CI/CD Pipelines

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs: test: runs-on: ubuntu-latest services: postgres: image: postgres:16 env: { POSTGRES_PASSWORD: test, POSTGRES_DB: testdb } options: >- --health-cmd pg_isready --health-interval 5s --health-timeout 5s --health-retries 5 steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: { node-version: 20, cache: npm } - run: npm ci - run: npm run lint - run: npm test -- --coverage env: { DATABASE_URL: postgres://postgres:test@localhost/testdb } - uses: codecov/codecov-action@v4

build-and-push: needs: test if: github.ref == 'refs/heads/main' runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: aws-actions/configure-aws-credentials@v4 with: aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} aws-region: us-east-1 - uses: aws-actions/amazon-ecr-login@v2 - run: | docker build -t $ECR_REGISTRY/myapp:$GITHUB_SHA . docker push $ECR_REGISTRY/myapp:$GITHUB_SHA

deploy: needs: build-and-push environment: production runs-on: ubuntu-latest steps: - run: | aws ecs update-service \ --cluster production \ --service api \ --force-new-deployment ```

Fast feedback loop:
• Fail fast: put quickest checks first (lint → unit → integration → E2E)
• Parallelize independent jobs
• Cache dependencies (npm/pip/maven packages)
• Target: CI under 5 minutes

Environments & Promotion: `` commit → [CI: test + lint + build] → staging deploy → smoke tests → prod deploy ``

Deployment strategies: | Strategy | Downtime | Risk | Rollback | |---|---|---|---| | Recreate | Yes | High | Redeploy old | | Rolling | No | Medium | Roll back version | | Blue/Green | No | Low | Instant (flip LB) | | Canary | No | Very low | Stop canary traffic |

Security in CI/CD:
• Never commit secrets use GitHub Secrets / Vault
• Scan dependencies: npm audit, Snyk
• Static analysis: SonarQube, CodeQL
• Container scanning: Trivy, Grype
• Signed commits and tags for release artifacts