shadd0wtaka/zen-ai-pentest/devops-cicd

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: {node-version: 20}
      - run: npm ci
      - run: npm test
      - run: npm run build
  docker:
    needs: [test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t app:${{ github.sha }} .
      - run: echo ${{ secrets.REGISTRY_PASS }} | docker login -u ${{ secrets.REGISTRY_USER }} --password-stdin
      - run: docker push app:${{ github.sha }}

      - uses: docker/setup-qemu-action@v3
      - uses: docker/setup-buildx-action@v3
      - run: |
          docker buildx build --platform linux/amd64,linux/arm64 \
            -t app:latest --push .

# .gitlab-ci.yml
stages: [test, build, deploy]
variables:
  DOCKER_IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
test:
  stage: test
  image: node:20
  script:
    - npm ci
    - npm test
    - npm run lint
build:
  stage: build
  image: docker:27
  services: [docker:27-dind]
  script:
    - docker build -t $DOCKER_IMAGE .
    - docker push $DOCKER_IMAGE

# Conventional Commits Auto-Version
VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")
MAJOR=$(echo $VERSION | cut -d. -f1)
MINOR=$(echo $VERSION | cut -d. -f2)
PATCH=$(echo $VERSION | cut -d. -f3)
if git log "$VERSION..HEAD" --grep="BREAKING" | grep .; then
  echo "$((MAJOR+1)).0.0"
elif git log "$VERSION..HEAD" --grep="feat:" | grep .; then
  echo "$MAJOR.$((MINOR+1)).0"
else
  echo "$MAJOR.$MINOR.$((PATCH+1))"
fi

# Blue-Green
kubectl apply -f deployment-green.yaml
kubectl wait --for=condition=ready pod -l app=myapp,version=green
kubectl patch service myapp -p '{"spec":{"selector":{"version":"green"}}}'
kubectl delete deployment myapp-v1  # old
 
# Canary (10% traffic)
kubectl set image deployment/myapp app=myapp:v2
kubectl scale deployment myapp --replicas=1  # canary
kubectl scale deployment myapp-v1 --replicas=9

# SonarQube
sonar-scanner -Dsonar.projectKey=myapp -Dsonar.qualitygate.wait=true
# Code Coverage
npm test -- --coverage --coverageThreshold='{"global":{"lines":80}}'
# Security Scan
trivy image myapp:latest --severity CRITICAL,HIGH --exit-code 1