Check out the visualization project that I built during my tenure at Splunk.

• Combating human trafficking using data scraping and Microsoft Azure Face with Global Emancipation Network.
• Detecting wildfires using IoT ground sensors alongside the Moraga-Orinda Fire District of CA.
• Tracking refugees and connectivity via Cisco Meraki devices with NetHope.
• Optimizing city tree maintenance using machine learning with San Francisco Public Works.

My other code and projects: GitHub

Automated GitHub Actions workflows:

• ci-cd.yaml: Executes the CI/CD pipeline on pull requests and branch merges to main.
  Click any job (e.g., ✅ misspell) for details or scroll horizontally to view all jobs.
  • Security scanning (codeql, syft-grype, and stackhawk) and lighthouse performance audits are deferred during PRs to optimize pipeline speed and run only upon merging to main.

• drift-detection.yaml: Runs daily tofu plan checks to catch Cloudflare state drift and trigger GitHub issues. See Infrastructure as Code for details.

Automated Node.js scripts using Puppeteer (a headless Chrome browser automation library):

• generate-resume-pdf.js: Renders the HTML resume as a PDF during the build job to keep public downloads in sync with source updates.
• generate-lighthouse-scores.js: Screenshots the Lighthouse audit ring score and passes the scores to this page during the lighthouse job for every build.

Visual Studio Code IDE extensions (including Neovim)

• Prettier*
• Stylelint*
• ESLint* including eslint-plugin-security
• HTML-validate*

Pre-commit hooks (view .pre-commit-config.yaml)

• Identical to the VS Code extensions above*
• Actionlint*
• Betterleaks

CI workflow jobs

• Identical to the pre-commit hooks above*
• Every CI linting job (except html-validate) uses ReviewDog wrappers to post findings as inline PR comments.

Secret scanner

• Betterleaks : Runs as a dedicated CI job to scan repository history

SBOM (view sbom.cyclonedx.json)

• Syft: Catalogs dependencies into a CycloneDX manifest

SCA

• Grype: Scans Syft's SBOM and reports findings via SARIF
• Renovate† : Proactive dependency updates via automated PRs
• npm audit: Fails CI on high/critical package-lock.json vulnerabilities

SAST

• Semgrep†: Lightweight, fast pattern matching for PR feedback
• CodeQL: Deep semantic data-flow analysis

DAST

• StackHawk: Scans live Cloudflare Pages preview deployments post-release

AI Code Review

• CodeRabbit†: Automated PR summaries and context-aware code reviews

Edge security & response hardening

• Enforces CSP, HSTS, X-Frame-Options, and protective headers across all endpoints to prevent XSS, clickjacking, and MIME-sniffing.
• Managed through OpenTofu rulesets for the production domain (hobbes3.com) and a repository _headers file for *.pages.dev preview environments outside the primary DNS zone.

Zero trust

• Restricts preview deployments (*.pages.dev) via identity-gated access (either a GitHub SSO login or an email one-time PIN) while keeping production public through OpenTofu rulesets.
• Still allows StackHawk to scan the preview deployments via Cloudflare access service tokens.

GitHub repository secrets

• Encrypts API tokens and securely injects them into GitHub Actions workflows at runtime as environment variables.
  • CLOUDFLARE_API_TOKEN for deploying Pages and detecting configuration drifts
  • AWS_ACCESS_KEY_ID for Cloudflare R2 buckets
  • AWS_SECRET_ACCESS_KEY
  • HAWK_API_KEY for StackHawk job
  • CF_ACCESS_CLIENT_ID* for StackHawk to bypass Cloudflare zero trust
  • CF_ACCESS_CLIENT_SECRET

terraform.tfvars

• Defines sensitive variables for local OpenTofu runs while keeping secrets out of the repository via .gitignore.
  • cloudflare_api_token for running tofu commands to modify Cloudflare configurations
  • github_client_secret for GitHub SSO in zero trust

This repository uses OpenTofu to declaratively manage all Cloudflare infrastructure for hobbes3.com and its subdomains (www, resume, fec).

Declarative infrastructure (view main.tf)

• Defines Cloudflare resources, including Pages projects, custom domains, DNS records, edge security headers, zero trust, and redirect rules.

Cloudflare R2 buckets

• Stores the terraform.tfstate file in a private R2 bucket with native state locking enabled for security, state persistence, and concurrent execution safety.

Automated CI/CD (view drift-detection.yaml)

• Runs a daily scheduled tofu plan check against Cloudflare API configurations to detect state drift and automatically open GitHub issues for remediation.

Lighthouse is Google's automated tool for measuring web performance, accessibility, and SEO.

Click the score above to view the latest Lighthouse audit report. The ring score and metrics are generated on every page build by a Node.js script.
Captured on .