CI/CD — Delivery Engineering

Commit → [Lint] → [Unit Test] → [Build] → [Security Scan] → [Integration Test] → [Push Artifact] → [Deploy Staging] → [Deploy Production]
          ↑ fast                            ↑ parallel possible                    ↑ gate here ↑                         ↑ manual approval?

# GitHub Actions example
name: CI/CD Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck

  test:
    runs-on: ubuntu-latest
    needs: lint          # only run if lint passes
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm test
        env:
          DATABASE_URL: postgres://postgres:test@localhost:5432/test

  build-and-push:
    runs-on: ubuntu-latest
    needs: test
    if: github.ref == 'refs/heads/main'   # only on main branch
    permissions:
      id-token: write   # for OIDC auth to AWS
      contents: read
    steps:
      - uses: actions/checkout@v4
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-role
          aws-region: us-east-1
      - name: Build and push to ECR
        run: |
          IMAGE_TAG="${{ github.sha }}"
          docker build -t myapp:$IMAGE_TAG .
          docker push 123456789012.dkr.ecr.us-east-1.amazonaws.com/myapp:$IMAGE_TAG

# Reproducible builds — always specify exact versions
- name: Build Docker image
  run: |
    docker build \
      --build-arg BUILD_DATE=$(date -u +%Y-%m-%dT%H:%M:%SZ) \
      --build-arg GIT_SHA=${{ github.sha }} \
      --build-arg VERSION=${{ github.ref_name }} \
      -t myapp:${{ github.sha }} \
      .

# Run tests with coverage
- name: Run tests
  run: npm test -- --coverage --ci

- name: Upload coverage
  uses: codecov/codecov-action@v4

# Security scanning — multiple layers
- name: Scan dependencies for vulnerabilities
  run: npm audit --audit-level=high

- name: Scan Docker image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: myapp:${{ github.sha }}
    severity: 'CRITICAL,HIGH'
    exit-code: '1'    # fail pipeline if found

- name: Scan for secrets in code
  uses: trufflesecurity/trufflehog@main
  with:
    path: ./

# Tag with both git SHA (immutable) and version tag
- name: Tag and push artifact
  run: |
    GIT_SHA="${{ github.sha }}"
    VERSION="1.2.3"

    docker tag myapp:$GIT_SHA myrepo/myapp:$GIT_SHA
    docker tag myapp:$GIT_SHA myrepo/myapp:$VERSION
    docker tag myapp:$GIT_SHA myrepo/myapp:latest

    docker push myrepo/myapp:$GIT_SHA   # immutable reference
    docker push myrepo/myapp:$VERSION
    docker push myrepo/myapp:latest

# Store build artifacts
- name: Upload build artifacts
  uses: actions/upload-artifact@v4
  with:
    name: build-artifacts
    path: ./dist/
    retention-days: 30

# WRONG — secrets in code, in logs, in history
- run: docker login -u myuser -p mysecretpassword123

env:
  API_KEY: sk-live-abc123   # visible in git history forever

# Use GitHub Secrets
- run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin

# Use OIDC (no long-lived credentials at all)
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123456789012:role/github-actions
    aws-region: us-east-1
    # GitHub gets temporary credentials via OIDC — no secrets stored anywhere

Before: [v1] [v1] [v1] [v1]
Step 1: [v2] [v1] [v1] [v1]
Step 2: [v2] [v2] [v1] [v1]
Step 3: [v2] [v2] [v2] [v1]
After:  [v2] [v2] [v2] [v2]

# Kubernetes rolling update (default)
spec:
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1          # create 1 extra pod before removing old
      maxUnavailable: 0    # never reduce capacity during update

Blue (v1):  [LB] → [v1] [v1] [v1]   ← receives traffic
Green (v2): [   ]   [v2] [v2] [v2]  ← idle, being deployed

Switch:
Blue (v1):  [   ]   [v1] [v1] [v1]  ← idle (kept for rollback)
Green (v2): [LB] → [v2] [v2] [v2]  ← now receives traffic

v1: ████████████████████ 95% traffic
v2: █                    5% traffic  ← canary

Monitor metrics... if healthy:

v1: ████████████         50% traffic
v2: ████████████         50% traffic

Continue until...

v1:                      0%
v2: ████████████████████ 100%

# Allow a step to fail without failing the whole pipeline
- name: Optional security scan
  run: trivy image myapp:latest
  continue-on-error: true

# Retry on flaky steps
- name: Integration tests
  run: npm run test:integration
  timeout-minutes: 10

# Notifications on failure
- name: Notify on failure
  if: failure()
  uses: slackapi/slack-github-action@v1
  with:
    payload: |
      {
        "text": "Pipeline failed on ${{ github.repository }} (${{ github.sha }})"
      }

# Always upload test results
- name: Upload test results
  uses: actions/upload-artifact@v4
  if: always()   # upload even on failure
  with:
    name: test-results
    path: |
      ./test-results/
      ./coverage/

# Annotate failures with test details
- uses: dorny/test-reporter@v1
  if: always()
  with:
    name: Test Results
    path: test-results/*.xml
    reporter: java-junit

# Track deployment in external system
- name: Create deployment record
  uses: chrnorm/deployment-action@v2
  with:
    token: ${{ secrets.GITHUB_TOKEN }}
    environment: production
    ref: ${{ github.sha }}