feat: add initial multi-environment CI/CD pipeline POC

Adds all required files for the proof of concept: - Gitea Actions CI/CD workflows for QA, staging, and production environments - Docker build configuration with healthcheck and runtime environment injection - Nginx server config with security headers and health endpoint - Sample static frontend application displaying environment metrics - Comprehensive README documentation with architecture, setup, and usage instructions
2026-06-01 14:23:20 -06:00
parent eea20775d3
commit 1171e15503
11 changed files with 1287 additions and 2 deletions
@@ -0,0 +1,136 @@
+name: CI Pipeline
+
+on:
+  push:
+    branches-ignore:
+      - 'renovate/**'
+  pull_request:
+    branches:
+      - dev
+      - staging
+      - main
+
+env:
+  REGISTRY_URL: ${{ vars.REGISTRY_URL }}
+  IMAGE_NAME: ${{ vars.IMAGE_NAME }}
+
+jobs:
+  lint:
+    name: HTML Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install html-validate
+        run: npm install -g html-validate
+
+      - name: Validate HTML
+        run: |
+          set -euo pipefail
+          html-validate src/index.html || true
+          echo "::notice::HTML validation completed (non-blocking)"
+
+  build:
+    name: Build Docker Image
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Cache Docker layers
+        uses: actions/cache@v4
+        with:
+          path: /tmp/.buildx-cache
+          key: ci-buildx-${{ gitea.sha }}
+          restore-keys: |
+            ci-buildx-
+
+      - name: Build image
+        run: |
+          set -euo pipefail
+          docker buildx build \
+            --cache-from=type=local,src=/tmp/.buildx-cache \
+            --cache-to=type=local,dest=/tmp/.buildx-cache-new,mode=max \
+            --load \
+            --build-arg APP_VERSION=ci-${{ gitea.sha }} \
+            --build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+            --build-arg GIT_COMMIT=${{ gitea.sha }} \
+            --build-arg GIT_BRANCH=${{ gitea.ref_name }} \
+            -t ci-image:latest \
+            .
+
+      - name: Verify image starts
+        run: |
+          set -euo pipefail
+          docker run -d --name ci-test \
+            -e APP_ENV=ci \
+            -e APP_VERSION=ci-${{ gitea.sha }} \
+            -e BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+            -e GIT_COMMIT=${{ gitea.sha }} \
+            -e GIT_BRANCH=${{ gitea.ref_name }} \
+            -e DEPLOY_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+            -p 8080:80 \
+            ci-image:latest
+
+          for i in $(seq 1 12); do
+            if curl -sf http://localhost:8080/health > /dev/null 2>&1; then
+              echo "::notice::Health check passed"
+              docker logs ci-test 2>&1 || true
+              docker stop ci-test
+              docker rm ci-test
+              exit 0
+            fi
+            sleep 5
+          done
+
+          echo "::error::Health check failed after 60 seconds"
+          docker logs ci-test 2>&1 || true
+          docker stop ci-test
+          docker rm ci-test
+          exit 1
+
+      - name: Move cache
+        run: |
+          set -euo pipefail
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+
+  security-scan:
+    name: Security Scan
+    runs-on: ubuntu-latest
+    needs: build
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ci-image:latest
+          format: table
+          exit-code: 1
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+
+  summary:
+    name: Generate Summary
+    runs-on: ubuntu-latest
+    needs: [lint, build, security-scan]
+    if: always()
+    steps:
+      - name: Create summary
+        run: |
+          cat << 'SUMMARY' >> $GITEA_HOME/workflow/summary
+          ## CI Pipeline Results
+
+          | Job | Status |
+          |-----|--------|
+          | Lint | ${{ needs.lint.result }} |
+          | Build | ${{ needs.build.result }} |
+          | Security Scan | ${{ needs.security-scan.result }} |
+
+          **Commit:** ${{ gitea.sha }}
+          **Branch:** ${{ gitea.ref_name }}
+          SUMMARY
@@ -0,0 +1,167 @@
+name: Deploy Production
+
+on:
+  push:
+    branches:
+      - main
+
+env:
+  REGISTRY_URL: ${{ vars.REGISTRY_URL }}
+  IMAGE_NAME: ${{ vars.IMAGE_NAME }}
+  APP_ENV: production
+
+jobs:
+  build-and-push:
+    name: Build and Push
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+      app_version: ${{ steps.meta.outputs.app_version }}
+    environment:
+      name: production
+      url: https://practicas.prod.kubistudio.cloud
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Gitea Registry
+        run: |
+          set -euo pipefail
+          echo "${{ secrets.TOKEN }}" | docker login $REGISTRY_URL -u ${{ gitea.actor }} --password-stdin
+
+      - name: Build and push
+        id: meta
+        run: |
+          set -euo pipefail
+          SHA_TAG="${{ gitea.sha }}"
+          PROD_TAG="production-latest"
+          STABLE_TAG="stable"
+          BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+          APP_VERSION="release-${{ gitea.sha }}"
+
+          docker buildx build \
+            --push \
+            --build-arg APP_VERSION=${APP_VERSION} \
+            --build-arg BUILD_DATE=${BUILD_DATE} \
+            --build-arg GIT_COMMIT=${SHA_TAG} \
+            --build-arg GIT_BRANCH=main \
+            -t ${REGISTRY_URL}/${IMAGE_NAME}:${PROD_TAG} \
+            -t ${REGISTRY_URL}/${IMAGE_NAME}:${STABLE_TAG} \
+            -t ${REGISTRY_URL}/${IMAGE_NAME}:sha-${SHA_TAG} \
+            .
