CI Pipeline Design

name: CI Pipeline
on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write
  security-events: write

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Secret scan
        uses: gitleaks/gitleaks-action@v2
      - name: Lint
        run: npm ci && npm run lint

  build-test:
    needs: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - run: npm ci && npm test -- --coverage
      - run: docker build -t app:${{ github.sha }} .

  security-scan:
    needs: build-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: SAST
        run: semgrep scan --config=auto --sarif -o semgrep.sarif
      - name: Container scan
        run: trivy image --exit-code 1 --severity CRITICAL,HIGH app:${{ github.sha }}
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

name: Deploy to EKS
on:
  push:
    branches: [main]

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-oidc-deploy
          aws-region: us-east-1

      - name: Login to ECR
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build and push
        run: |
          docker build -t $ECR_REGISTRY/app:${{ github.sha }} .
          docker push $ECR_REGISTRY/app:${{ github.sha }}

      - name: Update GitOps manifest
        run: |
          yq -i '.spec.template.spec.containers[0].image = "'$ECR_REGISTRY'/app:${{ github.sha }}"' k8s/deployment.yaml
          git config user.name "github-actions[bot]"
          git commit -am "deploy: ${{ github.sha }}"
          git push

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
        node: [18, 20, 22]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: npm
      - run: npm ci && npm test

  scan:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          severity: CRITICAL,HIGH
          exit-code: 1

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Cache Docker layers
        uses: actions/cache@v4
        with:
          path: /tmp/.buildx-cache
          key: buildx-${{ hashFiles('Dockerfile', 'package-lock.json') }}
          restore-keys: buildx-

      - uses: docker/setup-buildx-action@v3
      - name: Build with cache
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          tags: app:${{ github.sha }}
          cache-from: type=local,src=/tmp/.buildx-cache
          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max

      - name: Move cache
        run: |
          rm -rf /tmp/.buildx-cache
          mv /tmp/.buildx-cache-new /tmp/.buildx-cache

name: Node CI Template
on:
  workflow_call:
    inputs:
      node-version:
        required: false
        type: string
        default: "20"
      run-e2e:
        required: false
        type: boolean
        default: false
    secrets:
      SONAR_TOKEN:
        required: false

permissions:
  contents: read
  security-events: write
  id-token: write

jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: npm
      - run: npm ci && npm test
      - uses: gitleaks/gitleaks-action@v2
      - uses: aquasecurity/trivy-action@master
        with:
          scan-type: fs
          exit-code: 1
          severity: CRITICAL,HIGH

name: CI
on:
  pull_request:
  push:
    branches: [main]

jobs:
  call-platform-template:
    uses: my-org/.github/.github/workflows/[email protected]
    with:
      node-version: "22"
      run-e2e: false
    secrets: inherit

# Jenkins: stage('Test') { steps { sh 'npm test' } }
# Actions equivalent:
- name: Test
  run: npm ci && npm test

# Jenkins: when { branch 'main' }
# Actions equivalent:
if: github.ref == 'refs/heads/main'

# Jenkins: withCredentials([...])
# Actions equivalent: secrets.MY_SECRET or OIDC (preferred)

# Jenkins: shared library vars.buildApp()
# Actions equivalent:
uses: my-org/.github/.github/workflows/build.yml@v1