GitHub Actions & Jenkins Pipelines Deep Dive

name: CI Advanced
on:
  push:
    branches: [ main, 'feat/**' ]
  pull_request:
    branches: [ main ]

jobs:
  # ── Job 1: Lint (runs first, alone) ─────────
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci && npm run lint

  # ── Job 2: Test on 3 Node versions (PARALLEL) ─
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [ 18, 20, 22 ]  # 3 parallel jobs
      fail-fast: false               # don't cancel others on 1 fail
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: \${{ matrix.node-version }}
          cache: 'npm'
      - run: npm ci && npm test

  # ── Job 3: Build (waits for lint AND test) ───
  build:
    needs: [ lint, test ]  # ← fan-in here
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build

# === Set secrets in GitHub ===
# Repo → Settings → Secrets → Actions → New
# DOCKER_USERNAME, DOCKER_PASSWORD, APP_VERSION

# === Workflow-level env (all jobs see this) ===
env:
  NODE_ENV: production
  APP_NAME: my-devops-app

jobs:
  deploy:
    runs-on: ubuntu-latest

    # Job-level env (this job only)
    env:
      DOCKER_USER: \${{ secrets.DOCKER_USERNAME }}

    steps:
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: \${{ secrets.DOCKER_USERNAME }}
          password: \${{ secrets.DOCKER_PASSWORD }}

      - name: Build and push image
        run: |
          docker build -t \${{ secrets.DOCKER_USERNAME }}/\${{ env.APP_NAME }}:\${{ github.sha }} .
          docker push \${{ secrets.DOCKER_USERNAME }}/\${{ env.APP_NAME }}:\${{ github.sha }}

      # WRONG — never do this!
      # - run: echo "Token is ${{ secrets.DOCKER_PASSWORD }}"

# === Environment-scoped secrets (prod vs staging) ===
jobs:
  deploy-prod:
    environment: production  # uses prod-specific secrets
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying to production..."

# === Method 1: cache: 'npm' in setup-node (easiest) ===
steps:
  - uses: actions/setup-node@v4
    with:
      node-version: '20'
      cache: 'npm'       # ← caches ~/.npm automatically
  - run: npm ci          # uses cache on 2nd run → 60s → 5s

# === Method 2: actions/cache (more control) ===
steps:
  - name: Cache node_modules
    uses: actions/cache@v4
    with:
      path: ~/.npm
      key: npm-\${{ runner.os }}-\${{ hashFiles('**/package-lock.json') }}
      restore-keys: npm-\${{ runner.os }}-
  - run: npm ci

# Cache key uses the package-lock.json hash:
# - Same lock file → cache hit (fast)
# - Lock file changed → cache miss → fresh install

jobs:
  build:
    steps:
      - run: npm run build         # creates dist/
      - uses: actions/upload-artifact@v4
        with:
          name: dist-files
          path: dist/
          retention-days: 7

  deploy:
    needs: build
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist-files
      - run: ls dist/          # available here!

pipeline {
    agent any
    tools { nodejs 'NodeJS-20' }

    environment {
        APP_NAME = 'my-devops-app'
    }

    stages {
        stage('Checkout') {
            steps { checkout scm }
        }

        // Parallel: Lint + Test run simultaneously
        stage('Quality Checks') {
            parallel {
                stage('Lint') {
                    steps { sh 'npm ci && npm run lint' }
                }
                stage('Test') {
                    steps {
                        sh 'npm ci && npm test'
                    }
                    post {
                        always {
                            junit '**/test-results/*.xml'
                        }
                    }
                }
            }
        }

        // Only build on main branch
        stage('Build Docker') {
            when { branch 'main' }
            steps {
                withCredentials([usernamePassword(
                    credentialsId: 'docker-hub-creds',
                    usernameVariable: 'DOCKER_USER',
                    passwordVariable: 'DOCKER_PASS'
                )]) {
                    sh """
                        docker login -u $DOCKER_USER -p $DOCKER_PASS
                        docker build -t $DOCKER_USER/$APP_NAME:$BUILD_NUMBER .
                        docker push $DOCKER_USER/$APP_NAME:$BUILD_NUMBER
                    """
                }
            }
        }

