscreen mode

Draw this architecture yourself:

                    ┌── Lint
Pull Request ───────┼── SonarQube
                    └── Trivy
Enter fullscreen mode Exit fullscreen mode

Take a picture/screenshot of your drawing.

Part 7 — Push and create Pull Request 

git status
git add .
git commit -m "Add weekend CI homework"
git push -u origin weekend-ci-homework
Enter fullscreen mode Exit fullscreen mode

Go to GitHub and create:

weekend-ci-homework
        ↓
Pull Request
        ↓
main
Enter fullscreen mode Exit fullscreen mode

Then open:

GitHub → Actions

Find your jobs:

Lint
SonarQube
Trivy
Enter fullscreen mode Exit fullscreen mode

Take a screenshot showing the jobs.

If something fails, do not immediately delete or change things randomly.

Use our troubleshooting method:

CHECK
  ↓
FIND
  ↓
FIX
  ↓
VERIFY
Enter fullscreen mode Exit fullscreen mode

Open the failed job → find failed step → read logs → identify root cause → fix → commit → push → verify the new run.

Part 8 — Weekend interview questions

Students should be ready to answer these without reading notes:

What is CI?

What is GitHub Actions?

What is a workflow?

What is a job?

What is a runner?

What is a step?

What is Lint?

What is SonarQube?

What is SonarScanner?

What is a Quality Gate?

What is Trivy?

What is a CVE?

What is a dependency?

What is a transitive dependency?

What is the difference between
SonarQube and Trivy?

What are parallel jobs?

Why would you run security checks in CI?
Enter fullscreen mode Exit fullscreen mode

A good interview answer they can practice:

“In our project, we use GitHub Actions for CI. When a developer creates a Pull Request, independent jobs such as Lint, SonarQube, and Trivy can run in parallel. Lint checks code standards, SonarQube performs code analysis and evaluates the Quality Gate, and Trivy scans for known vulnerabilities.”

Top comments (0)