//stacktales
EN

//TUTORIAL

A Secure CI/CD Pipeline with Go, GitHub Actions, Vault, and Dokploy

I built a CI/CD pipeline that puts security in the path automatically, from pull request to production: scanners that block merges, secrets from Vault, an image built once and promoted, and a CI job that gets its token through OIDC. Free tools only.

Intermediate10 partsEstimated 3 hr 7 min
Start from part 1

Prerequisites

Basic Git and GitHub, some Docker and Docker Compose, the ability to read simple Go, and a VPS running Dokploy plus a HashiCorp Vault server (or the willingness to set one up).

Contents

  1. 01Part 1: Why I Built a Secure CI/CD Pipeline, and Getting the Tools Ready
  2. 02Part 2: Vault Secrets, Policies, and an AppRole per Environment
  3. 03Part 3: A Small Go App That Reads Its Secrets from a File and Refuses to Start on Bad Config
  4. 04Part 4: A Vault Agent Sidecar and Docker Compose, Secrets Without the App Knowing Vault Exists
  5. 05Part 5: The GitHub Repo and the PR Workflow as a Security Gate
  6. 06Part 6: Rulesets That Block Merges, and Five Demo PRs That Must Fail
  7. 07Part 7: Setting Up the Dev and Production Environments in Dokploy
  8. 08Part 8: The Deploy Workflow, Build Once, Scan, SBOM, GHCR, Then Promote to Production
  9. 09Part 9: An Exception Process for Security Findings You Can't Fix Yet
  10. 10Part 10: CI Gets Its Dokploy Token from Vault through GitHub OIDC, and Wrapping Up the Series