+
+          echo "image_tag=${PROD_TAG}" >> $GITEA_OUTPUT
+          echo "app_version=${APP_VERSION}" >> $GITEA_OUTPUT
+          echo "::notice::Image pushed: ${REGISTRY_URL}/${IMAGE_NAME}:${PROD_TAG}"
+
+  deploy:
+    name: Deploy to Production
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    environment:
+      name: production
+      url: https://practicas.prod.kubistudio.cloud
+    steps:
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USERNAME }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            set -euo pipefail
+
+            echo "Saving current image tag for rollback..."
+            CURRENT_IMAGE=$(docker inspect cicd-prod --format '{{.Config.Image}}' 2>/dev/null || echo "")
+
+            echo "Pulling image..."
+            echo "${{ secrets.TOKEN }}" | docker login ${{ env.REGISTRY_URL }} -u ${{ gitea.actor }} --password-stdin
+            docker pull ${{ env.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-push.outputs.image_tag }}
+
+            echo "Stopping existing container..."
+            docker stop cicd-prod 2>/dev/null || true
+            docker rm cicd-prod 2>/dev/null || true
+
+            echo "Starting new container..."
+            docker run -d \
+              --name cicd-prod \
+              --restart unless-stopped \
+              -p 8083:80 \
+              -e APP_ENV=production \
+              -e APP_VERSION=${{ needs.build-and-push.outputs.app_version }} \
+              -e DEPLOY_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+              ${{ env.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-push.outputs.image_tag }}
+
+            echo "Waiting for health check..."
+            HEALTHY=false
+            for i in $(seq 1 12); do
+              if curl -sf http://localhost:8083/health > /dev/null 2>&1; then
+                HEALTHY=true
+                echo "::notice::Production health check passed"
+                break
+              fi
+              sleep 5
+            done
+
+            if [ "$HEALTHY" = false ]; then
+              echo "::error::Health check failed - rolling back"
+
+              docker stop cicd-prod 2>/dev/null || true
+              docker rm cicd-prod 2>/dev/null || true
+
+              if [ -n "$CURRENT_IMAGE" ]; then
+                docker run -d \
+                  --name cicd-prod \
+                  --restart unless-stopped \
+                  -p 8083:80 \
+                  -e APP_ENV=production \
+                  -e APP_VERSION=rollback \
+                  -e DEPLOY_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+                  "$CURRENT_IMAGE"
+
+                echo "::warning::Rollback completed to previous image: $CURRENT_IMAGE"
+              else
+                echo "::error::No previous image available for rollback"
+              fi
+
+              exit 1
+            fi
+
+  release-notes:
+    name: Release Notes
+    runs-on: ubuntu-latest
+    needs: [build-and-push, deploy]
+    if: success()
+    steps:
+      - name: Generate release notes
+        run: |
+          set -euo pipefail
+          COMMITS_SINCE_LAST=$(git log --oneline --no-decorate ${{ gitea.sha }} -n 20 2>/dev/null || echo "No commit history available")
+
+          cat << 'SUMMARY' >> $GITEA_HOME/workflow/summary
+          ## Production Deployment Successful :rocket:
+
