Лучшие приёмы и практики CI/CD пайплайнов

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        shard: [1, 2, 3, 4]
    steps:
      - uses: actions/checkout@v3
      - name: Set up JDK 17
        uses: actions/setup-java@v3
        with:
          java-version: '17'
          distribution: 'temurin'
      - name: Test with Maven
        run: mvn test -Dsurefire.includePercentage=25 -Dsurefire.shardNumber=${{ matrix.shard }}

apiVersion: v1
kind: Secret
metadata:
  name: api-credentials
type: Opaque
data:
  username: YWRtaW4=  # base64-encoded "admin"
  password: cGFzc3dvcmQxMjM=  # base64-encoded "password123"

jobs:
  deploy:
    steps:
      - name: Deploy to production
        env:
          API_KEY: ${{ secrets.PRODUCTION_API_KEY }}
        run: ./deploy.sh

# Пример правила оповещения в Prometheus
groups:
name: pipeline_alerts
  rules:
  - alert: PipelineFailureRate
    expr: sum(rate(pipeline_runs_failed_total[15m])) by (project) / sum(rate(pipeline_runs_total[15m])) by (project) > 0.1
    for: 5m
    labels:
      severity: warning
    annotations:
      summary: "Pipeline failure rate high for {{ $labels.project }}"
      description: "Pipeline failure rate is {{ $value | humanize }} over the last 15 minutes"

# Тест для GitHub Actions workflow
name: Test Workflow
 
on: [pull_request]
 
jobs:
  test_workflow:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up act
        run: |
          curl -s [url]https://raw.githubusercontent.com/nektos/act/master/install.sh[/url] | sudo bash
      - name: Test workflow with act
        run: act -j build -W .github/workflows/build.yml --dry-run

name: Spring Boot CI/CD
 
on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
 
jobs:
  build:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v3
    
    - name: Set up JDK 17
      uses: actions/setup-java@v3
      with:
        java-version: '17'
        distribution: 'temurin'
        cache: maven
    
    - name: Build with Maven
      run: mvn -B package --file pom.xml
    
    - name: Run tests
      run: mvn test
    
    - name: Static code analysis
      run: mvn sonar:sonar -Dsonar.projectKey=myorg_myapp -Dsonar.organization=myorg -Dsonar.host.url=https://sonarcloud.io
    
    - name: Build Docker image
      run: |
        docker build -t myorg/myapp:${{ github.sha }} .
        docker tag myorg/myapp:${{ github.sha }} myorg/myapp:latest
    
    - name: Push Docker image
      if: github.ref == 'refs/heads/main'
      run: |
        echo ${{ secrets.DOCKER_PASSWORD }} | docker login -u ${{ secrets.DOCKER_USERNAME }} --password-stdin
        docker push myorg/myapp:${{ github.sha }}
        docker push myorg/myapp:latest

name: React App CI/CD
 
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
 
jobs:
  test:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v3
    
    - name: Setup Node.js
      uses: actions/setup-node@v3
      with:
        node-version: '16'
        cache: 'npm'
    
    - name: Install dependencies
      run: npm ci
    
    - name: Lint
      run: npm run lint
    
    - name: Test
      run: npm test -- --coverage
    
    - name: Build
      run: npm run build
    
    - name: Deploy to S3
      if: github.ref == 'refs/heads/main'
      uses: jakejarvis/s3-sync-action@master
      with:
        args: --delete
      env:
        AWS_S3_BUCKET: ${{ secrets.AWS_S3_BUCKET }}
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        SOURCE_DIR: 'build'

name: Django CI/CD
 
on:
  push:
    branches: [ main, dev ]
  pull_request:
    branches: [ main ]
 
jobs:
  test:
    runs-on: ubuntu-latest
    
    services:
      postgres:
        image: postgres:13
        env:
          POSTGRES_USER: postgres
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: test_db
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    
    steps:
    - uses: actions/checkout@v3
    
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
        cache: 'pip'
    
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install flake8 pytest coverage
    
    - name: Lint with flake8
      run: |
        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
    
    - name: Test with pytest
      env:
        DATABASE_URL: postgres://postgres:postgres@localhost:5432/test_db
      run: |
        pytest --cov=./ --cov-report=xml
    
    - name: Deploy to Heroku
      if: github.ref == 'refs/heads/main'
      uses: akhileshns/heroku-deploy@v3.12.12
      with:
        heroku_api_key: ${{ secrets.HEROKU_API_KEY }}
        heroku_app_name: ${{ secrets.HEROKU_APP_NAME }}
        heroku_email: ${{ secrets.HEROKU_EMAIL }}

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: myapp-rollout
spec:
  replicas: 5
  strategy:
    canary:
      steps:
      - setWeight: 20
      - pause: {duration: 10m}
      - setWeight: 40
      - pause: {duration: 10m}
      - setWeight: 60
      - pause: {duration: 10m}
      - setWeight: 80
      - pause: {duration: 10m}
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: myapp:1.0
        ports:
        - containerPort: 8080

# Пайплайн для GitLab CI
stages:
  - build
  - test
  - scan
  - publish
  - deploy
 
variables:
  IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
 
build:
  stage: build
  script:
    - ./gradlew build
 
test:
  stage: test
  script:
    - ./gradlew test
 
build_image:
  stage: publish
  script:
    - docker build -t $IMAGE_TAG .
    - docker push $IMAGE_TAG
 
scan_image:
  stage: scan
  script:
    - trivy image $IMAGE_TAG
 
deploy_to_k8s:
  stage: deploy
  script:
    - sed -i "s/__IMAGE__/$IMAGE_TAG/g" k8s/deployment.yaml
    - kubectl apply -f k8s/deployment.yaml

# Пример Argo CD Application
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: myapp
  namespace: argocd
spec:
  project: default
  source:
    repoURL: [url]https://github.com/myorg/myapp.git[/url]
    targetRevision: HEAD
    path: k8s
  destination:
    server: [url]https://kubernetes.default.svc[/url]
    namespace: myapp
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

# Kubernetes Blue/Green с Istio
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-service
spec:
  hosts:
  - my-service.example.com
  http:
  - route:
    - destination:
        host: my-service-green
        port:
          number: 8080
      weight: 0
    - destination:
        host: my-service-blue
        port:
          number: 8080
      weight: 100

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  MyPipeline:
    Type: 'AWS::CodePipeline::Pipeline'
    Properties:
      RoleArn: !GetAtt CodePipelineServiceRole.Arn
      ArtifactStore:
        Type: S3
        Location: !Ref ArtifactBucket
      Stages:
        - Name: Source
          Actions:
            - Name: Source
              ActionTypeId:
                Category: Source
                Owner: AWS
                Provider: CodeStarSourceConnection
                Version: '1'
              Configuration:
                ConnectionArn: !Ref GitHubConnection
                FullRepositoryId: myorg/myapp
                BranchName: main
              OutputArtifacts:
                - Name: SourceCode
        - Name: Build
          Actions:
            - Name: BuildAndTest
              ActionTypeId:
                Category: Build
                Owner: AWS
                Provider: CodeBuild
                Version: '1'
              Configuration:
                ProjectName: !Ref BuildProject
              InputArtifacts:
                - Name: SourceCode
              OutputArtifacts:
                - Name: BuildOutput
        - Name: Deploy
          Actions:
            - Name: DeployToECS
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Provider: ECS
                Version: '1'
              Configuration:
                ClusterName: !Ref ECSCluster
                ServiceName: !Ref ECSService
                FileName: imagedefinitions.json
              InputArtifacts:
                - Name: BuildOutput