# CI/CD Pipeline for Persistent Context Store
name: CI/CD Pipeline
on:
push:
branches: [ main, develop ]
tags: [ 'v*' ]
pull_request:
branches: [ main, develop ]
env:
NODE_VERSION: '18'
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
# =============================================================================
# CODE QUALITY & TESTING
# =============================================================================
lint-and-test:
name: Lint, Type Check & Test
runs-on: ubuntu-latest
services:
neo4j:
image: neo4j:5.15-community
env:
NEO4J_AUTH: neo4j/testpassword
ports:
- 7687:7687
- 7474:7474
options: >-
--health-cmd "cypher-shell -u neo4j -p testpassword 'RETURN 1'"
--health-interval 10s
--health-timeout 5s
--health-retries 5
redis:
image: redis:7-alpine
ports:
- 6379:6379
options: >-
--health-cmd "redis-cli ping"
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
cache: 'npm'
- name: Install Dependencies
run: npm ci
- name: Run ESLint
run: npm run lint
- name: Run Type Check
run: npm run typecheck
- name: Run Unit Tests
run: npm run test:unit
env:
NEO4J_URI: bolt://localhost:7687
NEO4J_USERNAME: neo4j
NEO4J_PASSWORD: testpassword
NEO4J_DATABASE: contextstore_test
REDIS_URL: redis://localhost:6379
JWT_SECRET: test-jwt-secret-for-ci-pipeline-only
NODE_ENV: test
- name: Run Integration Tests
run: npm run test:integration
env:
NEO4J_URI: bolt://localhost:7687
NEO4J_USERNAME: neo4j
NEO4J_PASSWORD: testpassword
NEO4J_DATABASE: contextstore_integration_test
REDIS_URL: redis://localhost:6379
JWT_SECRET: test-jwt-secret-for-ci-pipeline-only
NODE_ENV: test
- name: Run E2E Tests
run: npm run test:e2e
env:
NEO4J_URI: bolt://localhost:7687
NEO4J_USERNAME: neo4j
NEO4J_PASSWORD: testpassword
NEO4J_DATABASE: contextstore_e2e_test
REDIS_URL: redis://localhost:6379
JWT_SECRET: test-jwt-secret-for-ci-pipeline-only
NODE_ENV: test
PORT: 3001
- name: Generate Test Coverage
run: npm run test:coverage
env:
NEO4J_URI: bolt://localhost:7687
NEO4J_USERNAME: neo4j
NEO4J_PASSWORD: testpassword
NEO4J_DATABASE: contextstore_coverage_test
REDIS_URL: redis://localhost:6379
JWT_SECRET: test-jwt-secret-for-ci-pipeline-only
NODE_ENV: test
- name: Upload Coverage to Codecov
uses: codecov/codecov-action@v3
with:
file: ./coverage/lcov.info
fail_ci_if_error: false
- name: Build Application
run: npm run build
- name: Cache Build Artifacts
uses: actions/cache@v3
with:
path: |
build/
node_modules/
key: ${{ runner.os }}-build-${{ github.sha }}
# =============================================================================
# SECURITY SCANNING
# =============================================================================
security-scan:
name: Security Scan
runs-on: ubuntu-latest
needs: lint-and-test
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
cache: 'npm'
- name: Install Dependencies
run: npm ci
- name: Run Security Audit
run: npm audit --audit-level high
- name: Run Snyk Security Check
uses: snyk/actions/node@master
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --severity-threshold=high
- name: Run CodeQL Analysis
uses: github/codeql-action/init@v3
with:
languages: javascript
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
# =============================================================================
# DOCKER BUILD & PUSH
# =============================================================================
docker-build:
name: Build & Push Docker Image
runs-on: ubuntu-latest
needs: [lint-and-test, security-scan]
permissions:
contents: read
packages: write
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Log in to Container Registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract Metadata
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=ref,event=branch
type=ref,event=pr
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=semver,pattern={{major}}
type=sha,prefix={{branch}}-
- name: Build and Push Docker Image
uses: docker/build-push-action@v5
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
platforms: linux/amd64,linux/arm64
- name: Run Docker Security Scan
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
format: 'sarif'
output: 'trivy-results.sarif'
- name: Upload Trivy Results
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'
# =============================================================================
# PERFORMANCE TESTING
# =============================================================================
performance-test:
name: Performance Testing
runs-on: ubuntu-latest
needs: docker-build
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
services:
neo4j:
image: neo4j:5.15-community
env:
NEO4J_AUTH: neo4j/perftest
ports:
- 7687:7687
options: >-
--health-cmd "cypher-shell -u neo4j -p perftest 'RETURN 1'"
--health-interval 10s
--health-timeout 5s
--health-retries 5
