# GitHub Actions: Netflix Deployment Powered by DevSecOps

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697788120677/7708713d-c403-43f4-83a7-51a36545d708.png?auto=compress,format&format=webp align="left")

### Step1: Launch an Ec2 Instance

To launch an AWS EC2 instance with Ubuntu 2[2.04 using the](https://hashnode.com/@se7enAj) [AWS Manageme](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)nt Con[sole, sign in](https://hashnode.com/@se7enAj) [to your AWS](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) account, access the EC2 dashboard, and click "Launch Instances." In "Step 1," select "Ubuntu 22.04" as the AMI, and in "Step 2," choose "t2.medium" as the instance type. Configure the instance details, storage, tags, and security group settings according to your requirements. Review the settings, create or select a key pair for secure access, and launch the instance. Once launched, you can connect to it via SSH using the associated key pair.

### Step2A: Install Docker and Run Sonarqube Container

Connect to your Ec2 in[stance using Pu](https://hashnode.com/@se7enAj)[tty, Mobaxtr](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)eme or Git bash and install [docker on it](https://hashnode.com/@se7enAj)[.](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

```plaintext
sudo apt-get update
sudo apt install docker.io -y
sudo usermod -aG docker ubuntu
newgrp docker
sudo chmod 777 /var/run/docker.sock
```

Pull the SonarQube Docker image and run it.

After the docker installation, [we will creat](https://hashnode.com/@se7enAj)[e a Sonarqub](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)e container (Remembe[r to add 9000](https://hashnode.com/@se7enAj) [ports in th](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)e security group).

```plaintext
docker run -d --name sonar -p 9000:9000 sonarqube:lts-community
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694159658559/a607bab7-4ee0-4802-bf77-e9716ac33838.png?auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

Now copy the IP address of the ec2 instance

```plaintext
<ec2-public-ip:9000>
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694159822624/f07bd773-5992-4b88-b849-ffcea2891b8e.png?auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

