My CI/CD Pipeline: GitHub Actions Zero-Downtime

1. Lint & Format (parallel)
   ↓
2. Test (parallel, matrix strategy)
   ↓
3. Build Docker Image (once, cached layers)
   ↓
4. Push to Registry
   ↓
5. Deploy (pull image → health check → swap → old container stop)
   ↓
6. Notify on Success/Failure

name: CI/CD

on:
  push:
    branches:
      - main
      - develop
  pull_request:
    branches:
      - main

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
  NODE_VERSION: "20"

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 9

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Lint
        run: pnpm lint

      - name: Format check
        run: pnpm format:check

  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: ["18", "20"]
    steps:
      - uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v2
        with:
          version: 9

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: "pnpm"

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run tests
        run: pnpm test --coverage

      - name: Upload coverage
        uses: codecov/codecov-action@v3
        with:
          files: ./coverage/coverage-final.json

  build:
    needs: [lint, test]
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          push: ${{ github.event_name == 'push' }}
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    needs: build
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4

      - name: Deploy to production
        env:
          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
          DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }}
          IMAGE_TAG: ${{ needs.build.outputs.image-tag }}
        run: |
          mkdir -p ~/.ssh
          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H $DEPLOY_HOST >> ~/.ssh/known_hosts

          ssh -i ~/.ssh/deploy_key deploy@$DEPLOY_HOST \
            "cd /app && ./deploy.sh $IMAGE_TAG"

      - name: Notify on failure
        if: failure()
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: 'Deploy failed. Check logs: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
            })

FROM node:20-alpine AS base
RUN npm install -g pnpm
WORKDIR /app

FROM base AS dependencies
COPY pnpm-lock.yaml .
COPY package.json .
RUN pnpm install --frozen-lockfile --prod

FROM base AS builder
COPY pnpm-lock.yaml .
COPY package.json .
RUN pnpm install --frozen-lockfile
COPY . .
RUN pnpm build

FROM base AS runtime
COPY --from=dependencies /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/package.json .

EXPOSE 3000
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD node -e "require('http').get('http://localhost:3000/health', (r) => {if (r.statusCode !== 200) throw new Error(r.statusCode)})"

CMD ["node", "dist/server.js"]

#!/bin/bash
set -e

IMAGE_TAG=$1
REGISTRY=ghcr.io/yourorg/yourapp
CONTAINER_NAME=myapp
PORT=3000
HEALTH_URL=http://localhost:$PORT/health

# Pull new image
docker pull $REGISTRY:$IMAGE_TAG
echo "✔ Image pulled"

# Start new container on different port
docker run -d \
  --name ${CONTAINER_NAME}_new \
  -p 3001:3000 \
  -e DATABASE_URL=$DATABASE_URL \
  -e REDIS_URL=$REDIS_URL \
  $REGISTRY:$IMAGE_TAG

echo "✔ New container started on port 3001"

# Wait for health check
MAX_ATTEMPTS=30
ATTEMPT=0
while [ $ATTEMPT -lt $MAX_ATTEMPTS ]; do
  if curl -f http://localhost:3001/health >/dev/null 2>&1; then
    echo "✔ Health check passed"
    break
  fi
  ATTEMPT=$((ATTEMPT + 1))
  sleep 1
  if [ $ATTEMPT -eq $MAX_ATTEMPTS ]; then
    echo "✗ Health check failed. Cleaning up."
    docker stop ${CONTAINER_NAME}_new
    docker rm ${CONTAINER_NAME}_new
    exit 1
  fi
done

# Swap ports (or use load balancer / reverse proxy)
docker stop $CONTAINER_NAME || true
docker rm $CONTAINER_NAME || true
docker rename ${CONTAINER_NAME}_new $CONTAINER_NAME

echo "✔ Deploy complete"
docker ps --filter "name=$CONTAINER_NAME" --format "{{.Names}} {{.Status}}"

- name: Deploy
  env:
    DATABASE_URL: ${{ secrets.DATABASE_URL }}
    REDIS_URL: ${{ secrets.REDIS_URL }}
  run: ./deploy.sh

deploy:
  needs: build
  environment: production
  steps:
    - name: Deploy
      run: ./deploy.sh

- name: Tag image
  run: |
    VERSION=$(git describe --tags --always)
    docker tag $IMAGE:latest $IMAGE:$VERSION
    docker push $IMAGE:$VERSION

test:
  strategy:
    matrix:
      node-version: ["18", "20"]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps: [...]

  test:
    runs-on: ubuntu-latest
    steps: [...]

  build:
    needs: [lint, test]  # Wait for BOTH
    steps: [...]

  deploy:
    needs: build         # Wait for build only
    steps: [...]

✗ Test failed: src/auth.test.ts line 42
  Expected "admin" to equal "user"

  Run: npm run test -- --grep "auth" to debug locally