DevSecOps CI/CD Playbooks (GitHub Actions + Terraform)

Overview: Secure-by-default pipelines from commit to cloud, with policy-as-code and progressive delivery.
Key Capabilities: Composite Actions (lint/tests/build/SBOM/scans/provenance), Terraform modules (VPC, EKS/GKE/AKS, ingress, secrets),
OPA (conftest) policies for PR gates, canary/blue-green/preview environments.
Architecture: Matrix builds with caching; GitOps-friendly manifests; SAST/Dependency/Container scanning with SARIF reports.
Security & Compliance: Supply-chain hardening (provenance attestations), secret scanning and block-on-leak, branch protection;
templates for ISO 27001/PCI evidence.
Performance & Ops: Parallel test shards; build cache; runner sizing; rollback playbooks and incident response.
Quick Start: Copy workflows → configure OIDC/cloud creds → terraform init/apply on env modules.
Deliverables: Actions, modules, policies, examples, runbooks and compliance checklists.
FAQ: GitLab/Azure DevOps mapping guidance; self-hosted runner autoscaling recipes.