ci-cd-pipeline

Define sequential jobs for lint, unit tests, integration tests, security scans, and Docker image builds, then add staging and production deploy jobs gated by branch and manual approval. Use GitHub Secrets for credentials and environments for per-stage configuration.

Canary deployment shifts traffic gradually (10% to 50% to 100%) while monitoring error rates, reducing risk but taking longer. Blue-green runs a full parallel environment and switches the load balancer instantly, giving fast rollback at double infrastructure cost.

Run tests with coverage reporting, then add a blocking step that parses the coverage summary and exits with a failure if line coverage falls below the threshold, such as 80%. This prevents merges and deployments of under-tested code.

Build the image in the pipeline, then run Trivy against the image reference with severity filters like CRITICAL and HIGH and a non-zero exit code. Combine this with npm audit for dependencies and TruffleHog for secret detection.

Update the ECS service to point at the previous task definition version, which is why images must be tagged with Git SHAs and the last 10 production versions retained. Automate this by monitoring the error rate post-deploy and triggering rollback when it exceeds a threshold like 5%.

Production deployments should always require a manual approval gate, with only staging auto-deploying on merge to main. Auto-deploy to production is inappropriate for user-facing or critical services where a canary or blue-green strategy with human sign-off is needed.