devops-deployment

The skill generates a six-stage GitHub Actions workflow covering lint, test, security scan, Docker build and push, staging deploy, and production deploy. It includes dependency caching with lockfile-hashed keys and Trivy vulnerability scanning.

Use separate stages for dependency installation, building, and a minimal production runtime, copying only production node_modules and compiled artifacts into the final stage. This pattern reduces a typical Node.js image from about 850 MB to 180 MB.

Use Nixpacks for standard app stacks since it auto-detects the language and requires zero configuration. Switch to a Dockerfile when you need multi-stage builds, custom base images, or system dependencies Nixpacks does not support.

Use a three-phase migration: add the column as nullable, deploy code that writes to it and backfill existing rows, then add the NOT NULL constraint. Always deploy migrations before the application code that depends on them.

Run as a non-root user with the USER directive, never pass secrets via ARG or ENV, use a .dockerignore to exclude .env and .git, prefer alpine base images, and add a HEALTHCHECK for orchestrator integration.

Blue-green suits instant rollback needs but doubles resource usage, while canary limits blast radius by shifting traffic gradually at the cost of more complex traffic management. Rolling updates remain the default for zero-downtime with automatic rollback.