Skip to content

Commit e52ed6f

Browse files
YilingCAIYilingCAI
committed
first version backend and frontend
1 parent e00ea2f commit e52ed6f

120 files changed

Lines changed: 25930 additions & 5067 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/WORKFLOWS.md‎

Lines changed: 341 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,341 @@
1+
# 🚀 Production-Grade CI/CD Platform
2+
3+
Enterprise-level GitHub Actions workflows for continuous integration and continuous deployment to AWS Fargate.
4+
5+
## 📦 What's Included
6+
7+
### ✅ Workflows
8+
- **CI Pipeline** (`ci.yml`) - Comprehensive testing and security scanning
9+
- **Build & Push** (`build-push-ecr.yml`) - Docker image building and ECR push
10+
- **Terraform Planning** (`terraform-plan.yml`) - Infrastructure planning with validation
11+
- **Terraform Apply** (`terraform-apply.yml`) - Infrastructure deployment
12+
- **Fargate Deployment** (`deploy-fargate.yml`) - ECS service deployment with health checks
13+
- **Staging Deployment** (`deploy-staging.yml`) - Automated staging deployment pipeline
14+
- **Production Deployment** (`deploy-prod.yml`) - Gated production deployment pipeline
15+
16+
### 🔐 Security
17+
- SAST scanning (Bandit, ESLint)
18+
- Secret scanning (GitGuardian)
19+
- Dependency analysis (Snyk)
20+
- Container scanning (Trivy)
21+
- Infrastructure scanning (Checkov, tflint)
22+
- OIDC-based AWS authentication (no secrets!)
23+
24+
### 🛠️ Reusable Actions
25+
- `terraform-validate` - Comprehensive Terraform validation
26+
- `ecs-deploy` - ECS service deployment helper
27+
28+
### 📋 Configuration
29+
- `.trivyignore` - Trivy vulnerability exceptions
30+
- `CODEOWNERS` - Code ownership and review requirements
31+
- `config.json` - Environment-specific configuration
32+
33+
### 📚 Documentation
34+
- `README.md` - Complete workflow documentation
35+
- `.github/workflows/ENTERPRISE_STANDARDS.md` - Enterprise best practices
36+
- `QUICKSTART_CI_CD.md` - Quick start guide
37+
- `DEPLOYMENT_GUIDE.md` - Complete deployment guide
38+
- `SECURITY.md` - Security policy
39+
40+
## 🚀 Quick Start
41+
42+
### 1. Bootstrap AWS (5 minutes)
43+
44+
```bash
45+
chmod +x scripts/bootstrap.sh
46+
./scripts/bootstrap.sh
47+
```
48+
49+
This creates:
50+
- S3 bucket for Terraform state
51+
- DynamoDB table for state locking
52+
- ECR repositories for images
53+
- IAM role for GitHub OIDC
54+
55+
### 2. Configure GitHub Secrets (2 minutes)
56+
57+
```bash
58+
gh secret set AWS_ROLE_TO_ASSUME --body "arn:aws:iam::ACCOUNT:role/GitHubActionsRole"
59+
gh secret set TERRAFORM_STATE_BUCKET --body "terraform-state-ACCOUNT"
60+
gh secret set TERRAFORM_LOCK_TABLE --body "terraform-locks"
61+
```
62+
63+
### 3. Create GitHub Environments (2 minutes)
64+
65+
- `staging` - Auto-deploy
66+
- `prod-approval` - Requires approval for Terraform
67+
- `prod-deployment` - Requires approval for deployment
68+
69+
### 4. Deploy to Staging (1 minute)
70+
71+
```bash
72+
git push origin develop
73+
# → Automatically deploys to staging
74+
```
75+
76+
See [QUICKSTART_CI_CD.md](../QUICKSTART_CI_CD.md) for detailed guide.
77+
78+
## 📊 Workflow Pipeline Overview
79+
80+
```
81+
┌─────────────────────────────────────────────┐
82+
│ Pull Request / Push to Develop │
83+
└─────────────────────────────────────────────┘
84+
↓
85+
┌─────────────────────────────────────────────┐
86+
│ CI: Security Scanning & Testing │
87+
│ - SAST (Bandit, ESLint) │
88+
│ - Secrets (GitGuardian) │
89+