Provide [Login and pa](https://hashnode.com/@se7enAj)[ssword](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

```plaintext
login admin
password admin
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694159867860/7425ab62-8978-4dbb-a5c5-d0eb3362c15f.png?auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

Update your Sonarq[ube password](https://hashnode.com/@se7enAj) [& This is th](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)e Sonarqube dashboard

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1694159887297/6e055b5c-13ea-405f-bc13-1234b05bf2ff.png?auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

### Step2B: [Integrating](https://hashnode.com/@se7enAj) [SonarQube wi](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)th GitHub Actions

Integrating SonarQube w[ith GitHub Acti](https://hashnode.com/@se7enAj)[ons allows y](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ou to automatically analyz[e your code f](https://hashnode.com/@se7enAj)[or quality a](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)nd security as part of your continuous integration pipeline.

We already have Sonarqube up and running

On Sonarqube Dashboard click on Ma[nually](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733434327/7c1d1747-6a5c-4bfb-86c6-a377c16283c2.png?auto=compress,format&format=webp align="left")

[Next](https://hashnode.com/@se7enAj)[, provide a](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) name for your pro[ject and prov](https://hashnode.com/@se7enAj)[ide a Branch](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) name and click on [setup](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733461776/7a20890c-4c29-4af6-bc1b-d8f1608e5399.png?auto=compress,format&format=webp align="left")

[On t](https://hashnode.com/@se7enAj)[he next page](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) click on With GitHub actions

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733519026/1ece3e2d-cd62-4d0a-a5af-685052b92a48.png?auto=compress,format&format=webp align="left")

This will Generate an overvi[ew of the Pro](https://hashnode.com/@se7enAj)[ject and pro](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)vide some instructions [to integrate](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733567304/9a982d64-630d-4557-8911-e12f5ee93d21.png?auto=compress,format&format=webp align="left")

[Let's Open](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) your GitHub and select your Repository

In my case it is Netflix-[clone and Cli](https://hashnode.com/@se7enAj)[ck on Settin](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)gs

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706858451786/7ce3fb11-618b-4eb9-9f82-f02c12dd9213.png align="center")

Search for Secrets an[d variables a](https://hashnode.com/@se7enAj)[nd click on](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) and again click on actions

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733831585/cc14f1ff-0874-482a-a696-603996fa7830.png?auto=compress,format&format=webp align="left")

I[t will open a](https://hashnode.com/@se7enAj) [page like t](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)his click on New Repository secret

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733935806/991195ea-a5b2-4680-9862-5cfd83578094.png?auto=compress,format&format=webp align="left")

Now go back t[o Your Sonarq](https://hashnode.com/@se7enAj)[ube Dashboar](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)d

Copy SONAR\_TOKEN and click on Gener[ate Token](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697734072182/edf9523e-d085-4ce6-b6bd-71f6e2d6ca87.png?auto=compress,format&format=webp align="left")

[C](https://hashnode.com/@se7enAj)[lick on Gene](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)rate

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697734186205/ebc600b1-d572-4c62-a36b-d60c6b898bf6.png?auto=compress,format&format=webp align="left")

Let's cop[y the Token a](https://hashnode.com/@se7enAj)[nd add it to](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) GitHub secrets

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697734317430/cb2b2908-7b7c-4be2-9189-361f57101243.png?auto=compress,format&format=webp align="left")

Now [go back to Gi](https://hashnode.com/@se7enAj)[tHub an](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[d Paste the c](https://hashnode.com/@se7enAj)[opied name f](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)or the secret and token

Na[me: <mark>SONAR_TOK</mark>](https://hashnode.com/@se7enAj)[<mark>EN</mark>](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

[Secret:](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) Paste Your Token and click on Add secret

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697734395256/0e9df5a6-1f71-43dd-84bd-d896b45127e4.png?auto=compress,format&format=webp align="left")

Now go [back to the](https://hashnode.com/@se7enAj) [Sonarq](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[ube Dashboard](https://hashnode.com/@se7enAj)

[Copy the N](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ame and Value

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697734509638/728bd7b9-b054-47e4-a198-cee97b4d8c84.png?auto=compress,format&format=webp align="left")

Go to GitH[ub now and pa](https://hashnode.com/@se7enAj)[ste-like thi](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)s and click on [add secret](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697734741619/b10c45fd-6b3a-4d93-8da4-d717afa4e274.png?auto=compress,format&format=webp align="left")

[Our Sonarqub](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)e [secrets are](https://hashnode.com/@se7enAj) [added and yo](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)u can see

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697734812189/1f71c8a4-b476-4bfd-b737-c7d959c2212f.png?auto=compress,format&format=webp align="left")

Go to Sonarqube Dashboard [and click on](https://hashnode.com/@se7enAj) [continue](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697734879501/99701543-dcaf-49f3-a833-fb5d3c66020f.png?auto=compress,format&format=webp align="left")

[N](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ow create your Workflow f[or your Proje](https://hashnode.com/@se7enAj)[ct. In my ca](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)se, the Netflix project i[s built using](https://hashnode.com/@se7enAj) [React Js. T](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)hat's why I am selecting Other

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735091192/592ee329-3282-4531-86a6-649245d75e2a.png?auto=compress,format&format=webp align="left")

Now it Generates and workflow for my Project

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735193704/d55b9bd6-abc3-43c1-8e79-ca7492e65ef9.png?auto=compress,format&format=webp align="left")

Go back to GitHub. click on A[dd file and t](https://hashnode.com/@se7enAj)[hen create a](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) new file

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735294808/28027f5d-a7c7-4a73-8210-dda3aaec5594.png?auto=compress,format&format=webp align="left")

Go back to [the Sonarqub](https://hashnode.com/@se7enAj)[e dashboard](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) and copy the file name and content

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735423519/bc7d137f-e683-40d5-8d02-de252a6bba1b.png?auto=compress,format&format=webp align="left")

Here [file name (i](https://hashnode.com/@se7enAj)[n my case on](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ly )