        // Human approval gate before production
        stage('Approve Production') {
            when { branch 'main' }
            steps {
                input message: 'Deploy to production?',
                      ok: 'Deploy'
            }
        }

        stage('Deploy') {
            when { branch 'main' }
            steps {
                sh 'echo "Deploying $APP_NAME:$BUILD_NUMBER"'
            }
        }
    }

    post {
        always  { echo 'Pipeline finished' }
        success { slackSend '✅ Build passed' }
        failure { slackSend '❌ Build failed — check logs' }
        cleanup { cleanWs() }  // delete workspace
    }
}

name: CI Advanced

on:
  push:
    branches: [ main, 'feat/**' ]
  pull_request:
    branches: [ main ]

jobs:
  # ── 1. Lint ─────────────────────────
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - run: npm run lint || echo "No lint script — OK"

  # ── 2. Test — matrix Node 18 + 20 ───
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [ 18, 20 ]
      fail-fast: false
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: \${{ matrix.node-version }}
          cache: 'npm'
      - run: npm ci && npm test

  # ── 3. Build (needs lint + test) ─────
  build:
    needs: [ lint, test ]
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    env:
      APP_VERSION: \${{ secrets.APP_VERSION }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20', cache: 'npm' }
      - run: npm ci
      - name: Build
        run: echo "Building version $APP_VERSION"
      - name: Upload dist
        uses: actions/upload-artifact@v4
        with:
          name: build-\${{ github.sha }}
          path: dist/
          if-no-files-found: warn

# Conditional on branch + event
if: github.ref == 'refs/heads/main' && github.event_name == 'push'

# Continue even if a step fails
- run: npm run lint
  continue-on-error: true

# Set output from one step, use in next
- id: version
  run: echo "tag=$(git describe --tags)" >> $GITHUB_OUTPUT
- run: echo "Version is \${{ steps.version.outputs.tag }}"

# Timeout on a step
- run: npm test
  timeout-minutes: 10

# Retry a flaky step
- uses: nick-fields/retry@v3
  with:
    timeout_minutes: 5
    max_attempts: 3
    command: npm test

# Environment-gated deployment
jobs:
  deploy-prod:
    environment:
      name: production
      url: https://myapp.com
    # GitHub will show approval UI before this runs

# npm install (development)
npm install
# → Reads package.json
# → Resolves versions (may get newer patch)
# → Updates package-lock.json if needed
# → Merges with existing node_modules
# → Fine for developer machines

# npm ci (CI/production — always use this)
npm ci
# → Reads package-lock.json only
# → Installs EXACT versions (no resolution)
# → Fails if package-lock.json is missing
# → Fails if package-lock.json is out of sync with package.json
# → Deletes node_modules FIRST (clean install)
# → Never modifies package-lock.json
# → FASTER in CI (no resolution step)

# === The lock file sync problem ===
# Developer adds package, forgets to commit lock file
# npm install: silently resolves → works
# npm ci: FAILS → catches the problem ← correct behaviour

# === Fix: always commit package-lock.json ===
git add package.json package-lock.json
git commit -m "chore: add express dependency"

# Matrix
strategy:
  matrix:
    node: [ 18, 20 ]
  fail-fast: false
steps:
  - uses: actions/setup-node@v4
    with:
      node-version: \${{ matrix.node }}
      cache: 'npm'

# Fan-in
build:
  needs: [ lint, test ]
  if: github.ref == 'refs/heads/main'

# Secrets
env:
  TOKEN: \${{ secrets.MY_TOKEN }}

# Artifact upload
- uses: actions/upload-artifact@v4
  with:
    name: dist
    path: dist/

# Conditional step
- if: failure()
  run: echo "Step failed!"