Professional work / AssetWorks LLC / 2026
Quality and security gates for a modern stack
Took CI from not running on development branches to an enforced pipeline with static analysis, dynamic scanning, load tests, and a much more reliable end-to-end suite.
In place across the web product and shared backend
- 129 / 136
- test files passing once CI first ran on dev branches
- 57 → 79
- passing end-to-end tests in one session
- ~40
- redundant logins removed from the end-to-end suite
- 4
- repositories on a standard lint and security config
The problem
The new stack was moving quickly, but CI only ran on two branches, unit tests could hang, and the end-to-end suite failed for reasons unrelated to the code under test.
My role
Set up the security and testing tooling, fixed the CI blockers, and rebuilt the end-to-end suite's structure.
What I did
Security in the pipeline
Added security lint rules, custom Semgrep rules, an OWASP ZAP baseline scan, k6 load tests, and a dependency-audit step, and replaced a vulnerable spreadsheet library. I standardized lint configuration across four repositories.
Unblock CI
Made the workflow run on every branch, fixed a high-severity dependency issue, and fixed unit tests that hung because permission gates hid the page under test.
End-to-end tests that test the product
Replaced brittle login retries with an API-first approach and self-contained test sections. That removed about 40 redundant logins, and a script migrated 46 login calls across 28 files.
Stack
- GitHub Actions
- Vitest
- Playwright
- Semgrep
- OWASP ZAP
- k6
- ESLint
- TypeScript
- Node.js