If your CI/CD pipeline passes on the first try, are you even doing DevOps?

I recently set out to build a clean, secure portfolio pipeline (secure-shop-demo) combining GitHub Actions, Docker, Trivy, and Terraform. I figured it would take an afternoon. Instead, I spent hours debugging quirky edge cases that tutorials gloss over.

If you're building something similar, you might run into these exact same hurdles. Here is how I solved them.

1. Committing node_modules by Accident
Classic beginner mistake: I accidentally pushed a local node_modules directory into git tracking, which instantly polluted container builds and threw off dependency scans.

The Lesson: Always check your .gitignore before initializing. To clean it up without deleting local work, I had to run:

Bash git rm -r --cached src/node_modules

2. Trivy Being Too Good at Its Job
Adding container vulnerability scanning is great until your build breaks because of an upstream Alpine OS vulnerability (libcrypto3) that you didn't even write code for.

The Lesson: Configure your scanner intentionally. By scoping Trivy to target library dependencies (vuln-type: 'library'), I filtered out background OS noise and kept the focus squarely on application-level security. Also, swapping npm install for npm ci in my multi-stage Dockerfile ensured deterministic, clean builds every time.

3. The Terraform Cryptographic Headache
Trying to initialize Terraform in a fresh runner environment resulted in this lovely surprise:

Plaintext
Error while installing hashicorp/aws: error checking signature: openpgp: key expired
The Lesson: Older Terraform runner images can trip over expired registry GPG signing keys. Bumping the setup action to use a modern Terraform CLI version (1.9.5) fixed the underlying crypto verification bug immediately.

Summary Checklist for a Healthy Pipeline

  • Keep local build artifacts out of version control.

  • Use npm ci in your Dockerfiles for reproducible builds.

  • Pin your Terraform and provider versions to stable releases.

  • Use provider skip-flags if you're validating infrastructure plans with mock credentials in CI.

Have you hit any weird pipeline bugs lately? Let me know in the comments how you fixed them!