CI/CD Pipelines with GitHub Actions: From Commit to Production

1# .github/workflows/ci.yml2name: CI3 4on:5  push:6    branches: [main]7  pull_request:8    branches: [main]9 10jobs:11  test:12    runs-on: ubuntu-latest13 14    services:15      postgres:                         # spin up a real database for integration tests16        image: postgres:1617        env:18          POSTGRES_PASSWORD: postgres19        options: >-20          --health-cmd pg_isready21          --health-interval 10s22          --health-timeout 5s23 24    steps:25      - uses: actions/checkout@v4       # fetch code26 27      - uses: actions/setup-node@v428        with:29          node-version: "22"30          cache: "npm"                  # cache node_modules for speed31 32      - run: npm ci                     # reproducible install33 34      - run: npm run lint               # static analysis35 36      - run: npm run typecheck          # TypeScript errors37 38      - run: npm test                   # unit + integration tests39        env:40          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test

1# Multi-stage Dockerfile — lean production image2FROM node:22-slim AS builder3WORKDIR /app4COPY package*.json ./5RUN npm ci6COPY . .7RUN npm run build8 9FROM node:22-slim AS runtime10WORKDIR /app11RUN addgroup --system app && adduser --system --ingroup app app12COPY --from=builder /app/dist ./dist13COPY --from=builder /app/node_modules ./node_modules14USER app                         # don't run as root15CMD ["node", "dist/index.js"]16# Image size: ~120MB17 18---19# .github/workflows/ci.yml (build job, runs after test)20  build:21    needs: [test]                  # only runs if tests pass22    runs-on: ubuntu-latest23    outputs:24      image-tag: ${{ steps.meta.outputs.tags }}25 26    steps:27      - uses: actions/checkout@v428 29      - uses: docker/login-action@v330        with:31          registry: ghcr.io32          username: ${{ github.actor }}33          password: ${{ secrets.GITHUB_TOKEN }}   # built-in, no setup34 35      - name: Build and push36        uses: docker/build-push-action@v537        with:38          context: .39          push: true40          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}41          cache-from: type=gha                    # GitHub Actions cache layer42          cache-to: type=gha,mode=max

1# .github/workflows/deploy.yml2  deploy:3    needs: [build]4    runs-on: ubuntu-latest5    environment: production           # requires manual approval in GitHub6 7    steps:8      - uses: azure/k8s-set-context@v39        with:10          kubeconfig: ${{ secrets.KUBECONFIG }}11 12      - name: Rolling deploy13        run: |14          kubectl set image deployment/api \15            api=ghcr.io/${{ github.repository }}:${{ github.sha }}16 17          kubectl rollout status deployment/api --timeout=5m18 19      - name: Smoke test20        run: |21          sleep 1022          curl -f https://api.example.com/health || \23            kubectl rollout undo deployment/api  # auto-rollback on failure24 25---26# Kubernetes deployment manifest27apiVersion: apps/v128kind: Deployment29spec:30  replicas: 331  strategy:32    type: RollingUpdate33    rollingUpdate:34      maxUnavailable: 0           # never below 3 pods during deploy35      maxSurge: 1                 # allow 4 pods temporarily36  template:37    spec:38      containers:39        - name: api40          readinessProbe:         # Kubernetes won't route traffic until healthy41            httpGet:42              path: /health43              port: 300044            initialDelaySeconds: 545            periodSeconds: 5

1# GitHub Actions — secrets injected at runtime, masked in logs2  deploy:3    steps:4      - name: Deploy5        env:6          DATABASE_URL: ${{ secrets.PROD_DATABASE_URL }}7          STRIPE_SECRET_KEY: ${{ secrets.STRIPE_SECRET_KEY }}8        run: |9          kubectl create secret generic app-secrets \10            --from-literal=DATABASE_URL="$DATABASE_URL" \11            --from-literal=STRIPE_SECRET_KEY="$STRIPE_SECRET_KEY" \12            --dry-run=client -o yaml | kubectl apply -f -13 14# .env.example committed to repo (no real values, just structure)15DATABASE_URL=postgresql://user:password@localhost:5432/myapp16STRIPE_SECRET_KEY=sk_test_...17JWT_SECRET=...18 19# Runtime: fetch from secret store (Node.js example)20import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";21 22const client = new SecretsManagerClient({ region: "us-east-1" });23const { SecretString } = await client.send(24  new GetSecretValueCommand({ SecretId: "prod/myapp" })25);26const secrets = JSON.parse(SecretString!);