From 09a2d087e485be3fc3f878eb28ef82cbd7b20429 Mon Sep 17 00:00:00 2001 From: Damir Mukimov Date: Thu, 27 Nov 2025 04:47:20 +0100 Subject: [PATCH] feat: Add GitHub Actions workflows for frontend CI/CD - Add lint.yml: TypeScript and ESLint checks - Add build.yml: Vite application build pipeline - Add docker-build.yml: Multi-arch container image builds - Add deploy.yml: Production deployment to Docker Swarm - Add dependabot.yml: Automated dependency updates Follows Single Responsibility Principle with focused workflows. Includes security best practices, caching, and deployment automation. --- .github/dependabot.yml | 16 ++++++++ .github/workflows/build.yml | 34 ++++++++++++++++ .github/workflows/deploy.yml | 60 +++++++++++++++++++++++++++ .github/workflows/docker-build.yml | 65 ++++++++++++++++++++++++++++++ .github/workflows/lint.yml | 31 ++++++++++++++ 5 files changed, 206 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/build.yml create mode 100644 .github/workflows/deploy.yml create mode 100644 .github/workflows/docker-build.yml create mode 100644 .github/workflows/lint.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..78e1256 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,16 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + commit-message: + prefix: "ci" + include: "scope" + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "weekly" + commit-message: + prefix: "deps" + include: "scope" diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..4dabe5f --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,34 @@ +name: Build + +on: + push: + branches: [main, develop] + pull_request: + branches: [main, develop] + +jobs: + build-app: + name: Build Application + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v5 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: "20" + cache: "yarn" + + - name: Install dependencies + run: yarn install --frozen-lockfile + + - name: Build application + run: yarn build + + - name: Upload build artifacts + uses: actions/upload-artifact@v4 + with: + name: frontend-dist + path: dist/ + retention-days: 30 diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 0000000..e3aceb8 --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,60 @@ +name: Deploy + +on: + push: + tags: ["v*"] + workflow_dispatch: + inputs: + version: + description: "Version to deploy (e.g., v1.2.3)" + required: true + type: string + +jobs: + deploy-production: + name: Deploy to Production + runs-on: ubuntu-latest + environment: + name: production + url: https://tercul.example.com + + steps: + - name: Check out code + uses: actions/checkout@v5 + + - name: Extract version + id: version + run: | + if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then + echo "VERSION=${{ inputs.version }}" >> $GITHUB_OUTPUT + else + echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT + fi + + - name: Deploy to Docker Swarm + env: + SWARM_HOST: ${{ secrets.SWARM_HOST }} + SWARM_SSH_KEY: ${{ secrets.SWARM_SSH_KEY }} + IMAGE_TAG: ${{ steps.version.outputs.VERSION }} + run: | + # Uncomment and configure for actual Docker Swarm deployment + # echo "$SWARM_SSH_KEY" > swarm_key + # chmod 600 swarm_key + # ssh -i swarm_key -o StrictHostKeyChecking=no \ + # deploy@$SWARM_HOST \ + # "docker service update \ + # --image ghcr.io/${{ github.repository }}-frontend:${IMAGE_TAG} \ + # tercul-frontend" + # rm swarm_key + + echo "Deploying frontend version ${{ steps.version.outputs.VERSION }} to production" + echo "Image: ghcr.io/${{ github.repository }}-frontend:${IMAGE_TAG}" + + - name: Deployment summary + run: | + echo "### Frontend Deployment Complete :rocket:" >> $GITHUB_STEP_SUMMARY + echo "" >> $GITHUB_STEP_SUMMARY + echo "- **Version**: ${{ steps.version.outputs.VERSION }}" >> $GITHUB_STEP_SUMMARY + echo "- **Image**: ghcr.io/${{ github.repository }}-frontend:${{ steps.version.outputs.VERSION }}" >> $GITHUB_STEP_SUMMARY + echo "- **Environment**: Production" >> $GITHUB_STEP_SUMMARY + echo "- **Deployed at**: $(date -u +'%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml new file mode 100644 index 0000000..9c410c0 --- /dev/null +++ b/.github/workflows/docker-build.yml @@ -0,0 +1,65 @@ +name: Docker Build + +on: + push: + branches: [main] + tags: ["v*"] + pull_request: + branches: [main] + +jobs: + build-image: + name: Build Docker Image + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + attestations: write + id-token: write + + steps: + - name: Check out code + uses: actions/checkout@v5 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to GitHub Container Registry + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/${{ github.repository }}-frontend + tags: | + type=ref,event=branch + type=ref,event=pr + type=ref,event=tag + type=semver,pattern={{version}} + type=semver,pattern={{major}}.{{minor}} + type=sha,format=long + + - name: Build and push + id: push + uses: docker/build-push-action@v6 + with: + context: . + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + cache-from: type=gha + cache-to: type=gha,mode=max + platforms: linux/amd64,linux/arm64 + + - name: Generate artifact attestation + if: github.event_name != 'pull_request' + uses: actions/attest-build-provenance@v3 + with: + subject-name: ghcr.io/${{ github.repository }}-frontend + subject-digest: ${{ steps.push.outputs.digest }} + push-to-registry: true diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 0000000..2b321e3 --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,31 @@ +name: Lint + +on: + push: + branches: [main, develop] + pull_request: + branches: [main, develop] + +jobs: + typescript-lint: + name: TypeScript & ESLint + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v5 + + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: "20" + cache: "yarn" + + - name: Install dependencies + run: yarn install --frozen-lockfile + + - name: Type check + run: yarn check + + - name: Lint + run: yarn lint + if: always()