Production-grade CI/CD pipeline with GitHub Actions

🎭 Role

You are a Senior DevOps Engineer and CI/CD Architect with extensive experience in cloud-native infrastructure, secure software supply chains, and high-availability deployment strategies. Your expertise includes GitHub Actions, Docker, Kubernetes, and industry-standard security practices.

🌐 Context

We are architecting a production-grade CI/CD pipeline for a [APPLICATION_TYPE] application deployed on [CLOUD_PROVIDER/TARGET_ENVIRONMENT]. The goal is to move from manual deployments to a fully automated, resilient, and observable delivery model that minimizes human intervention while maximizing system stability and code quality.

🛠️ Task Instruction

Design a comprehensive GitHub Actions workflow configuration (YAML) and an accompanying technical strategy document that addresses the following phases:

1. Continuous Integration & Quality Gate: Configure multi-stage workflows covering linting, static application security testing (SAST), dependency vulnerability scanning, and parallelized test execution (Unit, Integration, and E2E).
2. Artifact Lifecycle: Implement Docker multi-stage builds optimized for layer caching and minimal image footprint, pushing to [CONTAINER_REGISTRY].
3. Environment Strategy: Define a tiered deployment model (Dev, Staging, Prod) utilizing environment-specific configurations, secrets management via [SECRETS_MANAGER_NAME], and manual approval gates for production promotion.
4. Deployment & Resiliency: Design a Blue-Green deployment strategy that includes automated health checks post-deployment and an automated rollback mechanism triggered by [MONITORING_TOOL] alerts.
5. Notifications: Integrate real-time pipeline status reporting to [NOTIFICATION_CHANNEL] (e.g., Slack/Microsoft Teams).

⚖️ Constraints & Tone

• Tone: Professional, technical, authoritative, and concise.
• Clarity: Prioritize security-by-design and observability.
• Avoid: Theoretical fluff. Focus on actionable implementation steps and best-practice configurations.
• Security: Ensure no hardcoded credentials; strictly adhere to the Principle of Least Privilege.

📝 Output Format

1. Pipeline Architecture Overview: A brief summary explaining the workflow logic and dependency flow.
2. Workflow Configuration: Full GitHub Actions YAML code block(s), commented for clarity, modularized by job stages.
3. Security & Compliance Checklist: A bulleted list of essential configurations to maintain compliance throughout the pipeline.
4. Resiliency Strategy: A detailed explanation of how the Blue-Green deployment and rollback logic will interact with the target infrastructure.
5. Implementation Roadmap: A logical sequence of steps to deploy this configuration within an existing repository.

Placeholders

• [APPLICATION_TYPE]: e.g., Node.js microservice, Go-based backend
• [CLOUD_PROVIDER/TARGET_ENVIRONMENT]: e.g., AWS EKS, Google Cloud Run, Azure App Service
• [CONTAINER_REGISTRY]: e.g., Amazon ECR, Docker Hub, GitHub Packages
• [SECRETS_MANAGER_NAME]: e.g., GitHub Secrets, HashiCorp Vault, AWS Secrets Manager
• [NOTIFICATION_CHANNEL]: e.g., Slack, Email, PagerDuty
• [MONITORING_TOOL]: e.g., Datadog, Prometheus/Grafana, New Relic