Привет, я junior DevOps-инженер

image: docker:24

services:
  - docker:24-dind

variables:
  DOCKER_TLS_CERTDIR: "/certs"
  IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  IMAGE_LATEST: $CI_REGISTRY_IMAGE:latest

stages:
  - lint
  - test
  - build
  - deploy

lint:
  stage: lint
  image: node:20-alpine
  cache:
    key: $CI_COMMIT_REF_SLUG
    paths: [ node_modules/ ]
  script:
    - npm ci
    - npm run lint

test:
  stage: test
  image: node:20-alpine
  coverage: '/Lines\s*:\s*(\d+\.?\d*)%/'
  script:
    - npm ci
    - npm test -- --coverage
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml

build:
  stage: build
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build --cache-from $IMAGE_LATEST -t $IMAGE -t $IMAGE_LATEST .
    - docker push $IMAGE
    - docker push $IMAGE_LATEST
  only: [ main ]

deploy_prod:
  stage: deploy
  image: alpine:latest
  environment:
    name: production
    url:  https://projectforfamilystablelife.top
  before_script:
    - apk add --no-cache openssh-client
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | ssh-add -
    - mkdir -p ~/.ssh && chmod 700 ~/.ssh
    - ssh-keyscan $SSH_HOST >> ~/.ssh/known_hosts
  script:
    - ssh $SSH_USER@$SSH_HOST "
        docker pull $IMAGE_LATEST &&
        docker stop app || true &&
        docker rm app   || true &&
        docker run -d --name app --restart unless-stopped
          -p 3000:3000 $IMAGE_LATEST &&
        docker image prune -f"
  only: [ main ]
  when:  on_success

name: Deploy

on:
  push:
    branches: [ main ]

jobs:
  build-test-deploy:
    runs-on: ubuntu-latest  # runner: act_runner

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install & Test
        run: |
          npm ci
          npm test

      - name: Build Docker image
        run: |
          docker build -t ${{ secrets.REGISTRY }}/app:${{ gitea.sha }} .
          docker tag ${{ secrets.REGISTRY }}/app:${{ gitea.sha }} \
                     ${{ secrets.REGISTRY }}/app:latest

      - name: Push to Gitea Registry
        run: |
          echo ${{ secrets.REGISTRY_TOKEN }} | \
            docker login ${{ secrets.REGISTRY }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
          docker push ${{ secrets.REGISTRY }}/app:latest

      - name: Deploy via SSH
        uses: appleboy/ssh-action@v1.0.3
        with:
          host:     ${{{ secrets.SSH_HOST }}
          username: ${{{ secrets.SSH_USER }}
          key:      ${{{ secrets.SSH_KEY }}
          script: |
            docker pull ${{ secrets.REGISTRY }}/app:latest
            docker compose -f /opt/app/docker-compose.yml up -d --no-deps app
            docker image prune -f

      - name: Notify on failure
        if: failure()
        run: |
          curl -s -X POST ${{ secrets.TELEGRAM_URL }} \
            -d "text=❌ Deploy failed: ${{ gitea.repository }} @ ${{ gitea.sha }}"

// Declarative Pipeline — Jenkins
pipeline {
  agent { label 'docker' }

  environment {
    REGISTRY   = 'registry.example.com'
    IMAGE      = "${REGISTRY}/my-app"
    TAG        = "${env.BUILD_NUMBER}-${env.GIT_COMMIT[0..6]}"
    DEPLOY_HOST= credentials('deploy-host')
    SSH_CRED   = credentials('deploy-ssh-key')
  }

  options {
    timeout(time: 30, unit: 'MINUTES')
    buildDiscarder(logRotator(numToKeepStr: '10'))
    disableConcurrentBuilds()
  }

  stages {
    stage('Checkout') {
      steps {
        checkout scm
        sh 'echo "Branch: $GIT_BRANCH, Commit: $GIT_COMMIT"'
      }
    }

    stage('Lint & Test') {
      parallel {
        stage('Lint') {
          steps {
            sh 'docker run --rm -v $PWD:/app -w /app node:20-alpine npm ci && npm run lint'
          }
        }
        stage('Unit Tests') {
          steps {
            sh '''
              docker run --rm -v $PWD:/app -w /app node:20-alpine sh -c \
                "npm ci && npm test -- --coverage --reporters=default --reporters=jest-junit"
            '''
          }
          post {
            always {
              junit 'junit.xml'
            }
          }
        }
      }
    }

    stage('Build & Push') {
      when { branch 'main' }
      steps {
        script {
          docker.withRegistry("https://${REGISTRY}", 'registry-creds') {
            def img = docker.build("${IMAGE}:${TAG}")
            img.push()
            img.push('latest')
          }
        }
      }
    }

    stage('Deploy to Production') {
      when { branch 'main' }
      input {
        message "Deploy ${TAG} to production?"
        ok 'Deploy'
      }
      steps {
        sshagent(['deploy-ssh-key']) {
          sh """
            ssh -o StrictHostKeyChecking=no ${DEPLOY_HOST} '
              docker pull ${IMAGE}:latest
              docker stop app 2>/dev/null || true
              docker rm   app 2>/dev/null || true
              docker run -d --name app --restart unless-stopped \\
                -p 3000:3000 ${IMAGE}:latest
              docker image prune -f
            '
          """
        }
      }
    }
  }

  post {
    success {
      sh """curl -s "$TELEGRAM_URL" -d "text=✅ ${JOB_NAME} #${BUILD_NUMBER} deployed" """
    }
    failure {
      sh """curl -s "$TELEGRAM_URL" -d "text=❌ ${JOB_NAME} #${BUILD_NUMBER} failed" """
    }
    always {
      cleanWs()
    }
  }
}