```plaintext
sonar-project.properties
```

The content to [add to the f](https://hashnode.com/@se7enAj)[ile is (copi](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ed from the above image)

```plaintext
sonar.projectKey=Netflix
```

[Add in Gi](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)tHub like this

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735613515/cdfa1471-d40f-4c6b-9d54-c935cf109d96.png?auto=compress,format&format=webp align="left")

Let's add our workflow

To do that click on Add fi[le and then c](https://hashnode.com/@se7enAj)[lick on Crea](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)t[e a new file](https://hashnode.com/@se7enAj)

[Here is t](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[he file name](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706858396652/dcce0848-a905-409a-ac4d-6f37b6a079a6.png align="center")

```plaintext
.github/workflows/build.yml  #you can use any name iam using sonar.yml
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735742377/942d5afd-c831-45ac-ab0c-a7c63caddfdc.png?auto=compress,format&format=webp align="left")

[Copy](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) content and add it to the file

```plaintext
name: Build,Analyze,scan

on:
  push:
    branches:
      - main


jobs:
  build-analyze-scan:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: Build and analyze with SonarQube
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735821468/6d9fdc2a-4065-4e5c-99b5-9fc2ae4a565e.png?auto=compress,format&format=webp align="left")

Click on commit changes

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735887372/f4fff53d-5e8a-4171-87ab-f61d215e615b.png?auto=compress,format&format=webp align="left")

Now workflow is created.

Click on Actions now

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735946338/58acfdf1-e96d-45d9-8148-2877e2e4bae6.png?auto=compress,format&format=webp align="left")

N[ow it's autom](https://hashnode.com/@se7enAj)[atically sta](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)r[ted the workf](https://hashnode.com/@se7enAj)[low](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697736015163/9be8e520-54e7-4eb9-bb7e-841d598a0e14.png?auto=compress,format&format=webp align="left")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697736055832/d2415635-cba2-4f55-b3cd-9147b55c56ee.png?auto=compress,format&format=webp align="left")

[Let's](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) [click on Buil](https://hashnode.com/@se7enAj)[d and see](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) [what are the](https://hashnode.com/@se7enAj) [steps involv](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ed

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697736123510/a2ac77be-6cd4-411a-993f-d25613fccb3d.png?auto=compress,format&format=webp align="left")

Click on Run Sona[rsource and y](https://hashnode.com/@se7enAj)[ou can do th](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)is after the build completion

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697736204287/80bce1ff-6fee-4623-a92c-3cf4bf67c05f.png?auto=compress,format&format=webp align="left")

Bu[ild complete.](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697736325893/8c9309b3-394c-4a58-b91a-3e452e578484.png?auto=compress,format&format=webp align="left")

[Go to the](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) Sonarqube dashboard and click on projects and yo[u can see the](https://hashnode.com/@se7enAj) [anal](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[ysis](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697736376673/fef41016-089d-4a96-9ca2-34cd7081f508.png?auto=compress,format&format=webp align="left")

[If you](https://hashnode.com/@se7enAj) [want to see](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) the full report, click on issues.

### Step3: Let's scan fi[les using Tri](https://hashnode.com/@se7enAj)[vy](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

[Add this](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) code to your sonar.yml (I me[an workflow)](https://hashnode.com/@se7enAj)