│ - Dependencies (Snyk) │
90+
│ - Tests (pytest, Jest) │
91+
│ - Coverage reporting │
92+
└─────────────────────────────────────────────┘
93+
↓
94+
┌─────────────────────────────────────────────┐
95+
│ Build: Docker Image Creation │
96+
│ - Multi-stage builds │
97+
│ - Layer caching │
98+
│ - Container scanning (Trivy) │
99+
│ - Push to ECR │
100+
└─────────────────────────────────────────────┘
101+
↓
102+
(For Develop Branch)
103+
↓
104+
┌─────────────────────────────────────────────┐
105+
│ Infrastructure: Terraform Plan │
106+
│ - Format validation │
107+
│ - Linting (tflint) │
108+
│ - IaC scanning (Checkov) │
109+
│ - Plan generation │
110+
└─────────────────────────────────────────────┘
111+
↓
112+
┌─────────────────────────────────────────────┐
113+
│ Deploy to Fargate │
114+
│ - Pre-deployment validation │
115+
│ - Task definition update │
116+
│ - Service deployment │
117+
│ - Health checks │
118+
│ - Smoke tests │
119+
│ - Automatic rollback on failure │
120+
└─────────────────────────────────────────────┘
121+
↓
122+
┌─────────────────────────────────────────────┐
123+
│ Staging Environment Live ✅ │
124+
└─────────────────────────────────────────────┘
125+
```
126+
127+
## 🔄 Environment-Specific Flows
128+
129+
### Staging (Automatic)
130+
```
131+
develop push
132+
↓
133+
CI ✓
134+
↓
135+
Build ✓
136+
↓
137+
Terraform plan ✓
138+
↓
139+
Terraform apply ✓ (auto)
140+
↓
141+
Deploy to Fargate ✓ (auto)
142+
↓
143+
✅ Live in staging
144+
```
145+
146+
### Production (Controlled)
147+
```
148+
main push
149+
↓
150+
Pre-release checks ✓
151+
↓
152+
CI ✓
153+
↓
154+
Build ✓
155+
↓
156+
Terraform plan ✓
157+
↓
158+
🔒 Approval required
159+
↓
160+
Terraform apply ✓
161+
↓
162+
🔒 Approval required
163+
↓
164+
Deploy to Fargate ✓
165+
↓
166+
Post-deployment validation ✓
167+
↓
168+
✅ Live in production
169+
```
170+
171+
## 📚 Documentation Structure
172+
173+
```
174+
.
175+
├── .github/
176+
│ ├── workflows/
177+
│ │ ├── README.md .......................... This file
178+
│ │ ├── config.json ....................... Environment configuration
179+
│ │ ├── ci.yml ............................ CI pipeline
180+
│ │ ├── build-push-ecr.yml ................ Docker build
181+
│ │ ├── terraform-plan.yml ................ Infra planning
182+
│ │ ├── terraform-apply.yml ............... Infra apply
183+
│ │ ├── deploy-fargate.yml ................ ECS deployment
184+
│ │ ├── deploy-staging.yml ................ Staging orchestration
185+
│ │ └── deploy-prod.yml ................... Production orchestration
186+
│ ├── actions/
187+
│ │ ├── terraform-validate/ ............... Terraform validation action
188+
│ │ ├── ecs-deploy/ ....................... ECS deployment action
189+
│ │ └── aws-assume-role/ .................. AWS auth action
190+
│ └── CODEOWNERS ............................ Code ownership
191+
├── SECURITY.md ............................... Security policy
192+
├── ENTERPRISE_STANDARDS.md ................... Best practices
193+
├── QUICKSTART_CI_CD.md ....................... Quick start
194+
├── DEPLOYMENT_GUIDE.md ....................... Full deployment guide
195+
└── scripts/
196+
└── bootstrap.sh .......................... AWS setup automation
197+
```
198+
199+
## 🔑 Key Features
200+
201+
### Security First
202+
- No hardcoded credentials
203+
- OIDC-based AWS authentication
204+
- Automated security scanning
205+
- Vulnerability detection
206+
- Secret scanning
207+
208+
### Reliability
209+
- Health checks and monitoring
