Streamlining DevSecOps Pipelines with Azure Bicep and GitHub Actions

Abstract

DevSecOps practices often face friction between development speed and security validation. This paper introduces a streamlined CI/CD pipeline integrating Azure Bicep templates for Infrastructure as Code (IaC) with GitHub Actions for automated policy enforcement. A Node.js-based e-commerce system was used to test compliance with enterprise security baselines including Azure Policy and OWASP Top 10 risks. The pipeline enforced checks during pull requests and deployment stages. Results show that 95% of misconfigurations were caught pre-deployment without delaying release cycles. This paper elaborates on the pipeline architecture, implementation steps, performance analysis, and implications for large-scale enterprise adoption. A detailed discussion follows on pipeline generalizability, organizational resistance, and tooling interoperability in cross-cloud contexts.