Migrate Jenkins pipeline to GitHub Actions

[devin-ai-integration]

Summary

Migrates the existing Jenkins pipelines to GitHub Actions while preserving every stage, parameter, and post-build behavior.

Two new workflows are added under .github/workflows/:

GitHub Actions workflow	Replaces	Triggers
ci.yml	Jenkinsfile (CI)	push/pull_request to DevOps, workflow_dispatch with docker_tag input
cd.yml	GitOps/Jenkinsfile (CD)	workflow_dispatch with docker_tag input (auto-invoked by ci.yml on success)

Stage-by-stage mapping

Jenkinsfile → ci.yml

Jenkins stage	GitHub Actions equivalent
Workspace cleanup (cleanWs())	implicit on ephemeral ubuntu-latest runners
Git: Code Checkout	actions/checkout@v4
Trivy: Filesystem scan (trivy fs .)	aquasecurity/trivy-action@0.35.0 (scan-type: fs)
OWASP: Dependency check	dependency-check/Dependency-Check_Action@main + actions/upload-artifact@v4 for the report
SonarQube: Code Analysis	SonarSource/sonarqube-scan-action@v3 with projectName=bankapp, projectKey=bankapp
SonarQube: Code Quality Gate (abortPipeline: false)	SonarSource/sonarqube-quality-gate-action@v1.1.0 with continue-on-error: true and a 1-minute timeout
Docker: Build Images	docker/setup-buildx-action@v3 + docker/build-push-action@v6
Docker: Push to DockerHub	same step with push: true and docker/login-action@v3 (DockerHub creds)
post.success: archiveArtifacts '*.xml'	actions/upload-artifact@v4 (xml-artifacts)
post.success: build job: 'BankApp-CD' with DOCKER_TAG	final gh workflow run cd.yml -f docker_tag=... step

GitOps/Jenkinsfile → cd.yml

Jenkins stage	GitHub Actions equivalent
Workspace cleanup	implicit on ephemeral runners
Git: Code Checkout	actions/checkout@v4 (with persist-credentials: true)
Verify: Docker Image Tags	echo "DOCKER TAG RECEIVED: …"
Update: Kubernetes manifest	sed over kubernetes/bankapp-deployment.yml (note the actual filename in the repo is .yml; the Jenkinsfile referred to .yaml)
Git: Code update and push	git commit + git push origin HEAD:<ref> using GITHUB_TOKEN
post.always: emailext	dawidd6/action-send-mail@v3, gated on vars.ENABLE_EMAIL_NOTIFICATIONS == 'true' so the workflow stays green when SMTP isn't configured

Required configuration

Add these to Settings → Secrets and variables → Actions:

• Secrets: SONAR_TOKEN, SONAR_HOST_URL, DOCKERHUB_USERNAME, DOCKERHUB_TOKEN
• Optional secrets (only when ENABLE_EMAIL_NOTIFICATIONS=true): SMTP_SERVER, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORD, NOTIFY_FROM, NOTIFY_TO
• Optional repository variables: DOCKERHUB_USER (defaults to madhupdevops), ENABLE_EMAIL_NOTIFICATIONS (true/false)

The CI workflow degrades gracefully — if SONAR_TOKEN or DOCKERHUB_TOKEN is missing, those steps are skipped instead of failing, so the workflow can be observed end-to-end before all secrets are wired up.

Behavior differences worth flagging

• The original Jenkinsfile checked out a hardcoded fork (LondheShubham153/Springboot-BankApp@DevOps); the workflow now checks out this repository's commit, which matches normal GitHub Actions semantics.
• Pull requests run the Trivy + OWASP + Sonar (when configured) steps but skip Docker build/push and the downstream CD trigger — this matches the Jenkinsfile, which was webhook/SCM-polling driven and never ran on a fork PR's behalf.
• The CD workflow only commits when the sed actually changed the manifest (git diff --quiet guard) to avoid empty commits.

Pre-existing issue surfaced (not addressed in this PR)

Dockerfile:28 references openjdk:17-alpine, which was deprecated and is no longer present on Docker Hub. The Jenkins pipeline is currently broken for the same reason; this PR does not change that, but a follow-up PR should bump the base image to e.g. eclipse-temurin:17-jre-alpine so the new Docker build/push step actually succeeds when the workflow runs on DevOps or via workflow_dispatch.

Review & Testing Checklist for Human

• Add the required secrets/variables listed above and run Actions → CI → Run workflow on DevOps with a sample docker_tag (e.g. v1); confirm Trivy + OWASP + Sonar + Docker build/push all execute and that cd.yml is auto-triggered on success.
• Verify the Docker image lands in Docker Hub under <DOCKERHUB_USER>/bankapp:<docker_tag> (requires the Dockerfile fix above).
• Manually run Actions → CD → Run workflow with a known tag and confirm kubernetes/bankapp-deployment.yml is updated and pushed back to DevOps with the github-actions[bot] author.
• Once GitHub Actions is green end-to-end, decide whether to delete Jenkinsfile, GitOps/Jenkinsfile, and vars/ (left in place for reference in this PR).
• Optional: enable email notifications by setting ENABLE_EMAIL_NOTIFICATIONS=true and the SMTP secrets, then verify a successful CD run sends mail.

Notes

• actionlint v1.7.7 was run locally over both workflows and reported zero issues.
• The Jenkinsfile parameter DOCKER_TAG maps to inputs.docker_tag. For non-dispatch triggers (push, pull_request), the workflow falls back to the short commit SHA.
• vars/*.groovy shared library functions were inlined as workflow steps — there is no GitHub Actions equivalent to a Jenkins shared library, but the bodies were small enough to make this lossless.

Link to Devin session: https://app.devin.ai/sessions/34630b47b8494d3583052d7e72dd4d15
Requested by: @vanessasalas-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring