1name: CI/CD Pipeline
2 
3on:
4  push:
5    branches: [main]
6  pull_request:
7    branches: [main]
8 
9jobs:
10  build-and-test:
11    runs-on: ubuntu-latest
12    steps:
13      - uses: actions/checkout@v4
14 
15      - name: Setup Node.js
16        uses: actions/setup-node@v4
17        with:
18          node-version: '20'
19          cache: 'npm'
20 
21      - name: Install dependencies
npm ci is reproducible (uses package-lock.json) and faster than npm install
22        run: npm ci  # ci is faster and more reliable than install
23 
24      - name: Type check
25        run: npm run typecheck  # Fast feedback — runs in ~10s
26 
27      - name: Lint
28        run: npm run lint
29 
Image tagged with commit SHA — enables precise rollbacks
30      - name: Unit tests (parallel)
31        run: npm run test -- --maxWorkers=4
32 
33      - name: Build Docker image
34        run: |
35          docker build -t ${{ env.REGISTRY }}/app:${{ github.sha }} .
36          docker push ${{ env.REGISTRY }}/app:${{ github.sha }}
37 
38  deploy-staging:
39    needs: build-and-test
40    runs-on: ubuntu-latest
41    if: github.ref == 'refs/heads/main'
42    steps:
43      - name: Deploy to staging
44        run: |
Manual approval gate for production — require explicit sign-off
45          kubectl set image deployment/app-staging \
46            app=${{ env.REGISTRY }}/app:${{ github.sha }}
47          kubectl rollout status deployment/app-staging --timeout=120s
48 
49      - name: Smoke test staging
50        run: npm run test:smoke -- --env=staging
51 
52  deploy-production:
53    needs: deploy-staging
54    runs-on: ubuntu-latest
55    environment: production  # Requires manual approval in GitHub
56    steps:
57      - name: Deploy to production (rolling update)
58        run: |
59          kubectl set image deployment/app-prod \
60            app=${{ env.REGISTRY }}/app:${{ github.sha }}
61          kubectl rollout status deployment/app-prod --timeout=300s
62 
63      - name: Verify SLOs post-deploy
64        run: npm run verify:slos -- --window=5m

1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: orders-api
5  labels:
6    app: orders-api
7spec:
8  replicas: 3
9  selector:
10    matchLabels:
11      app: orders-api
12  strategy:
13    type: RollingUpdate
14    rollingUpdate:
15      maxSurge: 1        # Allow 1 extra pod during update
maxUnavailable: 0 = zero-downtime rolling update
16      maxUnavailable: 0  # Zero-downtime: never kill a pod before new one is ready
17 
18  template:
19    metadata:
20      labels:
21        app: orders-api
22    spec:
23      containers:
24        - name: api
25          image: registry/orders-api:abc1234  # Always use specific tag, never 'latest'
26          ports:
27            - containerPort: 3000
Resource limits are mandatory — without them, one pod can starve others
28 
29          resources:
30            requests:
31              cpu: 250m       # 0.25 CPU cores guaranteed
32              memory: 256Mi   # 256MB RAM guaranteed
33            limits:
34              cpu: 500m       # Never use more than 0.5 cores
35              memory: 512Mi   # OOMKilled if exceeded — set carefully
readinessProbe gates traffic — pod is NOT ready until this passes
36 
37          readinessProbe:   # Pod receives traffic only when this passes
38            httpGet:
39              path: /health/ready
40              port: 3000
41            initialDelaySeconds: 5
42            periodSeconds: 10
43            failureThreshold: 3
44 
45          livenessProbe:    # Pod is restarted if this fails
46            httpGet:
47              path: /health/live
48              port: 3000
49            initialDelaySeconds: 15
50            periodSeconds: 20
51 
52          env:
53            - name: DATABASE_URL
54              valueFrom:
55                secretKeyRef:
56                  name: app-secrets
57                  key: database-url

1# Terraform: Production ECS + RDS setup
2terraform {
3  required_providers {
4    aws = { source = "hashicorp/aws", version = "~> 5.0" }
5  }
6  backend "s3" {
7    bucket         = "mycompany-terraform-state"
8    key            = "production/app/terraform.tfstate"
9    region         = "us-east-1"
10    dynamodb_table = "terraform-state-lock"  # Prevents concurrent applies
DynamoDB lock prevents two engineers from running terraform apply simultaneously
11    encrypt        = true
12  }
13}
14 
15# RDS PostgreSQL
16resource "aws_db_instance" "postgres" {
17  identifier        = "prod-postgres"
18  engine            = "postgres"
19  engine_version    = "16.1"
20  instance_class    = "db.r6g.xlarge"
21  allocated_storage = 100
22  storage_type      = "gp3"
23 
24  db_name  = "production"
Fetch password from Secrets Manager — never hardcode in Terraform
25  username = "postgres"
26  password = data.aws_secretsmanager_secret_version.db_password.secret_string
27 
multi_az = true for production — single AZ = single point of failure
28  multi_az               = true    # High availability — standby in another AZ
29  deletion_protection    = true    # Prevent accidental destroy
30  backup_retention_period = 30     # 30-day automated backups
31  skip_final_snapshot    = false   # Take snapshot before destroy
32 
33  vpc_security_group_ids = [aws_security_group.rds.id]
34  db_subnet_group_name   = aws_db_subnet_group.main.name
35 
36  tags = {
37    Environment = "production"
38    Terraform   = "true"
39  }
40}