Привет, я junior DevOps-инженер

image: docker:24
services:
  - docker:24-dind

variables:
  IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
  LATEST: $CI_REGISTRY_IMAGE:latest

stages: [ lint, test, build, deploy ]

lint:
  stage: lint
  image: node:20-alpine
  cache:
    key: $CI_COMMIT_REF_SLUG
    paths: [ node_modules/ ]
  script: [ npm ci, npm run lint ]

test:
  stage: test
  image: node:20-alpine
  coverage: '/Lines\s*:\s*(\d+\.?\d*)%/'
  script: [ npm ci, npm test -- --coverage ]

build:
  stage: build
  before_script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
  script:
    - docker build --cache-from $LATEST -t $IMAGE -t $LATEST .
    - docker push $IMAGE && docker push $LATEST
  only: [ main ]

deploy_prod:
  stage: deploy
  image: alpine
  environment:
    name: production
    url:  https://projectforfamilystablelife.top
  before_script:
    - apk add --no-cache openssh-client
    - eval $(ssh-agent -s) && echo "$SSH_PRIVATE_KEY" | ssh-add -
    - ssh-keyscan $SSH_HOST >> ~/.ssh/known_hosts
  script:
    - ssh $SSH_USER@$SSH_HOST "docker pull $LATEST && docker compose up -d"
  only: [ main ]

name: Deploy
on:
  push:
    branches: [ main ]

jobs:
  build-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
      - name: Test
        run: npm ci && npm test
      - name: Build & Push Docker
        run: |
          echo ${{ secrets.REGISTRY_TOKEN }} | docker login ${{ secrets.REGISTRY }} -u ${{ secrets.REGISTRY_USER }} --password-stdin
          docker build -t ${{ secrets.REGISTRY }}/app:latest .
          docker push ${{ secrets.REGISTRY }}/app:latest
      - uses: appleboy/ssh-action@v1.0.3
        with:
          host: ${{{ secrets.SSH_HOST }}
          username: ${{{ secrets.SSH_USER }}
          key: ${{{ secrets.SSH_KEY }}
          script: docker pull ${{ secrets.REGISTRY }}/app:latest && docker compose up -d
      - name: Notify on fail
        if: failure()
        run: curl -s -X POST ${{ secrets.TELEGRAM_URL }} -d "text=❌ Deploy failed"

// Declarative Pipeline
pipeline {
  agent { label 'docker' }
  environment {
    REGISTRY    = 'registry.example.com'
    IMAGE       = "${REGISTRY}/my-app"
    DEPLOY_HOST = credentials('deploy-host')
  }
  options {
    timeout(time: 30, unit: 'MINUTES')
    buildDiscarder(logRotator(numToKeepStr: '10'))
  }
  stages {
    stage('Lint & Test') {
      parallel {
        stage('Lint') {
          steps { sh 'docker run --rm -v $PWD:/app -w /app node:20-alpine npm ci && npm run lint' }
        }
        stage('Test') {
          steps { sh 'docker run --rm -v $PWD:/app -w /app node:20-alpine sh -c "npm ci && npm test"' }
          post { always { junit 'junit.xml' } }
        }
      }
    }
    stage('Build & Push') {
      when { branch 'main' }
      steps {
        script {
          docker.withRegistry("https://${REGISTRY}", 'registry-creds') {
            def img = docker.build("${IMAGE}:${env.BUILD_NUMBER}")
            img.push(); img.push('latest')
          }
        }
      }
    }
    stage('Deploy') {
      when { branch 'main' }
      input { message "Deploy to production?"; ok 'Deploy' }
      steps {
        sshagent(['deploy-ssh-key']) {
          sh "ssh $DEPLOY_HOST 'docker pull ${IMAGE}:latest && docker compose up -d'"
        }
      }
    }
  }
  post {
    success { sh """curl -s "$TELEGRAM_URL" -d "text=✅ ${JOB_NAME} #${BUILD_NUMBER} deployed" """ }
    failure { sh """curl -s "$TELEGRAM_URL" -d "text=❌ ${JOB_NAME} #${BUILD_NUMBER} failed" """ }
    always  { cleanWs() }
  }
}