Setup CICD using GitHub Part 1

1. ✅ Request a new email @devsecopsbook.com for GitHub Admin Email

• Purpose: Centralized and auditable admin access (not tied to a personal email).
• Mailbox Owner: Ideally managed by IT or a shared mailbox system (e.g., Google Workspace Group, Zoho Mail)

2. 📝 Register GitHub Admin Account

• Go to https://github.com/join
• Register using:
  • Email: GitHub Admin Email
  • Username: devsecopsbook-admin (or similar)
  • Enable 2FA immediately after creation
• This account is the sole GitHub Owner (avoid having too many owners)
• Store credentials and 2FA recovery codes in your password vault (e.g., Bitwarden, 1Password)

---

3. 🏢 Create the GitHub Organization

• Logged in as devsecopsbook-admin
• Go to: https://github.com/organizations/plan
• Choose the Free plan (for now, upgrade later if needed)
• Organization name: devsecopsbook-com
• Org URL: https://github.com/devsecopsbook-com

---

4. 🛡️ Initial Security Hardening

Apply immediately:

• Enforce 2FA for org members
  • Settings → Organization Security → Authentication Security
• Create Teams:
  • devs, devops, security, reviewers, interns
• Set least privilege access per team
• Enable Branch Protection Rules on main repos
• Turn on Dependabot Alerts
• Set up required reviewers via CODEOWNERS

---

5. 📁 Seed Initial Repositories

Examples:

• product-webapp
• product-api
• product-infra-terraform
• policies-iso27001 (internal docs + markdown)
• Use README and SECURITY.md templates