Continuous Deployment

name: CD Pipeline

on:
  push:
    branches: [ main ]

jobs:

  # ── Stage 1: Run tests ──────────────────
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci && npm test

  # ── Stage 2: Deploy to staging (AUTO) ───
  deploy-staging:
    needs: test
    runs-on: ubuntu-latest
    environment: staging   # links to GitHub Environment
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to staging
        run: |
          echo "🚀 Deploying \${{ github.sha }} to STAGING"
          # docker pull ghcr.io/... && docker run ...
          # or: kubectl set image deployment/app app=ghcr.io/...:SHA
          # or: helm upgrade app chart/ --set image.tag=SHA

  # ── Stage 3: Production (MANUAL GATE) ───
  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment:
      name: production   # requires approval ← configured in GitHub
      url: https://myapp.example.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to production
        run: |
          echo "🌐 Deploying \${{ github.sha }} to PRODUCTION"

  # ── Stage 4: Notify team ────────────────
  notify:
    needs: [ deploy-production ]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Slack notification
        uses: slackapi/slack-github-action@v1.26.0
        with:
          payload: |
            { "text": "Deploy \${{ job.status }} — \${{ github.sha }}" }
        env:
          SLACK_WEBHOOK_URL: \${{ secrets.SLACK_WEBHOOK_URL }}

# ── Option 1: Redeploy previous SHA (Docker) ───
# Every image is tagged with its commit SHA
# Rollback = deploy the previous SHA tag
PREVIOUS_SHA=$(git log --format="%H" -n 2 | tail -1)
docker pull ghcr.io/user/myapp:sha-${PREVIOUS_SHA:0:7}
docker run -p 3000:3000 ghcr.io/user/myapp:sha-${PREVIOUS_SHA:0:7}

# ── Option 2: Kubernetes rollout undo ──────────
kubectl rollout history deployment/myapp
# REVISION  CHANGE-CAUSE
# 1         sha-a3f7c2d
# 2         sha-b4e8d3e  ← current, broken
kubectl rollout undo deployment/myapp
# → rolls back to revision 1 instantly
kubectl rollout undo deployment/myapp --to-revision=1

# ── Option 3: Feature flag (no redeploy) ───────
# Feature flags: toggle feature off in LaunchDarkly/Unleash
# Bug is in new feature → turn flag off → bug hidden
# Fix, test, turn flag back on → zero downtime

# ── Option 4: Git revert + redeploy ────────────
git revert HEAD                     # creates revert commit
git push origin main
# → triggers CI/CD → new deploy with code reverted
# slower: requires full CI run

# ── Option 5: Database rollback (careful!) ─────
# RULE: always make backward-compatible schema changes
# ADD nullable column first (both old + new app work)
# REMOVE column only after all instances are updated
# NEVER remove a column the old app still reads!

name: CD — Deploy

on:
  push:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci && npm test

  deploy-staging:
    needs: test
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Staging
        run: |
          echo "Deploying \${{ github.sha }} to STAGING"
          echo "Image: ghcr.io/\${{ github.repository }}:sha-\${{ github.sha }}"
          echo "✅ Staging deploy complete"

  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://myapp.example.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Production
        run: |
          echo "Deploying \${{ github.sha }} to PRODUCTION"
          echo "Image: ghcr.io/\${{ github.repository }}:sha-\${{ github.sha }}"
          echo "🌐 Production deploy complete"
      - name: Smoke test
        run: |
          echo "Running smoke tests..."
          echo "✅ App healthy at \${{ env.APP_URL }}"

  notify:
    needs: [ deploy-production ]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo "Deploy status: \${{ needs.deploy-production.result }}"
          echo "SHA: \${{ github.sha }}"
          echo "Actor: \${{ github.actor }}"

──── git push origin feat/x ─────────────────

ci.yml:
  ├─ lint (ESLint, Husky)
  └─ test (matrix Node 18+20)

──── git merge → main ───────────────────────

test.yml:
  └─ jest --coverage (70% gate)

docker.yml:
  └─ docker build + push to GHCR
     ghcr.io/user/app:sha-abc1234
     ghcr.io/user/app:latest

deploy.yml:
  ├─ test (regression check)
  ├─ deploy-staging  ← AUTO (no gate)
  │   └─ "✅ sha-abc1234 → staging"
  ├─ [⏸ WAITING FOR APPROVAL]
  ├─ deploy-production ← GATED
  │   └─ "🌐 sha-abc1234 → production"
  └─ notify
      └─ Slack: "Deploy success: sha-abc1234"

──── Total time: ~8-12 minutes ──────────────
# (excluding approval wait time)

# Environment with all protection rules
jobs:
  deploy-prod:
    environment:
      name: production
      url: https://app.example.com
    # ↑ URL shown in GitHub UI after deploy
    # ↑ required reviewers set in GitHub Settings

# Environment-specific secrets
# (different from repository secrets)
# production DB_URL ≠ staging DB_URL
    env:
      DB_URL: \${{ secrets.DB_URL }}
      # → uses the DB_URL from 'production' environment
      #    not from the repo-level secrets

# Limit which branches can deploy to production
# Configured in: Settings → Environments → production
# → Deployment branches: main only
# → Prevents feature branches deploying to prod!

# Timeout the approval gate
timeout-minutes: 1440  # 24 hours max wait

# Concurrency — prevent simultaneous deploys
concurrency:
  group: production
  cancel-in-progress: false
  # → queue, don't cancel running deploys

notify:
  needs: [ deploy-production ]
  if: always()    # notify even on failure
  runs-on: ubuntu-latest
  steps:
    - name: Notify Slack — success
      if: needs.deploy-production.result == 'success'
      uses: slackapi/slack-github-action@v1.26.0
      with:
        payload: |
          {
            "text": "✅ Deployed to production",
            "blocks": [
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": "✅ *Production deploy successful*\n*SHA:* \`\${{ github.sha }}\`\n*By:* \${{ github.actor }}\n*Repo:* \${{ github.repository }}"
                }
              }
            ]
          }
      env:
        SLACK_WEBHOOK_URL: \${{ secrets.SLACK_WEBHOOK_URL }}

    - name: Notify Slack — failure
      if: needs.deploy-production.result == 'failure'
      uses: slackapi/slack-github-action@v1.26.0
      with:
        payload: |
          { "text": "❌ Production deploy FAILED — \${{ github.sha }}" }
      env:
        SLACK_WEBHOOK_URL: \${{ secrets.SLACK_WEBHOOK_URL }}

# Runs on: PR + push to main/feat/**
# Jobs: lint, test (matrix Node 18+20)
# Gate: ESLint errors block merge
# Purpose: quality gate on every PR

# Runs on: push to main + feat/**
# Jobs: jest --coverage
# Gate: 70% coverage threshold
# Purpose: no code without tests

# Runs on: push to main + git tags
# Jobs: npm audit + docker build + push
# Output: ghcr.io/user/app:sha-xxx
# Purpose: deployable artifact

# Runs on: push to main
# Jobs: test → staging → (gate) → prod → notify
# Gate: production requires approval
# Purpose: full CD