210+
- Automatic rollback on failure
211+
- Blue-green deployment ready
212+
- Multi-AZ architecture
213+
- Comprehensive logging
214+
215+
### Compliance
216+
- Audit trails
217+
- Change management
218+
- Approval workflows
219+
- Environment parity
220+
- Documentation
221+
222+
### Developer Experience
223+
- Fast feedback loops
224+
- Clear error messages
225+
- Easy rollback
226+
- PR status checks
227+
- Deployment notifications
228+
229+
## 🎯 Common Tasks
230+
231+
### Deploy to Staging
232+
```bash
233+
git push origin develop
234+
# Automatically deploys after ~15 minutes
235+
```
236+
237+
### Deploy to Production
238+
```bash
239+
git push origin main
240+
# Triggers approval workflow
241+
# Review Terraform plan
242+
# Approve deployment
243+
# Deploys after ~20 minutes
244+
```
245+
246+
### Rollback Deployment
247+
```bash
248+
# Automatic rollback on failure
249+
# Manual rollback: See DEPLOYMENT_GUIDE.md
250+
```
251+
252+
### View Logs
253+
```bash
254+
# GitHub Actions
255+
gh run list
256+
gh run view [run-id] --log
257+
258+
# Application logs
259+
aws logs tail /ecs/mypythonproject1 --follow
260+
```
261+
262+
## 🔍 Monitoring & Troubleshooting
263+
264+
### Check Pipeline Status
265+
```bash
266+
# List recent runs
267+
gh run list
268+
269+
# View specific run
270+
gh run view [run-id]
271+
272+
# View detailed logs
273+
gh run view [run-id] --log
274+
```
275+
276+
### Check Application Status
277+
```bash
278+
# ECS services
279+
aws ecs describe-services \
280+
--cluster mypythonproject1-cluster-prod \
281+
--services backend-service-prod
282+
283+
# Application logs
284+
aws logs tail /ecs/mypythonproject1 --follow
285+
```
286+
287+
### Troubleshoot Issues
288+
See [DEPLOYMENT_GUIDE.md](../DEPLOYMENT_GUIDE.md#-troubleshooting) for common issues and solutions.
289+
290+
## 🆘 Need Help?
291+
292+
1. **Quick questions** → Check [QUICKSTART_CI_CD.md](../QUICKSTART_CI_CD.md)
293+
2. **Deployment issues** → See [DEPLOYMENT_GUIDE.md](../DEPLOYMENT_GUIDE.md)
294+
3. **Security concerns** → Review [SECURITY.md](../SECURITY.md)
295+
4. **Enterprise standards** → Read [ENTERPRISE_STANDARDS.md](../ENTERPRISE_STANDARDS.md)
296+
5. **Workflow details** → Check individual workflow files
297+
298+
## 📊 Security Scanning Details
299+
300+
### SAST Scanning
301+
- **Bandit** (Python): `bandit -r app/ --severity-level HIGH`
302+
- **ESLint** (JavaScript): `eslint --ext .ts,.js src/`
303+
304+
### Dependency Scanning
305+
- **Snyk**: Scans Python and Node.js dependencies
306+
307+
### Container Scanning
308+
- **Trivy**: Scans Docker images for vulnerabilities
309+
310+
### IaC Scanning
311+
- **Checkov**: Terraform security validation
312+
- **tflint**: Terraform best practices
313+
314+
### Secret Scanning
315+
- **GitGuardian**: Detects secrets in code
316+
317+
## 🚀 Next Steps
318+
319+
1. ✅ Read this README
320+
2. ✅ Run bootstrap script
321+
3. ✅ Configure GitHub secrets
322+
4. ✅ Deploy to staging
323+
5. ✅ Review DEPLOYMENT_GUIDE.md
324+
6. ✅ Deploy to production
325+
7. ✅ Monitor first deployment
326+
327+
## 📞 Support
328+
329+
- **Issues?** Check the documentation
330+
- **Questions?** Review the workflow files
331+
- **Help needed?** Contact your DevOps team
332+
333+
## 📄 License
334+
335+
See LICENSE file in project root.
336+
337+
---
338+
339+
**Last Updated:** February 17, 2026
340+
**Version:** 1.0.0
341+
**Status:** Production Ready ✅

0 commit comments

Comments
 (0)