CI/CD Automation Engineer – Build workflow templates, GitHub Actions, Docker deployable by clients

Detailed Upwork Job Post QG v2 Job Title: CI/CD Automation Engineer – Build & Productize Custom Source Code Discovery Pipeline About the Project: I have developed a functional source code analysis engine (codename: DiscoveryScan) that inspects codebases for specific patterns and assets. The core logic is already built. I now need a skilled automation engineer to build the complete delivery system around it. The mission is to turn this engine into a production‑ready, self‑service scanning tool that lives inside GitHub and GitLab, +, runs automatically on every push or pull request, and outputs standardized artifacts. The final deliverable will be a repeatable, deployable solution that can be demonstrated to potential customers. Important: The tool’s exact detection domain is proprietary. You do not need to understand the detection logic – only how to package, run, and report its output. All detection rules are provided as a black‑box script or binary. Scope of Work – What You Will Build Component What You Will Implement GitHub Action Create a custom GitHub Action that invokes the scanner, passes the repo contents, and returns scan results. GitLab CI Job Template Build a reusable scan job template for .gitlab-ci.yml. Orchestration Develop scripts to install dependencies, invoke the scanner, and capture machine‑readable output. Artifact Handling Design a unified JSON artifact format storing every finding, plus a human‑readable markdown summary. Wrapper Scripts & Dockerization Build a lightweight Docker image packaging the scanner and its dependencies. Runner Configuration Test the integration on ephemeral GitHub/GitLab runners. Pull Request Integration Implement automatic PR commenting, failure annotations (GitHub Checks), and job summaries in GitLab MRs. Basic Dashboard Create a minimal HTML dashboard that parses the artifact and displays a findings summary, plus a JSON export. Customer Demo Kit Build a sandbox repo with deliberately vulnerable (but generic) example code to showcase the tool's detection. Qualifications – What You Need to Bring (my best estimate at this time) · 3+ years of experience with CI/CD pipeline development (GitHub Actions and GitLab CI). · Strong scripting proficiency (Python and Bash). · Experience building GitHub Actions from scratch (container actions or JavaScript actions). · Familiarity with Docker and container registries. · Solid understanding of artifact management and workflow orchestration. · Ability to produce clean, maintainable, well‑documented code. · Bonus: prior work on developer tooling, scanning integrations, or commercial productization. What Success Looks Like 1. A potential customer can install the scanner by copying a few lines into their .github/workflows/ folder or .gitlab-ci.yml. 2. Every push to a protected branch or pull request triggers a scan. 3. Results appear as job annotations, downloadable JSON artifacts, and a unified markdown summary. 4. The detection engine remains entirely under our control – no external API calls, no data leaves the customer's runner. Budget & Timeline · Budget: TBD · Timeline: 4 weeks · Milestone payments: · GitHub Action completion (25%) · GitLab CI integration (25%) · Artifact format + dashboard (25%) · Final delivery, docs, demo kit (25%) How to Apply Please include the word “QNIRVANA” at the top of your proposal. Then briefly describe: 1. One GitHub Action you have built from scratch and one GitLab CI pipeline you have designed. 2. Your approach to delivering a reusable, installable scanner that runs in both platforms. 3. Your availability and estimated timeline. --- Path to Commercialization (Generic) Once the pipeline is built, the tool becomes a sellable product without ever revealing its detection internals. · Self‑Service Installation: Customers add a short workflow snippet – no complex agent deployment. · Standalone Engine: The scanner runs entirely in their infrastructure, respecting compliance and data privacy. Leverages all of the available onprem GitHub or GitLab security capabilities. · Standardized Output: JSON artifact, text files · Proof‑of‑Value Kit: The demo repository allows sales engineers to run live demonstrations in a customer’s own environment. Potentially, What Comes After This Hire (broad estimates at this time) 1. Packaging & Licensing: Add a simple license key mechanism. 2. Managed Policy Repository: Offer curated rule updates as a subscription. 3. A support agreement By completing this work, you will own the delivery pipeline that transforms a proprietary detection engine into a product that can be installed, demonstrated, and sold to enterprise.