Summary

Adds two GitHub Actions workflow files (.github/workflows/ci.yml and .github/workflows/cd.yml) to replace the existing Jenkins pipelines (Jenkinsfile and GitOps/Jenkinsfile).

CI workflow (ci.yml): Triggers on push to DevOps or manual dispatch. Runs Trivy filesystem scan, OWASP dependency check, SonarQube analysis + quality gate, builds/pushes Docker image to madhupdevops/bankapp, uploads OWASP XML artifacts, and triggers the CD workflow on success.

CD workflow (cd.yml): Triggered via workflow_dispatch from CI. Updates the image tag in kubernetes/bankapp-deployment.yaml using sed, commits/pushes back to DevOps, and sends an HTML email notification.

Review & Testing Checklist for Human

• Configure all 7 required secrets in repo Settings → Secrets → Actions before running: SONAR_TOKEN, SONAR_HOST_URL, DOCKERHUB_USERNAME, DOCKERHUB_TOKEN, GH_PAT, EMAIL_USERNAME, EMAIL_PASSWORD. Workflows will fail without these.
• Verify the image name mismatch is intentional: CI pushes to madhupdevops/bankapp but CD's sed updates trainwithshubham/bankapp-eks in the K8s manifest. This mirrors the original Jenkins behavior but means CI and CD reference different image repos.
• CD will fail if sed produces no diff: If the tag already matches, git commit will exit non-zero with "nothing to commit". Consider whether a guard (git diff --quiet || git commit ...) is needed.
• Test end-to-end: Trigger CI manually via Actions → CI Pipeline → "Run workflow" with a test docker_tag. Confirm CI completes, triggers CD, CD updates the manifest, and email is received.
• GH_PAT permissions: The PAT needs repo and actions:write scopes to both trigger the CD workflow dispatch and push commits back to DevOps.

Notes

• These workflows were written to spec matching the existing Jenkins pipeline behavior. The original Jenkinsfile and GitOps/Jenkinsfile are not removed in this PR.
• Actions like aquasecurity/trivy-action@master and SonarSource/sonarqube-scan-action@master use floating @master tags per the spec — consider pinning to SHA or release tags for supply chain safety.

Link to Devin run: https://app.devin.ai/sessions/4dc347fcc128470bbc6bcb10e54ce038
Requested by: @angelalincog