```plaintext
- name: install trivy
  run: |
    #install trivy
    sudo apt-get install wget apt-transport-https gnupg lsb-release -y
    wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
    echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
    sudo apt-get update
    sudo apt-get install trivy -y
    #command to scan files
    trivy fs .
```

GitHub Actions workflow step that installs Trivy, a popular open-source vuln[erability sca](https://hashnode.com/@se7enAj)[nner for con](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)tainers, and then uses it to scan the files.

I added a step in the workflow

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697737102202/c47866e8-173b-4619-8608-91d7ff4d103f.png?auto=compress,format&format=webp align="left")

Commit changes

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735887372/f4fff53d-5e8a-4171-87ab-f61d215e615b.png align="left")

Click on actions again

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735946338/58acfdf1-e96d-45d9-8148-2877e2e4bae6.png align="left")

I[t started the](https://hashnode.com/@se7enAj) [workflow bu](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ild

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697737273762/3a338c77-9209-464d-8d46-46733c7fa46a.png?auto=compress,format&format=webp align="left")

Cl[ick on Build,](https://hashnode.com/@se7enAj) [Ana](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[lyze and scan](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697737352185/8b806279-8e18-4f5c-8e6a-6324fc723ab4.png?auto=compress,format&format=webp align="left")

[It instal](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[led Trivy ver](https://hashnode.com/@se7enAj)[sion 0.46.0](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) and sca[nned files al](https://hashnode.com/@se7enAj)[so. See repo](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)rt

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697737445167/f8279a79-0a45-45c2-8c82-ef2c88217535.png?auto=compress,format&format=webp align="left")

The f[ile scan is c](https://hashnode.com/@se7enAj)[ompleted, th](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)is is another security check

### Step4A: Docker [build and pu](https://hashnode.com/@se7enAj)[sh to Docker](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)hub

Create a Personal Access token [for your Docke](https://hashnode.com/@se7enAj)[rhub account](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

Go to docker hub [and click on](https://hashnode.com/@se7enAj) [your profile](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) --&gt; Account settings --&gt; security [--&gt; New acce](https://hashnode.com/@se7enAj)[ss token](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

[I](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)t asks for a name Provide a name and click on generate token

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1706858314272/fe895ecb-f79c-481b-857e-cf1f2388b5cc.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697738153103/481b06e8-e089-4c49-bddd-892ad8885f3f.png?auto=compress,format&format=webp align="left")

Copy the tok[en save it in](https://hashnode.com/@se7enAj) [a safe plac](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)e, and close

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697738231443/d69a2fc2-3c7f-4319-b6b1-01fab73cb7c6.png?auto=compress,format&format=webp align="left")

Now Go to GitHub again a[nd click on s](https://hashnode.com/@se7enAj)[ettings](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733771633/aede3330-0e1d-4c50-83aa-1789a792bf70.png align="left")

[Se](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)arch for Secrets and variab[les and click](https://hashnode.com/@se7enAj) [on and agai](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)n click on actions

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733831585/cc14f1ff-0874-482a-a696-603996fa7830.png align="left")

I[t will open a](https://hashnode.com/@se7enAj) [page like t](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)his click on New Repository secret

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697733935806/991195ea-a5b2-4680-9862-5cfd83578094.png align="left")

Add your Dock[erhub usernam](https://hashnode.com/@se7enAj)[e with the s](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ecret name as

```plaintext
DOCKERHUB_USERNAME   #use your dockerhub username
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697738532234/8e5480a2-d0c1-4fff-8bba-27a65f1eb7fb.png?auto=compress,format&format=webp align="left")

Click on Add Secret.

Let's add our token also and click on the new reposito[ry secret aga](https://hashnode.com/@se7enAj)[in](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

[Name](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

```plaintext
DOCKERHUB_TOKEN
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697738661634/236f1094-7ac5-419d-95b2-0dab36d18de7.png?auto=compress,format&format=webp align="left")

[Paste](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) the token that you generated and click on Add [secret.](https://hashnode.com/@se7enAj)

### [S](https://hashnode.com/@se7enAj)[tep4B: Creat](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[e a TMDB API](https://hashnode.com/@se7enAj) [Key](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

[Next, w](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)e will create a TMDB API key

Open a [new tab in the](https://hashnode.com/@se7enAj) [Browser and](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) searc[h for TMDB](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676147833/d4b2a30a-9905-4c80-9e35-5f2c4ab507ed.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

[Click on the](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) first resul[t, you will s](https://hashnode.com/@se7enAj)[ee this page](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676217664/aa0b301b-4b7f-47d0-b07b-4213f0e60354.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

Click on the Login on th[e top right.](https://hashnode.com/@se7enAj) [You will get](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) this page.

You need to cr[eate an accou](https://hashnode.com/@se7enAj)[nt here. cli](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ck on click here. I have an account t[hat's why I a](https://hashnode.com/@se7enAj)[dded my deta](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ils there.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676319480/44376988-549f-41d2-b469-2951d0574359.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

once you create an account you will see this page.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676407253/ebb7fba4-efb8-4422-a473-b164bc609f3d.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

Let's create an API key[, By clicking](https://hashnode.com/@se7enAj) [on your pro](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)file and clicking settings.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676474552/d8913c51-3268-463c-9b67-9c1b70d72bef.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

[Now click o](https://hashnode.com/@se7enAj)[n API from t](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)he left side panel.

Now click on create

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676552066/d768cbba-5c5c-44c9-8692-14276afa7516.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

Click on [Developer](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676567781/7f92bfb0-f76c-47c0-9f7b-716cfa8e617d.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

[N](https://hashnode.com/@se7enAj)[ow you have](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) to accept the terms [and condition](https://hashnode.com/@se7enAj)[s.](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676601846/c2b4a1c7-e72a-405c-82a5-cfd5fc454403.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

[Prov](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[ide basic det](https://hashnode.com/@se7enAj)[ails](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676624029/ac7b685f-3fae-449c-977f-717e406a4933.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

[Click on subm](https://hashnode.com/@se7enAj)[it and you w](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ill get your API key.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1696676675438/de5b5e7b-370e-4d73-874f-842451e2d508.png?auto=compress,format&format=webp&auto=compress,format&format=webp align="left")

Le[t's add the b](https://hashnode.com/@se7enAj)[elow step to](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) [the workflow](https://hashnode.com/@se7enAj)

[<mark>You have t</mark>](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)<mark>o add API at the Build c</mark>[<mark>ommand</mark>](https://hashnode.com/@se7enAj)

[Chang](https://hashnode.com/@se7enAj)[e your usern](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ame also

```plaintext
- name: Docker build and push
  run: |
    #run commands to build and push docker images
    docker build --build-arg TMDB_V3_API_KEY=<USE YOUR API KEY> -t netflix .
    docker tag netflix hassanb111/netflix:${{ github.sha }}
    docker login -u ${{ secrets.DOCKERHUB_USERNAME }} -p ${{ secrets.DOCKERHUB_TOKEN }}
    docker push hassanb111/netflix:${{ github.sha }}
  env:
    DOCKER_CLI_ACI: 1
```

You can see the image, I already added

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697739277274/960ba9a6-a37d-4f52-89b0-ad242ef86d7e.png?auto=compress,format&format=webp align="left")

Let's commit changes

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735887372/f4fff53d-5e8a-4171-87ab-f61d215e615b.png align="left")

Click on act[ions again](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735946338/58acfdf1-e96d-45d9-8148-2877e2e4bae6.png align="left")

[It started t](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)he workflow buil[d](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697737273762/3a338c77-9209-464d-8d46-46733c7fa46a.png align="left")

[Click on](https://hashnode.com/@se7enAj) [Build, Ana](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[lyze and Scan](https://hashnode.com/@se7enAj)[. You will s](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[ee this Docke](https://hashnode.com/@se7enAj)[r image is b](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)uilding [now](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697784303064/218537fa-9768-4d44-8402-057d39186869.png?auto=compress,format&format=webp align="left")

[Build](https://hashnode.com/@se7enAj) [Succeeded](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697784355130/0296231f-dfc4-46cc-85dc-5da7b738b286.png?auto=compress,format&format=webp align="left")

If you go to your Docker hub, you will find that the image [is pushed to](https://hashnode.com/@se7enAj) [Dock](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[erhub](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697784447586/e331d2f7-69cf-4767-adfc-a7457583f503.png?auto=compress,format&format=webp align="left")

### [Ste](https://hashnode.com/@se7enAj)[p5A: Add a s](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)elf-hosted runner to Ec2

Go to GitHub and click on <mark>Setting</mark>[<mark>s --&gt; Actions -</mark>](https://hashnode.com/@se7enAj)[<mark>-&gt; Runners</mark>](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697784904684/3c0ee142-c3de-4727-97f8-1efd25d70fae.png?auto=compress,format&format=webp align="left")

Click on New se[lf-hosted run](https://hashnode.com/@se7enAj)[ner](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697785132651/80efa346-558b-4bec-8da3-e8cb57c928d9.png?auto=compress,format&format=webp align="left")

[Now se](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)lect <mark>Linux</mark> and Architecture <mark>X64</mark>

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697785277210/ac5ac3d3-1acb-4612-996c-ddb71747ff69.png?auto=compress,format&format=webp align="left")

Us[e the below c](https://hashnode.com/@se7enAj)[ommands to a](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)dd a self[\-hosted runne](https://hashnode.com/@se7enAj)[r](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697785495740/46e13d60-5495-4c54-94a3-3c2bdea4561d.png?auto=compress,format&format=webp align="left")

[Go to Pu](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)tty or Mobaxtre[me and connec](https://hashnode.com/@se7enAj)[t to your ec](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)2 instance

And paste the co[mmands](https://hashnode.com/@se7enAj)

[<mark>NOTE:</mark>](https://hashnode.com/@se7enAj) [<mark> USE YOUR RU</mark>](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)<mark>NNER COMMANDS (EXAMPLE CASE IAM USI</mark>[<mark>NG MINE)</mark>](https://hashnode.com/@se7enAj)

```plaintext
mkdir actions-runner && cd actions-runner
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697785757454/95c807b3-fb92-4648-a209-d0e57652811d.png?auto=compress,format&format=webp align="left")

The command "mkdir actions-runner && cd actions-runner" is used to create a [new directory](https://hashnode.com/@se7enAj) [called "act](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ions-runner" in the current working directory and then immediately change the current working directory to the newly created "actions-runner" directory. This allows you to organize your files and perform subsequent actions within the newly created directory without having to navigate to it separately.

```plaintext
curl -o actions-runner-linux-x64-2.310.2.tar.gz -L https://github.com/actions/runner/releases/download/v2.310.2/actions-runner-linux-x64-2.310.2.tar.gz
```

This command downloads a file called "actions-runner-linux-x64-2.310.2.tar.g[z" from a spe](https://hashnode.com/@se7enAj)[cific web ad](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)dress on GitHub and saves it in your current directory.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697785890834/03a46ac0-0fe1-4d78-8583-9c8d35d5c6fd.png?auto=compress,format&format=webp align="left")

Let's validate the hash installation

```plaintext
echo "fb28a1c3715e0a6c5051af0e6eeff9c255009e2eec6fb08bc2708277fbb49f93  actions-runner-linux-x64-2.310.2.tar.gz" | shasum -a 256 -c
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697785991432/05c19f2d-138b-415d-b7bc-acd1b9ffd63e.png?auto=compress,format&format=webp align="left")

Now Extract the installer

```plaintext
tar xzf ./actions-runner-linux-x64-2.310.2.tar.gz
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697786043970/57ba915c-9e91-4944-80f2-654d90976c5f.png?auto=compress,format&format=webp align="left")

[Let's con](https://hashnode.com/@se7enAj)[figure the r](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)unner

```plaintext
./config.sh --url https://github.com/hassanb111/Netflix-clone --token A2MXW4323ALGB72GGLH34NLFGI2T4
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697786345444/58749331-f0f4-4dac-9807-902746a80723.png?auto=compress,format&format=webp align="left")

Let's start runner

```plaintext
./run.sh
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697786436625/5e13c1dd-cb2e-42ec-8cf8-b5eeb965afcf.png?auto=compress,format&format=webp align="left")

