ci-cd-and-automation

Create a workflow file at .github/workflows/ci.yml triggered on pull requests and pushes to main. Add sequential steps for dependency install, lint, type check, tests, build, and security audit, using actions/setup-node with npm caching for speed.

Define a Postgres service container in the job with health checks, then run migrations and tests against localhost:5432. Store the database password in GitHub Secrets rather than hardcoding it in the workflow file.

A complete pipeline runs lint, type checking, unit tests, build, integration tests, optional E2E tests, security audit, and bundle size checks. No gate should be skippable, and branch protection should block merges when any check fails.

Slow pipelines usually lack dependency caching and run jobs sequentially. Enable the setup-node cache option, split lint, typecheck, and test into parallel jobs, use path filters to skip unrelated work, and shard large test suites across runners.

Create a manually triggered workflow_dispatch workflow that accepts a version input and redeploys that previous release. Pair it with staged rollouts and a post-deploy monitoring window so errors trigger rollback before wide impact.

No, CI should never hold production secrets. Use separate credentials for CI test environments stored in GitHub Secrets, keep production secrets in the deployment platform or a vault, and commit only .env.example templates.