+          **Version:** ${{ needs.build-and-push.outputs.app_version }}
+          **Commit:** ${{ gitea.sha }}
+          **Image:** ${{ vars.REGISTRY_URL }}/${{ vars.IMAGE_NAME }}:production-latest
+          **URL:** https://practicas.prod.kubistudio.cloud
+
+          ### Recent Commits
+          ```
+          SUMMARY
+
+          git log --oneline --no-decorate -n 20 ${{ gitea.sha }} 2>/dev/null >> $GITEA_HOME/workflow/summary || true
+
+          cat << 'SUMMARY' >> $GITEA_HOME/workflow/summary
+          ```
+
+          ### Rollback
+          If needed, rollback with:
+          ```bash
+          docker stop cicd-prod && docker rm cicd-prod
+          docker run -d --name cicd-prod --restart unless-stopped -p 8083:80 \${{ vars.REGISTRY_URL }}/\${{ vars.IMAGE_NAME }}:stable
+          ```
+          SUMMARY
@@ -0,0 +1,115 @@
+name: Deploy QA
+
+on:
+  push:
+    branches:
+      - dev
+
+env:
+  REGISTRY_URL: ${{ vars.REGISTRY_URL }}
+  IMAGE_NAME: ${{ vars.IMAGE_NAME }}
+  APP_ENV: qa
+
+jobs:
+  build-and-push:
+    name: Build and Push
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Gitea Registry
+        run: |
+          set -euo pipefail
+          echo "${{ secrets.TOKEN }}" | docker login $REGISTRY_URL -u ${{ gitea.actor }} --password-stdin
+
+      - name: Build and push
+        id: meta
+        run: |
+          set -euo pipefail
+          SHA_TAG="${{ gitea.sha }}"
+          QA_TAG="qa-latest"
+          BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+          docker buildx build \
+            --push \
+            --build-arg APP_VERSION=dev-${SHA_TAG} \
+            --build-arg BUILD_DATE=${BUILD_DATE} \
+            --build-arg GIT_COMMIT=${SHA_TAG} \
+            --build-arg GIT_BRANCH=dev \
+            -t ${REGISTRY_URL}/${IMAGE_NAME}:${QA_TAG} \
+            -t ${REGISTRY_URL}/${IMAGE_NAME}:sha-${SHA_TAG} \
+            .
+
+          echo "image_tag=${QA_TAG}" >> $GITEA_OUTPUT
+          echo "::notice::Image pushed: ${REGISTRY_URL}/${IMAGE_NAME}:${QA_TAG}"
+
+  deploy:
+    name: Deploy to QA
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    steps:
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USERNAME }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            set -euo pipefail
+
+            echo "Pulling image..."
+            echo "${{ secrets.TOKEN }}" | docker login ${{ env.REGISTRY_URL }} -u ${{ gitea.actor }} --password-stdin
+            docker pull ${{ env.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-push.outputs.image_tag }}
+
+            echo "Stopping existing container..."
+            docker stop cicd-qa 2>/dev/null || true
+            docker rm cicd-qa 2>/dev/null || true
+
+            echo "Starting new container..."
+            docker run -d \
+              --name cicd-qa \
+              --restart unless-stopped \
+              -p 8081:80 \
+              -e APP_ENV=qa \
+              -e APP_VERSION=dev-${{ gitea.sha }} \
+              -e GIT_COMMIT=${{ gitea.sha }} \
+              -e GIT_BRANCH=dev \
+              -e BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+              -e DEPLOY_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+              -e BUILD_NUMBER=${{ gitea.run_id }} \
+              ${{ env.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-push.outputs.image_tag }}
+
+            echo "Waiting for health check..."
+            for i in $(seq 1 12); do
+              if curl -sf http://localhost:8081/health > /dev/null 2>&1; then
+                echo "::notice::QA deployment healthy"
+                exit 0
+              fi
+              sleep 5
+            done
+
+            echo "::error::QA health check failed"
+            exit 1
+
+  notify:
+    name: Notification
+    runs-on: ubuntu-latest
+    needs: [build-and-push, deploy]
+    if: always()
+    steps:
+      - name: Write summary
+        run: |
+          cat << 'SUMMARY' >> $GITEA_HOME/workflow/summary
+          ## QA Deployment ${{ needs.deploy.result }}
+
+          **Branch:** dev
+          **Commit:** ${{ gitea.sha }}
+          **Image:** ${{ vars.REGISTRY_URL }}/${{ vars.IMAGE_NAME }}:qa-latest
+          **URL:** https://practicas.qa.kubistudio.cloud
+          SUMMARY
@@ -0,0 +1,115 @@
+name: Deploy Staging
+
+on:
+  push:
+    branches:
+      - staging
+
+env:
+  REGISTRY_URL: ${{ vars.REGISTRY_URL }}
+  IMAGE_NAME: ${{ vars.IMAGE_NAME }}
+  APP_ENV: staging
+
+jobs:
+  build-and-push:
+    name: Build and Push
+    runs-on: ubuntu-latest
+    outputs:
+      image_tag: ${{ steps.meta.outputs.image_tag }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Gitea Registry
+        run: |
+          set -euo pipefail
+          echo "${{ secrets.TOKEN }}" | docker login $REGISTRY_URL -u ${{ gitea.actor }} --password-stdin
+
+      - name: Build and push
+        id: meta
+        run: |
+          set -euo pipefail
+          SHA_TAG="${{ gitea.sha }}"
+          STAGING_TAG="staging-latest"
+          BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+          docker buildx build \
+            --push \
+            --build-arg APP_VERSION=staging-${SHA_TAG} \
+            --build-arg BUILD_DATE=${BUILD_DATE} \
+            --build-arg GIT_COMMIT=${SHA_TAG} \
+            --build-arg GIT_BRANCH=staging \
+            -t ${REGISTRY_URL}/${IMAGE_NAME}:${STAGING_TAG} \
+            -t ${REGISTRY_URL}/${IMAGE_NAME}:sha-${SHA_TAG} \
+            .
+
+          echo "image_tag=${STAGING_TAG}" >> $GITEA_OUTPUT
+          echo "::notice::Image pushed: ${REGISTRY_URL}/${IMAGE_NAME}:${STAGING_TAG}"
+
+  deploy:
+    name: Deploy to Staging
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    steps:
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ secrets.DEPLOY_HOST }}
+          username: ${{ secrets.DEPLOY_USERNAME }}
+          key: ${{ secrets.DEPLOY_SSH_KEY }}
+          script: |
+            set -euo pipefail
+
+            echo "Pulling image..."
+            echo "${{ secrets.TOKEN }}" | docker login ${{ env.REGISTRY_URL }} -u ${{ gitea.actor }} --password-stdin
+            docker pull ${{ env.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-push.outputs.image_tag }}
+
+            echo "Stopping existing container..."
+            docker stop cicd-staging 2>/dev/null || true
+            docker rm cicd-staging 2>/dev/null || true
+
+            echo "Starting new container..."
+            docker run -d \
+              --name cicd-staging \
+              --restart unless-stopped \
+              -p 8082:80 \
+              -e APP_ENV=staging \
+              -e APP_VERSION=staging-${{ gitea.sha }} \
+              -e GIT_COMMIT=${{ gitea.sha }} \
+              -e GIT_BRANCH=staging \
+              -e BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+              -e DEPLOY_TIME=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+              -e BUILD_NUMBER=${{ gitea.run_id }} \
+              ${{ env.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:${{ needs.build-and-push.outputs.image_tag }}
+
+            echo "Running smoke tests..."
+            RESPONSE=$(curl -sf http://localhost:8082/health)
+            echo "Health response: $RESPONSE"
+
+            ENV_VALUE=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['env'])" 2>/dev/null || echo "unknown")
+            if [ "$ENV_VALUE" != "staging" ]; then
+              echo "::error::Smoke test failed: expected env=staging, got env=$ENV_VALUE"
+              exit 1
+            fi
+
+            echo "::notice::Staging smoke tests passed"
+
+  notify:
+    name: Notification
+    runs-on: ubuntu-latest
+    needs: [build-and-push, deploy]
+    if: always()
+    steps:
+      - name: Write summary
+        run: |
+          cat << 'SUMMARY' >> $GITEA_HOME/workflow/summary
+          ## Staging Deployment ${{ needs.deploy.result }}
+
+          **Branch:** staging
+          **Commit:** ${{ gitea.sha }}
+          **Image:** ${{ vars.REGISTRY_URL }}/${{ vars.IMAGE_NAME }}:staging-latest
+          **URL:** https://practicas.staging.kubistudio.cloud
+          SUMMARY