مشروع: سير عمل CI/CD متكامل

# .github/workflows/cicd.yml name: CI/CD Pipeline on: push: branches: [main] pull_request: branches: [main] release: types: [published] env: REGISTRY: ghcr.io IMAGE_NAME: ${{ github.repository }} jobs: # ── 1. LINT & TEST ────────────────────────────────────────────── test: name: Lint & Unit Tests runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: "20" cache: "npm" - run: npm ci - name: Lint run: npm run lint - name: Unit tests with coverage run: npm test -- --coverage --coverageThreshold='{"global":{"lines":80}}' - uses: actions/upload-artifact@v4 if: always() with: name: coverage-report path: coverage/ retention-days: 7 # ── 2. BUILD IMAGE ──────────────────────────────────────────────── build-image: name: Build Docker Image runs-on: ubuntu-24.04 needs: test outputs: image-digest: ${{ steps.build.outputs.digest }} image-tag: ${{ steps.meta.outputs.tags }} permissions: contents: read packages: write steps: - uses: actions/checkout@v4 - uses: docker/setup-buildx-action@v3 - uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract metadata id: meta uses: docker/metadata-action@v5 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | type=sha,prefix=sha-,format=short type=ref,event=branch type=semver,pattern={{version}} - name: Build & push (cache-optimised) id: build uses: docker/build-push-action@v5 with: context: . push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max provenance: true sbom: true # ── 3. SCAN & SIGN ────────────────────────────────────────────── scan: name: CVE Scan runs-on: ubuntu-24.04 needs: build-image permissions: contents: read packages: read security-events: write steps: - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-image.outputs.image-digest }} format: sarif output: trivy-results.sarif severity: CRITICAL,HIGH exit-code: "1" - uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: trivy-results.sarif # ── 4. DEPLOY STAGING ──────────────────────────────────────────── deploy-staging: name: Deploy to Staging runs-on: ubuntu-24.04 needs: scan environment: staging if: github.ref == 'refs/heads/main' steps: - uses: actions/checkout@v4 - uses: azure/setup-kubectl@v4 with: version: "v1.30.0" - name: Authenticate to cluster run: | mkdir -p ~/.kube echo "${{ secrets.STAGING_KUBECONFIG }}" | base64 -d > ~/.kube/config chmod 600 ~/.kube/config - name: Rolling update run: | IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-image.outputs.image-digest }}" kubectl set image deployment/api api="$IMAGE" -n staging kubectl rollout status deployment/api -n staging --timeout=120s - name: Smoke test run: | STAGING_URL="https://staging.api.example.com" for i in 1 2 3 4 5; do STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$STAGING_URL/healthz") [ "$STATUS" = "200" ] && echo "Smoke test passed" && exit 0 echo "Attempt $i: got $STATUS, retrying in 10s..." sleep 10 done echo "Smoke test failed after 5 attempts" && exit 1 # ── 5. DEPLOY PRODUCTION ───────────────────────────────────────── deploy-production: name: Deploy to Production runs-on: ubuntu-24.04 needs: deploy-staging environment: production if: github.event_name == 'release' steps: - uses: actions/checkout@v4 - uses: azure/setup-kubectl@v4 with: version: "v1.30.0" - name: Authenticate to production cluster run: | mkdir -p ~/.kube echo "${{ secrets.PROD_KUBECONFIG }}" | base64 -d > ~/.kube/config chmod 600 ~/.kube/config - name: Blue/green cutover run: | IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ needs.build-image.outputs.image-digest }}" kubectl set image deployment/api api="$IMAGE" -n production kubectl rollout status deployment/api -n production --timeout=300s - name: Tag deployment in Datadog env: DD_API_KEY: ${{ secrets.DATADOG_API_KEY }} run: | curl -s -X POST "https://api.datadoghq.com/api/v1/events" \ -H "DD-API-KEY: $DD_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"title\":\"Deployed ${{ github.ref_name }}\",\"text\":\"SHA ${{ github.sha }}\",\"tags\":[\"env:production\"]}"

# Dockerfile FROM node:20-alpine AS deps WORKDIR /app COPY package*.json ./ RUN npm ci --omit=dev FROM node:20-alpine AS builder WORKDIR /app COPY --from=deps /app/node_modules ./node_modules COPY . . RUN npm run build FROM node:20-alpine AS runner WORKDIR /app RUN addgroup --system --gid 1001 nodejs \ && adduser --system --uid 1001 nodeuser COPY --from=builder --chown=nodeuser:nodejs /app/dist ./dist COPY --from=deps --chown=nodeuser:nodejs /app/node_modules ./node_modules USER nodeuser EXPOSE 3000 HEALTHCHECK --interval=15s --timeout=5s --start-period=10s --retries=3 \ CMD wget -qO- http://localhost:3000/healthz || exit 1 CMD ["node", "dist/server.js"]

# التراجع: إعادة صورة الـ deployment إلى الـ digest السابع المعروف بأنه سليم kubectl set image deployment/api \ api=ghcr.io/your-org/your-repo@sha256:<previous-digest> \ -n production kubectl rollout status deployment/api -n production --timeout=300s # التحقق kubectl get pods -n production -l app=api -o wide