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: ${{ env.NODE_VERSION }}
cache: 'npm'
- name: Install Dependencies
run: npm ci
- name: Build Application
run: npm run build
- name: Start Application
run: npm start &
env:
NEO4J_URI: bolt://localhost:7687
NEO4J_USERNAME: neo4j
NEO4J_PASSWORD: perftest
NEO4J_DATABASE: contextstore_perf
JWT_SECRET: perf-test-secret
NODE_ENV: production
PORT: 3000
- name: Wait for Application
run: |
timeout 60 bash -c 'until curl -f http://localhost:3000/health; do sleep 2; done'
- name: Run Load Tests
run: |
npm install -g artillery
artillery run scripts/load-test.yml --output perf-report.json
- name: Generate Performance Report
run: |
artillery report perf-report.json --output perf-report.html
- name: Upload Performance Results
uses: actions/upload-artifact@v3
with:
name: performance-report
path: |
perf-report.json
perf-report.html
# =============================================================================
# STAGING DEPLOYMENT
# =============================================================================
deploy-staging:
name: Deploy to Staging
runs-on: ubuntu-latest
needs: [docker-build, performance-test]
if: github.ref == 'refs/heads/develop'
environment: staging
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup kubectl
uses: azure/setup-kubectl@v3
with:
version: 'v1.28.0'
- name: Configure kubectl
run: |
echo "${{ secrets.KUBE_CONFIG_STAGING }}" | base64 -d > kubeconfig
export KUBECONFIG=kubeconfig
- name: Deploy to Staging
run: |
export KUBECONFIG=kubeconfig
export IMAGE_TAG=${{ github.sha }}
envsubst < k8s/staging/deployment.yaml | kubectl apply -f -
kubectl rollout status deployment/context-store-app -n context-store-staging
- name: Run Smoke Tests
run: |
export STAGING_URL="${{ secrets.STAGING_URL }}"
npm run test:smoke -- --url="$STAGING_URL"
- name: Notify Deployment
uses: 8398a7/action-slack@v3
with:
status: ${{ job.status }}
channel: '#deployments'
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
message: |
🚀 Staging deployment completed
Branch: ${{ github.ref }}
Commit: ${{ github.sha }}
URL: ${{ secrets.STAGING_URL }}
# =============================================================================
# PRODUCTION DEPLOYMENT
# =============================================================================
deploy-production:
name: Deploy to Production
runs-on: ubuntu-latest
needs: docker-build
if: startsWith(github.ref, 'refs/tags/v')
environment: production
steps:
- name: Checkout Code
uses: actions/checkout@v4
- name: Setup kubectl
uses: azure/setup-kubectl@v3
with:
version: 'v1.28.0'
- name: Configure kubectl
run: |
echo "${{ secrets.KUBE_CONFIG_PRODUCTION }}" | base64 -d > kubeconfig
export KUBECONFIG=kubeconfig
- name: Create Backup
run: |
export KUBECONFIG=kubeconfig
kubectl create job backup-pre-deploy-$(date +%s) \
--from=cronjob/context-store-backup \
-n context-store-production
- name: Deploy to Production
run: |
export KUBECONFIG=kubeconfig
export IMAGE_TAG=${GITHUB_REF#refs/tags/}
envsubst < k8s/production/deployment.yaml | kubectl apply -f -
kubectl rollout status deployment/context-store-app -n context-store-production --timeout=600s
- name: Run Health Checks
run: |
export PRODUCTION_URL="${{ secrets.PRODUCTION_URL }}"
timeout 300 bash -c 'until curl -f "$PRODUCTION_URL/health"; do sleep 10; done'
curl -f "$PRODUCTION_URL/health/detailed"
- name: Run Post-Deploy Tests
run: |
export PRODUCTION_URL="${{ secrets.PRODUCTION_URL }}"
export API_KEY="${{ secrets.PRODUCTION_API_KEY }}"
npm run test:smoke -- --url="$PRODUCTION_URL" --api-key="$API_KEY"
- name: Create GitHub Release
uses: softprops/action-gh-release@v1
with:
generate_release_notes: true
files: |
CHANGELOG.md
README.md
- name: Notify Success
uses: 8398a7/action-slack@v3
with:
status: success
channel: '#deployments'
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
message: |
🎉 Production deployment successful!
Version: ${{ github.ref }}
URL: ${{ secrets.PRODUCTION_URL }}
- name: Notify Failure
if: failure()
uses: 8398a7/action-slack@v3
with:
status: failure
channel: '#alerts'
webhook_url: ${{ secrets.SLACK_WEBHOOK }}
message: |
🚨 Production deployment failed!
Version: ${{ github.ref }}
Please check the logs and rollback if necessary.
# =============================================================================
# CLEANUP & MAINTENANCE
# =============================================================================
cleanup:
name: Cleanup Old Images
runs-on: ubuntu-latest
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
needs: [deploy-staging]
steps:
- name: Delete Old Images
uses: actions/delete-package-versions@v4
with:
package-name: ${{ env.IMAGE_NAME }}
package-type: 'container'
min-versions-to-keep: 10
delete-only-untagged-versions: true
