1name: Test
 2
 3on:
 4  push:
 5    branches: [main, develop]
 6  pull_request:
 7    branches: [main]
 8
 9jobs:
10  test:
11    runs-on: ubuntu-latest
12
13    strategy:
14      matrix:
15        node-version: [18.x, 20.x]
16
17    steps:
18      - uses: actions/checkout@v4
19
20      - name: Use Node.js ${{ matrix.node-version }}
21        uses: actions/setup-node@v4
22        with:
23          node-version: ${{ matrix.node-version }}
24          cache: "npm"
25
26      - name: Install dependencies
27        run: npm ci
28
29      - name: Run linter
30        run: npm run lint
31
32      - name: Run tests
33        run: npm test
34
35      - name: Upload coverage
36        uses: codecov/codecov-action@v3
37        with:
38          files: ./coverage/lcov.info

 1name: Build and Push
 2
 3on:
 4  push:
 5    branches: [main]
 6    tags: ["v*"]
 7
 8env:
 9  REGISTRY: ghcr.io
10  IMAGE_NAME: ${{ github.repository }}
11
12jobs:
13  build:
14    runs-on: ubuntu-latest
15    permissions:
16      contents: read
17      packages: write
18
19    steps:
20      - uses: actions/checkout@v4
21
22      - name: Log in to Container Registry
23        uses: docker/login-action@v3
24        with:
25          registry: ${{ env.REGISTRY }}
26          username: ${{ github.actor }}
27          password: ${{ secrets.GITHUB_TOKEN }}
28
29      - name: Extract metadata
30        id: meta
31        uses: docker/metadata-action@v5
32        with:
33          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
34          tags: |
35            type=ref,event=branch
36            type=ref,event=pr
37            type=semver,pattern={{version}}
38            type=semver,pattern={{major}}.{{minor}}
39
40      - name: Build and push
41        uses: docker/build-push-action@v5
42        with:
43          context: .
44          push: true
45          tags: ${{ steps.meta.outputs.tags }}
46          labels: ${{ steps.meta.outputs.labels }}
47          cache-from: type=gha
48          cache-to: type=gha,mode=max

 1name: Deploy to Kubernetes
 2
 3on:
 4  push:
 5    branches: [main]
 6
 7jobs:
 8  deploy:
 9    runs-on: ubuntu-latest
10
11    steps:
12      - uses: actions/checkout@v4
13
14      - name: Configure AWS credentials
15        uses: aws-actions/configure-aws-credentials@v4
16        with:
17          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
18          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
19          aws-region: us-west-2
20
21      - name: Update kubeconfig
22        run: |
23          aws eks update-kubeconfig --name production-cluster --region us-west-2
24
25      - name: Deploy to Kubernetes
26        run: |
27          kubectl apply -f k8s/
28          kubectl rollout status deployment/my-app -n production
29          kubectl get services -n production
30
31      - name: Verify deployment
32        run: |
33          kubectl get pods -n production
34          kubectl describe deployment my-app -n production

 1name: Matrix Build
 2
 3on: [push, pull_request]
 4
 5jobs:
 6  build:
 7    runs-on: ${{ matrix.os }}
 8
 9    strategy:
10      matrix:
11        os: [ubuntu-latest, macos-latest, windows-latest]
12        python-version: ["3.9", "3.10", "3.11", "3.12"]
13
14    steps:
15      - uses: actions/checkout@v4
16
17      - name: Set up Python
18        uses: actions/setup-python@v5
19        with:
20          python-version: ${{ matrix.python-version }}
21
22      - name: Install dependencies
23        run: |
24          python -m pip install --upgrade pip
25          pip install -r requirements.txt
26
27      - name: Run tests
28        run: pytest

 1# .github/workflows/reusable-test.yml
 2name: Reusable Test Workflow
 3
 4on:
 5  workflow_call:
 6    inputs:
 7      node-version:
 8        required: true
 9        type: string
10    secrets:
11      NPM_TOKEN:
12        required: true
13
14jobs:
15  test:
16    runs-on: ubuntu-latest
17    steps:
18      - uses: actions/checkout@v4
19      - uses: actions/setup-node@v4
20        with:
21          node-version: ${{ inputs.node-version }}
22      - run: npm ci
23      - run: npm test

1jobs:
2  call-test:
3    uses: ./.github/workflows/reusable-test.yml
4    with:
5      node-version: "20.x"
6    secrets:
7      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

 1name: Security Scan
 2
 3on:
 4  push:
 5    branches: [main]
 6  pull_request:
 7    branches: [main]
 8
 9jobs:
10  security:
11    runs-on: ubuntu-latest
12
13    steps:
14      - uses: actions/checkout@v4
15
16      - name: Run Trivy vulnerability scanner
17        uses: aquasecurity/trivy-action@master
18        with:
19          scan-type: "fs"
20          scan-ref: "."
21          format: "sarif"
22          output: "trivy-results.sarif"
23
24      - name: Upload Trivy results to GitHub Security
25        uses: github/codeql-action/upload-sarif@v2
26        with:
27          sarif_file: "trivy-results.sarif"
28
29      - name: Run Snyk Security Scan
30        uses: snyk/actions/node@master
31        env:
32          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

 1name: Deploy to Production
 2
 3on:
 4  push:
 5    tags: ["v*"]
 6
 7jobs:
 8  deploy:
 9    runs-on: ubuntu-latest
10    environment:
11      name: production
12      url: https://app.example.com
13
14    steps:
15      - uses: actions/checkout@v4
16
17      - name: Deploy application
18        run: |
19          echo "Deploying to production..."
20          # Deployment commands here
21
22      - name: Notify Slack
23        if: success()
24        uses: slackapi/slack-github-action@v1
25        with:
26          webhook-url: ${{ secrets.SLACK_WEBHOOK }}
27          payload: |
28            {
29              "text": "Deployment to production completed successfully!"
30            }