Migrate Jenkins CI/CD Pipelines to GitHub Actions

[devin-ai-integration]

Summary

Adds two GitHub Actions workflow files (.github/workflows/ci.yml and .github/workflows/cd.yml) to replace the existing Jenkins pipelines (Jenkinsfile and GitOps/Jenkinsfile).

CI workflow (ci.yml): Triggers on push to DevOps or manual dispatch. Runs Trivy filesystem scan, OWASP dependency check, SonarQube analysis + quality gate, builds/pushes Docker image to madhupdevops/bankapp, uploads OWASP XML artifacts, and triggers the CD workflow on success.

CD workflow (cd.yml): Triggered via workflow_dispatch from CI. Updates the image tag in kubernetes/bankapp-deployment.yaml using sed, commits/pushes back to DevOps, and sends an HTML email notification.

Review & Testing Checklist for Human

• Configure all 7 required secrets in repo Settings → Secrets → Actions before running: SONAR_TOKEN, SONAR_HOST_URL, DOCKERHUB_USERNAME, DOCKERHUB_TOKEN, GH_PAT, EMAIL_USERNAME, EMAIL_PASSWORD. Workflows will fail without these.
• Verify the image name mismatch is intentional: CI pushes to madhupdevops/bankapp but CD's sed updates trainwithshubham/bankapp-eks in the K8s manifest. This mirrors the original Jenkins behavior but means CI and CD reference different image repos.
• CD will fail if sed produces no diff: If the tag already matches, git commit will exit non-zero with "nothing to commit". Consider whether a guard (git diff --quiet || git commit ...) is needed.
• Test end-to-end: Trigger CI manually via Actions → CI Pipeline → "Run workflow" with a test docker_tag. Confirm CI completes, triggers CD, CD updates the manifest, and email is received.
• GH_PAT permissions: The PAT needs repo and actions:write scopes to both trigger the CD workflow dispatch and push commits back to DevOps.

Notes

• These workflows were written to spec matching the existing Jenkins pipeline behavior. The original Jenkinsfile and GitOps/Jenkinsfile are not removed in this PR.
• Actions like aquasecurity/trivy-action@master and SonarSource/sonarqube-scan-action@master use floating @master tags per the spec — consider pinning to SHA or release tags for supply chain safety.

Link to Devin run: https://app.devin.ai/sessions/4dc347fcc128470bbc6bcb10e54ce038
Requested by: @angelalincog

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring