OpenShift CI/CD with GitHub Actions

Learn how to build a complete CI/CD pipeline for Spring Boot applications using GitHub Actions and OpenShift. Understand automated builds, testing, Docker image creation, image scanning, deployment, and enterprise DevSecOps best practices.

Introduction

Modern software development is no longer about manually building and deploying applications.

Enterprise organizations automate the entire software delivery lifecycle using Continuous Integration (CI) and Continuous Deployment (CD).

For a Spring Boot application deployed on OpenShift, every code change should automatically:

Build the application
Run unit tests
Create a Docker image
Scan the image for vulnerabilities
Push the image to a registry
Deploy to OpenShift
Verify the deployment
Notify the development team

GitHub Actions provides a cloud-native automation platform that integrates seamlessly with GitHub repositories and OpenShift.

Learning Objectives

By the end of this article, you will understand:

What is CI/CD?
GitHub Actions architecture
GitHub Actions workflow
Building Spring Boot applications
Docker image creation
Image scanning
Deploying to OpenShift
Environment promotion
Enterprise DevSecOps best practices

What is CI/CD?

Continuous Integration (CI)

Build automatically
Execute unit tests
Validate code quality
Detect issues early

Continuous Deployment (CD)

Build Docker image
Deploy automatically
Verify deployment
Rollback if needed

CI/CD Architecture

flowchart LR
    A[Developer]
    B[GitHub Repository]
    C[GitHub Actions]
    D[Maven Build]
    E[Docker Build]
    F[Image Scan]
    G[Container Registry]
    H[OpenShift Cluster]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H

Complete Deployment Workflow

sequenceDiagram
    participant Dev as Developer
    participant GitHub
    participant Actions
    participant Registry
    participant OpenShift

    Dev->>GitHub: Push Code
    GitHub->>Actions: Trigger Workflow
    Actions->>Actions: Build & Test
    Actions->>Registry: Push Image
    Registry->>OpenShift: Deploy Image
    OpenShift-->>Dev: Deployment Successful

CI/CD Pipeline Stages

flowchart LR
    A[Git Push]
    B[Compile]
    C[Test]
    D[Package]
    E[Docker Build]
    F[Image Scan]
    G[Push Registry]
    H[Deploy OpenShift]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H

Project Structure

springboot-payment-api/

├── src/

├── Dockerfile

├── pom.xml

├── deployment.yaml

├── service.yaml

└── .github/
    └── workflows/
        └── openshift.yml

GitHub Repository Secrets

Store credentials securely.

Secret	Purpose
OPENSHIFT_SERVER	API URL
OPENSHIFT_TOKEN	Login Token
REGISTRY_USERNAME	Registry User
REGISTRY_PASSWORD	Registry Password

Never commit credentials into Git.

Maven Build

- name: Build Application

  run: mvn clean package

Run Unit Tests

- name: Run Tests

  run: mvn test

Always stop the pipeline if tests fail.

Build Docker Image

- name: Build Image

  run: |
    docker build \
    -t quay.io/company/payment:${{ github.sha }} .

Docker Build Architecture

flowchart LR
    A[Spring Boot Source]
    B[Maven Package]
    C[Docker Build]
    D[Container Image]

    A --> B
    B --> C
    C --> D

Image Scanning

Example using Trivy.

- name: Scan Image

  run: |
    trivy image \
    quay.io/company/payment:${{ github.sha }}

Critical vulnerabilities should fail the pipeline.

Push Image

- name: Push Image

  run: |
    docker push \
    quay.io/company/payment:${{ github.sha }}

Registry Architecture

flowchart LR
    A[GitHub Actions]
    B[Container Image]
    C[Quay Registry]
    D[OpenShift]

    A --> B
    B --> C
    C --> D

Login to OpenShift

- name: Login OpenShift

  run: |
    oc login \
    --token=${{ secrets.OPENSHIFT_TOKEN }} \
    --server=${{ secrets.OPENSHIFT_SERVER }}

Deploy Application

- name: Deploy

  run: |
    oc apply -f deployment.yaml
    oc apply -f service.yaml
    oc apply -f route.yaml

Update Image

- name: Update Image

  run: |
    oc set image deployment/payment-api \
    payment-api=quay.io/company/payment:${{ github.sha }}

Deployment Architecture

flowchart LR
    A[GitHub Actions]
    B[OpenShift API]
    C[Deployment]
    D[ReplicaSet]
    E[Pods]

    A --> B
    B --> C
    C --> D
    D --> E

Verify Deployment

- name: Verify

  run: |
    oc rollout status deployment/payment-api

Rollback

oc rollout undo deployment/payment-api

Environment Promotion

flowchart LR
    A[Development]
    B[QA]
    C[UAT]
    D[Production]

    A --> B
    B --> C
    C --> D

Each environment should require approval before promotion.

Branch Strategy

Branch	Environment
feature/*	Development
develop	Dev Cluster
release/*	QA
main	Production

Enterprise Banking Pipeline

flowchart LR
    A[Developer]
    B[GitHub]
    C[GitHub Actions]
    D[SonarQube]
    E[Trivy]
    F[Quay]
    G[OpenShift Dev]
    H[OpenShift QA]
    I[OpenShift Production]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H
    H --> I

Deployment Gates

Before Production deployment:

Code Review
Unit Tests
Integration Tests
Security Scan
Image Scan
Manual Approval

Notifications

Notify developers after deployment.

Examples:

Microsoft Teams
Slack
Email
GitHub Comments

Complete DevSecOps Pipeline

flowchart LR
    A[Code Commit]
    B[Build]
    C[Test]
    D[Static Code Analysis]
    E[Docker Build]
    F[Image Scan]
    G[Push Registry]
    H[Deploy]
    I[Health Check]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G
    G --> H
    H --> I

Useful OpenShift Commands

oc login

Deploy

oc apply -f deployment.yaml

View Pods

oc get pods

Check Rollout

oc rollout status deployment/payment-api

Rollback

oc rollout undo deployment/payment-api

Common Problems

Build Failed

Possible causes:

Compilation errors
Missing dependencies
Failed unit tests

Docker Build Failed

Verify:

Dockerfile
Image name
Registry credentials

Deployment Failed

Verify:

oc describe pod

Check:

Events
Image Pull
Secrets
ConfigMaps

Image Pull Error

Check:

Registry credentials
Image name
Image tag

Production Best Practices

Use GitHub Secrets.
Never hardcode credentials.
Run automated tests.
Perform image scanning.
Deploy immutable images.
Use rolling deployments.
Tag every image.
Enable rollback.
Protect the main branch.
Require pull request approvals.

Common Mistakes

❌ Deploying directly from a developer laptop.

❌ Skipping automated testing.

❌ Ignoring vulnerability reports.

❌ Using the latest image tag in production.

❌ Storing OpenShift tokens in source code.

Advantages

Fully automated deployments
Faster releases
Improved software quality
Secure DevSecOps pipeline
Repeatable deployments
Easy rollback
Better collaboration
Enterprise-ready CI/CD

Summary

GitHub Actions provides a powerful and flexible CI/CD platform for deploying Spring Boot applications to OpenShift.

Key takeaways:

Automate build, test, scan, and deployment workflows.
Secure credentials using GitHub Secrets.
Scan container images before deployment.
Use immutable image tags and rolling deployments.
Integrate quality gates and approvals for production releases.
Combine GitHub Actions with OpenShift to build a secure and reliable enterprise CI/CD pipeline.

Interview Questions

What is the difference between CI and CD?
How do GitHub Actions integrate with OpenShift?
Why should credentials be stored in GitHub Secrets?
What are the typical stages of a CI/CD pipeline?
Why is image scanning important?
How do you update a Deployment with a new image?
What is a rolling deployment?
Why should production avoid the latest image tag?
How do you roll back a failed deployment?
What are the best practices for CI/CD in OpenShift?