What it does: The developer writes application features, bug fixes, and unit tests in their local IDE (VS Code, IntelliJ, PyCharm) on a local feature branch (e.g. feature/user-profile). Before committing, local Git pre-commit hooks (using Husky or Gitleaks) automatically run code linters and scan the local workspace to prevent hardcoded passwords, API tokens, or AWS credentials from ever reaching Git history.

Tools Used: VS Code, Git, Husky, Gitleaks, ESLint/Prettier.

# Create feature branch, stage changes, and commit
git checkout -b feature/user-profile
git add .
git commit -m "feat(user): implement user profile endpoint with unit tests"

What it does: Code is pushed to the central GitHub repository. GitHub acts as the version control hub, managing source code history, branch protection rules (requiring 2 code reviews and passing CI checks), Pull Request (PR) discussions, and dispatching automated Webhook trigger payloads to the CI pipeline server upon push events.

Tools Used: GitHub, Pull Requests, Branch Protection Rules.

git push origin feature/user-profile

What it does: Catches the incoming push/PR webhook and triggers the Continuous Integration (CI) pipeline job. The runner environment (ephemeral GitHub-hosted runner or Jenkins Kubernetes pod agent) provisions a clean container, checks out the code, and initiates the automated build matrix.

Tools Used: GitHub Actions workflows (.github/workflows/ci.yml) or Jenkins Declarative Pipelines (Jenkinsfile).

name: CI Build Pipeline
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Set up JDK
      uses: actions/setup-java@v3
      with:
        java-version: '17'
        distribution: 'temurin'

What it does: Runs multiple automated quality gates and security scans in parallel to enforce strict software quality standards:

• Unit Testing: Verifies function-level business logic (JUnit, Jest, PyTest) and calculates code coverage percentage.
• SonarQube Analysis: Static Application Security Testing (SAST) analyzing source code for code smells, bugs, security hotspots, and duplication. Fails the pipeline if Quality Gates are not met (coverage < 80%).
• Aqua Trivy Filesystem Scan: Scans raw project source code and third-party dependencies for known security vulnerabilities before building binaries.

# Run Unit Tests & SonarQube Scanner
mvn test sonar:sonar -Dsonar.projectKey=my-app

# Run Trivy Filesystem Vulnerability Scan
trivy fs --security-checks vuln,config --severity HIGH,CRITICAL .

What it does: Creates an immutable Docker container image of the application using multi-stage Dockerfile builds (which separate build-time dependencies from slim runtime images). The image is tagged with the exact Git commit SHA (e.g. my-app:v1.2.0-8f9e0a1) to guarantee 100% build reproducibility across environments.

# Multi-stage Dockerfile
FROM maven:3.9-eclipse-temurin-17 AS builder
WORKDIR /app
COPY . .
RUN mvn clean package -DskipTests

FROM eclipse-temurin:17-jre-alpine
WORKDIR /app
COPY --from=builder /app/target/app.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]

# Build command
docker build -t 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:${GIT_SHA} .

What it does: Stores the built Docker container image securely in Amazon Elastic Container Registry (ECR). ECR enables AES-256 encryption at rest, IAM role-based repository access policies, and automated Scan on Push to discover newly disclosed CVE vulnerabilities continuously.

aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.us-east-1.amazonaws.com
docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:${GIT_SHA}

What it does: Declarative Infrastructure as Code (IaC) & Automated Configuration Management:

• Terraform: Provisions cloud infrastructure declaratively (VPC, Subnets, EKS Cluster, IAM Roles, Security Groups, NAT Gateways). State is stored remotely in Amazon S3 with DynamoDB state locking.
• Ansible: Configures server dependencies, manages system packages, updates configuration files, and enforces security compliance rules across EC2 nodes post-provisioning.

# Provision Infrastructure with Terraform
terraform init
terraform plan -out=tfplan
terraform apply tfplan

# Configure Servers with Ansible
ansible-playbook -i inventory/hosts.yaml playbooks/setup-node.yaml

What it does: Managed Kubernetes service in AWS running production worker node groups (EC2 / Fargate), networking via AWS VPC CNI (giving pods native VPC IP addresses), IAM Roles for Service Accounts (IRSA), CoreDNS, and Kube-Proxy ready to host containerized microservices at scale.

What it does: Packaging and GitOps Continuous Delivery:

• Helm: Packages Kubernetes manifests into reusable, versioned Helm Charts with environment-specific values.yaml parameters.
• Argo CD: Operates natively inside EKS, continuously watching the GitOps repository on GitHub. Upon detecting new image tags in Git, Argo CD pulls the chart and synchronizes Kubernetes state automatically.

What it does: Creates Kubernetes objects to run and expose the containerized application securely:

[Pods] ➔ Running application containers
  │
  ▼
[Service (ClusterIP)] ➔ Provides stable internal IP & DNS name
  │
  ▼
[Ingress (NGINX Controller)] ➔ Path routing (/api) & SSL Termination
  │
  ▼
[AWS Application Load Balancer] ➔ Exposes app externally to public internet

What it does: Global end-users access the live application via HTTPS (Port 443) over TLS 1.3 encryption. Route 53 resolves the domain name, AWS WAF filters malicious web attacks, and the ALB distributes traffic to healthy Kubernetes pods across multiple Availability Zones.

What it does: Collects real-time metrics, log streams, distributed request traces, and AI insights across infrastructure and applications:

What it does: Routes operational alerts to engineering teams via multi-channel notification policies:

• Slack Notifications: Non-critical warnings, successful deployment notices, and build alerts are posted to dedicated team Slack channels.
• PagerDuty Incidents: Critical production outages (e.g. EKS pod crash loops, High HTTP 5xx error rate > 5%, database latency spike) automatically trigger PagerDuty to create incidents and escalate via phone calls, SMS, and push notifications to on-call engineers.