Plumber
Point Plumber at a repo and it doesn't just deploy your app to AWS with fully working plumbing. It builds an entire CI/CD pipeline with mandatory security gates, so every change ships safely and your app stays continuously deployable.
CreatePipelines
✓GitHub
2App review
3Deployment
4CI/CD
aster-ridge/checkout-api
Node.js 20 · Express · listens on 8080 · no Dockerfile yet
Dockerfile · production Dockerfile at repository rootwill add
.dockerignore · keeps node_modules, .git and local secrets out of the buildwill add
Multi-stage build · separates build and runtime layerswill add
Non-root runtime userwill add
HEALTHCHECK instruction · unhealthy tasks are caught before traffic shiftswill add
Choose where and how you deploy
Website on a custom domainStatic or server-rendered site
Containers on ECSECS Fargate behind a load balancer
Serverless APILambda behind API Gateway
Infrastructure: AWS CloudFormation · region us-east-1 · deploys through
TudovuDeployRole with GitHub OIDCGenerate the secure pipeline pull request
Build application imagebuild
Container smoke testblocking
Trivy dependency scanblocking
Semgrep policy scan (SAST)blocking
CloudFormation template lintblocking
Configure AWS for deploy (OIDC) · Deploy CloudFormation stackno stored keys
OWASP ZAP baseline (DAST) against the deployed appreport
BackContinue
| Repository | Last run | Stack |
|---|---|---|
| customer-platformTudovu Secure Pipeline | success 1 hour ago | tudovu-customer-platform-app UPDATE_COMPLETE |
| checkout-apiTudovu Secure Pipeline | success just now · run #2211 | tudovu-checkout-api-app UPDATE_COMPLETE |
| orders-serviceTudovu Secure Pipeline | pending runs after PR #42 merges | not deployed yet |
aster-ridge / checkout-apiPull requestsActionsSecurity
Add the Tudovu Secure Pipeline #57
⎇ Open tudovu wants to merge 1 commit into
main from tudovu/plumber/secure-pipelineConversationCommits 1Checks 2Files changed 4
Files changed
+ Dockerfile multi-stage, non-root, HEALTHCHECK+ .dockerignore+ .github/workflows/tudovu-secure-pipeline.yml gates, then deploy with OIDC+ infra/checkout-api.yaml ECS Fargate service and load balancer
Opened on a branch; Tudovu never writes to your default branch. The workflow holds no AWS keys: deploys assume
TudovuDeployRole through GitHub OIDC, pinned to this repository's main.Merge pull request1 approval by priya-natarajan
Tudovu Secure Pipeline #2210
main · triggered by the merge of #57
build-test-securein progress
Build application imagerunning
Container smoke testqueued
Trivy dependency scan (blocking)queued
Semgrep policy scan (SAST)queued
CloudFormation template lintqueued
Deploy CloudFormation stackqueued
OWASP ZAP baseline (DAST)queued
Trivy dependency scan failed: 1 CRITICAL vulnerability with a fixed version available. The image never reached ECR and nothing was deployed.
priya-natarajan pushed 1 commit to main: Upgrade the vulnerable dependency to its fixed version
Plumber.
A CI/CD pipeline with the security gates already in it.
Ship through the gates, not around them.
Start free in about five minutes, with no card.
Choose a feature to watch next
0:00 / 0:00