ci-cd-and-automation

Create a workflow file at .github/workflows/ci.yml that triggers on pull requests and pushes to main. Add sequential steps for dependency install, lint, type check, tests, build, and security audit, using actions/setup-node with npm caching.

Define a postgres service container in the job with health checks, then run migrations and tests against localhost:5432. Store the database password in GitHub Secrets rather than hardcoding credentials in the workflow file.

A complete pipeline includes lint, type checking, unit tests, build, integration tests, optional E2E tests, security audit, and bundle size checks. No gate should be skipped; failures must block merge through branch protection rules.

Slow pipelines usually lack dependency caching and run jobs sequentially. Apply setup-node caching, split lint, typecheck, and test into parallel jobs, use path filters to skip unrelated work, and shard test suites with matrix builds.

No, CI should never hold production secrets. Use separate secrets for CI testing stored in GitHub Secrets, keep production credentials in the deployment platform or a vault, and commit only .env.example templates.

Use feature flags when you want to merge incomplete or risky features to main without releasing them. Flags enable canary rollouts, instant rollback without redeploying, and A/B testing, but should be removed after full rollout.