### Step5B: Final workflow to run the containe[r](https://hashnode.com/@se7enAj)

[Let's add](https://hashnode.com/@se7enAj) [a deployment](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) workfl[ow](https://hashnode.com/@se7enAj)

```plaintext
deploy:    
    needs: build-analyze-scan  
    runs-on: [aws-netflix]  
    steps:
      - name: Pull the docker image
        run: docker pull hassanb111/netflix:${{ github.sha }}
      - name: Trivy image scan
        run: trivy image hassanb111/netflix:${{ github.sha }}
      - name: Run the container netflix
        run: docker run -d --name netflix -p 8081:80 hassanb111/netflix:${{ github.sha }}
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697786712536/6a2f6787-26c0-4bd4-807e-9ffef33f9d69.png?auto=compress,format&format=webp align="left")

1. `deploy:`: This is the name of a workflow or job, likely associated with a CI/[CD pipeline.](https://hashnode.com/@se7enAj) [It specifies](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) what should happen when this deployment job is triggered.
    
2. `needs: build-analyze-scan`: This line indicates that this deployment job depe[nds on the su](https://hashnode.com/@se7enAj)[ccessful com](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)pletion of a previous job named "build-analyze-scan." In other words, it waits for "build-analyze-scan" to finish before starting.
    
3. `runs-on: [aws-netflix]`: This job is set to run on a specific type of runner [or environmen](https://hashnode.com/@se7enAj)[t, labeled a](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)s "aws-netflix." Runners are the environments where jobs are executed, and "aws-netflix" suggests that this deployment might be intended for an AWS-based infrastructure.
    
4. `steps:`: This section lists the individual steps or tasks to be executed as p[art of the de](https://hashnode.com/@se7enAj)[ployment job](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops).
    
    * `name: Pull the docker image`: This step has a descriptive name. It uses the `d`[`ocker pull` co](https://hashnode.com/@se7enAj)[mmand to fet](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ch a Docker image labeled "sevenajay/netflix:latest." This is a common step in container-based deployments, where it ensures that the latest version of the Docker image is available locally.
        
    * `name: Trivy image scan`: This step performs a security scan on the Docker ima[ge "sevenajay](https://hashnode.com/@se7enAj)[/netflix:lat](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)est" using a tool called Trivy. Trivy is used for vulnerability scanning of container images.
        
    * `name: Run the container netflix`: This step starts a Docker container named "[netflix" usin](https://hashnode.com/@se7enAj)[g the image](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) "sevenajay/netflix:latest." It runs the container in detached mode ("-d") and maps port 8081 on the host to port 80 in the container, making the service accessible via port 8081 on the host.
        

This workflow is designed to automate the deployment of a Docker container, [with checks f](https://hashnode.com/@se7enAj)[or the lates](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)t image, a security scan, and launching the container. The success of this job depends on the success of the preceding "build-analyze-scan" job, and it's meant to be executed on the specified runner, possibly in an AWS environment.

Commit changes

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735887372/f4fff53d-5e8a-4171-87ab-f61d215e615b.png align="left")

Click on actions again

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697735946338/58acfdf1-e96d-45d9-8148-2877e2e4bae6.png align="left")

You will see two different Jobs no[w](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787022248/a3b34120-45dd-45d5-8f8d-ba5303b36c0a.png?auto=compress,format&format=webp align="left")

[Click on](https://hashnode.com/@se7enAj) [Buil](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[d and Push do](https://hashnode.com/@se7enAj)[cker image B](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)[uild (using t](https://hashnode.com/@se7enAj)[he above ima](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)ge), you will [see this onc](https://hashnode.com/@se7enAj)[e the first](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) job completes

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787115094/4bfe83a3-6b23-477b-af43-3a8e161fc0b8.png?auto=compress,format&format=webp align="left")

Now come back by clicking on Summary and click on Deploy now

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787219269/9f9b6c50-06cb-476d-be8d-d977794fe6e6.png?auto=compress,format&format=webp align="left")

You can see h[ow it's pulli](https://hashnode.com/@se7enAj)[ng image and](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) scanning image

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787413957/17fa1910-0547-4c4f-9178-6d362f4954b8.png?auto=compress,format&format=webp align="left")

It starts running th[e job on your](https://hashnode.com/@se7enAj) [Ec2 instanc](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)e

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787285371/5ff707a4-fec2-43bb-9f6d-bc3227affa92.png?auto=compress,format&format=webp align="left")

Now it's completed running [the container](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787466071/0e4c055b-06ce-4239-83e4-10867018c495.png?auto=compress,format&format=webp align="left")

[You will](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) see this in the instance

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787596671/0df83d09-41ca-4c0a-88b5-80338703b892.png?auto=compress,format&format=webp align="left")

[On GitHub,](https://hashnode.com/@se7enAj) [you will se](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)e this. the build [succeeded](https://hashnode.com/@se7enAj)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787645836/5d4d44d1-bf33-4bdd-8045-3dcd010e1331.png?auto=compress,format&format=webp align="left")

[N](https://hashnode.com/@se7enAj)[ow copy your](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) ec2 instan[ce ip and go](https://hashnode.com/@se7enAj) [to the brows](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)er

