cicd-automation

Create a workflow that checks out code, sets up Python 3.13, installs ruff, mypy, and pytest, then runs lint, strict type checking, and tests with a coverage threshold. Add integration and security jobs using MySQL services and pip-audit.

Use actions/setup-node with pnpm caching, run pnpm install with frozen lockfile, then execute lint, tsc --noEmit, tests with coverage, and audit. A separate build job uploads the dist folder as an artifact.

Yes, use the paths filter under push and pull_request triggers, such as paths: ['ai-server/**'], so the backend CI only runs when backend files change. This avoids wasting runner minutes on unrelated commits.

Build the project with pnpm build, sync the dist directory to the S3 bucket using aws s3 sync, then create a CloudFront invalidation for all paths. Store the bucket name and distribution ID as CI secrets.

Templates cover common quality, integration, and security stages but require manual adjustment for custom test databases, non-AWS hosting, or monorepo structures beyond the assumed folder layout. Always validate with a manual trigger before enabling automatic runs.