Building a Spring Boot Monolith Application and a DevSecOps Pipeline Around It

A lot of CI/CD tutorials show a simple “Hello World” app and a Jenkins job that prints Build Successful. That never felt close to how systems work in real environments. At least, they never helped me.

So I decided to build a small University Management Spring Boot monolith application with JWT authentication and protected APIs, and then build a complete pipeline around it — from source control to deployment, quality checks, security scans, artifact management and validation. Since I'm not a developer, the code itself isn't great it was just me exploring a new language along with some help from AI (Needless to say!)

The application itself is intentionally simple:

• JWT-based authentication (/auth/login)


• Protected APIs (/students)


• Spring Security integration


• Maven build and Docker packaging

The goal wasn't to show how to build an application (In that case, this would be the worst tutorial). Th goal is, to show a CI/CD(partly) flow to someone in less than 15 minutes.

So I created a mini DevSecOps pipeline that includes:

• GitHub webhooks


• Jenkins Controller + Agent


• SonarQube quality gates


• Docker image creation


• Trivy security scans


• Nexus artifact storage


• Automated deployment using Docker Compose

Just incase, anyone's interested in the code, it stays

The App:

• The build generates a jar file, which is quite famously referred to as the artifact.


• Now, this artifact is scanned by our quality gates which checks it for any code smells, Bugs, Vulnerabilities, etc.

My 2 cents: Do not forget to add Jenkins call back in Sonarqube, else the job in Jenkins will wait to get the status from sonarqube and will eventually timeout.

• If our code passes quality gates, we build the docker image and bake the artifact into the image.

• Additionally, I also posted the scan results on a nexus repository with the job number appended.

• This is the smallest CD part of the pipeline where we bring up the app using the image we built earlier using docker-compose.

Future enhancements: I must admit, this document is incomplete without :

• converting this to a microservice


• Moving the application to K8s or Openshift.


• Adding monitoring for our App.