CI‐CD

CI/CD components

GitHub actions

We are using GitHub actions for our CI/CD. That means that everything can be found in the GitHub, including logs, found vulnerabilities code coverage, build statuses etc. The actions are using self-hosted GitHub runner on our infra server, therefore all of the CI/CD runs are "free" and no additional fees come from the GitHub.

Codecov

We are also using self-hosted codecov service, which allows us to store code coverage info from CI runs and analyze. In order to access the service you need to login here via your GitHub account, which should be added to the Alt-Org organization. Also this service provides checks on PRs for code coverage percentages.

Stages and steps:

1. Run tests - runs on every PR or mush to dev/main/prod branches

   • Checkout code - downloading code from the repo
   • Setup Node.js - downloading Node.js with npm
   • Install dependencies - installing dependencies from package.json
   • Run tests, first attempt - running all tests from test-folder
   • Identify failed test suites - sometimes part of the tests might not pass when everything is run in a bunch, therefore we need to run failed tests again to check whenever they are actually failing or is it just a technical issue.
   • Re-run failed test suites individually - rerun each failed test one-by-one
   • Upload coverage reports to Codecov

2. Build and Push Docker Image - runs only on pushes (including merges) to dev/main/prod branches

   • Checkout code - downloading code from the repo
   • Log in to Docker Hub - logging-in to docker hub via username and token
   • Build and push image - build image from Dockerfile in the root folder and push it with two tags: branch_name-latest and branch_name-gh_actions_run_number
   • Scan image for vulnerabilities - check if the build image has vulnerabilities that can be fixed with Trivy scanner. It will not block CI/CD if any found.
   • Upload vulnerabilities to summary tab - vulnerabilities will be listed in the action run Summary tab, i.e. here.
   • Convert scan results to SARIF format - required for the next step
   • Upload vulnerabilities to Security tab - vulnerabilities can be found in repo Security and quality tab

3. Notify server about new image build - runs only on pushes (including merges) to dev/main/prod branches

   • Notify server - send notification to prod server that a new image available. The server will then download the image from docker hub and replace the old one. The branch name defines which API version will be updated, i.e. dev will update dev version.

Configuration

CI/CD can be used as it is now, but additionally some adjustments can be made.

CI/CD flow - ci.yaml

The CI/CD is completely defined in the .github/workflows/ci.yaml. If you make a change to this file and push it the CI/CD in the current branch will reflect the changes immediately.

Unless something breaks, do not change the file if you do not understand what each section does, especially with AI.

If you have decided to add a new stage/step, be mindful about it as every new thing will make runs longer and will use more resources of our infra server, which is not that powerful.

Code coverage - codecov.yml

Codecov can be configured in the codecov.yml file in the root dir. It can have many advanced configurations, here is the reference. The most useful is coverage targets (=min accepted coverage), where project-section means the whole code base and patch-section means the changed code in a PR/commit.

Things to notice

When CI/CD is running all of the server resources are in use, therefore any other service, i.e. Codecov, will be unresponsive. It is recommended to let the server run the CI/CD in peace.