```plaintext
<Ec2-instance-ip:8081>
```

[You will se](https://hashnode.com/@se7enAj)[e Netflix ap](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops)p will run

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787725932/3c33714a-bf1a-4446-9be4-25bcf9cd93fc.png?auto=compress,format&format=webp align="left")

Deployment is done.

FULL WORKFLOW

```plaintext
name: Build,Analyze,scan

on:
  push:
    branches:
      - main


jobs:
  build-analyze-scan:
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis

      - name: Build and analyze with SonarQube
        uses: sonarsource/sonarqube-scan-action@master
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

      - name: install trivy
        run: |
           #install trivy
           sudo apt-get install wget apt-transport-https gnupg lsb-release -y
           wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
           echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
           sudo apt-get update
           sudo apt-get install trivy -y
           #scanning files
           trivy fs .

      - name: Docker build and push
        run: |
          #run commands to build and push docker images
          docker build --build-arg TMDB_V3_API_KEY=cc43e68ccd7edc1f4cbe88e891ad7059 -t netflix .
          docker tag netflix hassanb111/netflix:${{ github.sha }}
          docker login -u ${{ secrets.DOCKERHUB_USERNAME }} -p ${{ secrets.DOCKERHUB_TOKEN }}
          docker push hassanb111/netflix:${{ github.sha }}
        env:
          DOCKER_CLI_ACI: 1     

  deploy:    
    needs: build-analyze-scan  
    runs-on: [aws-netflix]  
    steps:
      - name: Pull the docker image
        run: docker pull hassanb111/netflix:${{ github.sha }}
      - name: Trivy image scans
        run: trivy image hassanb111/netflix:${{ github.sha }}
      - name: Run the container netflix
        run: docker run -d --name netflix -p 8081:80 hassanb111/netflix:${{ github.sha }}
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1697787897982/b38b2cbb-c497-4ab2-a88b-cbb01d191f35.png?auto=compress,format&format=webp align="left")

Clear the instance.

I hope you found this blog insightful and that you've l[earned someth](https://hashnode.com/@se7enAj)[ing new](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) [about how Git](https://hashnode.com/@se7enAj)[Hub Actions](https://mrcloudbook.hashnode.dev/github-actions-netflix-deployment-powered-by-devsecops) can supercharge your Netflix deployments through the lens of DevSecOps. As technology evolves, staying informed and adaptable is key to thriving in the world of software development. If you have any questions or would like to share your thoughts, feel free to reach out. Your feedback and engagement are invaluable as we continue to explore and embrace the exciting innovations in the tech landscape. Thank you for joining me on this journey of discovery!