name: Test — NutriTrack API
on:
push:
branches: [main, develop]
pull_request:
branches: [main]
jobs:
test:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: ["18.x", "20.x"]
steps:
- uses: actions/checkout@v4
- name: Node ${{ matrix.node-version }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node-version }}
cache: "npm"
- name: Instalar dependencias
run: npm ci
- name: Lint ESLint
run: npm run lint
- name: Tests con cobertura
run: npm test -- --coverage
- name: Upload a Codecov
uses: codecov/codecov-action@v4
with:
token: ${{ secrets.CODECOV_TOKEN }}
files: ./coverage/lcov.info
name: Build & Push Docker Image
on:
push:
branches: [main]
tags: ["v*"]
env:
REGISTRY: ghcr.io
IMAGE_NAME: ${{ github.repository }}
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v4
- name: Login a ghcr.io
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Metadata (tags, labels)
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
tags: |
type=semver,pattern={{version}}
type=semver,pattern={{major}}.{{minor}}
type=ref,event=branch
- name: Build & Push con cache
uses: docker/build-push-action@v5
with:
context: .
push: true
tags: ${{ steps.meta.outputs.tags }}
cache-from: type=gha
cache-to: type=gha,mode=max
name: Security Scan
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
security:
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- uses: actions/checkout@v4
- name: Trivy — scanner de vulnerabilidades
uses: aquasecurity/trivy-action@0.28.0
with:
scan-type: "fs"
scan-ref: "."
format: "sarif"
output: "trivy-results.sarif"
severity: "CRITICAL,HIGH"
- name: Upload resultados a GitHub Security
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: trivy-results.sarif
- name: Snyk — auditoria de dependencias
uses: snyk/actions/node@0.4.0
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
with:
args: --severity-threshold=high
🔍 Trivy — Resultado
CRITICAL
0 encontradas
HIGH
0 encontradas
MEDIUM
2 encontradas
LOW
5 encontradas
🐍 Snyk — Dependencias npm
lodash 4.17.20
MEDIUM
express 4.18.1
CLEAN
jsonwebtoken
CLEAN
pg-pool
CLEAN
name: Deploy to Production — NutriTrack
on:
push:
tags: ["v*"]
jobs:
deploy-staging:
runs-on: ubuntu-latest
environment:
name: staging
url: https://staging.nutritrack.es
steps:
- uses: actions/checkout@v4
- name: Configurar AWS credentials
uses: aws-actions/configure-aws-credentials@v4
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1
- name: Update kubeconfig EKS
run: |
aws eks update-kubeconfig \
--name nutritrack-cluster \
--region us-east-1
- name: Deploy a staging
run: |
kubectl apply -f k8s/staging/
kubectl rollout status deployment/nutritrack \
-n staging --timeout=300s
deploy-production:
needs: [deploy-staging]
runs-on: ubuntu-latest
environment:
name: production
url: https://app.nutritrack.es
steps:
- name: Deploy a produccion
run: |
kubectl apply -f k8s/production/
kubectl rollout status deployment/nutritrack \
-n production --timeout=300s
kubectl get services -n production
- name: Notificar Slack
if: success()
uses: slackapi/slack-github-action@v1
with:
webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
payload: |
{"text": "Deploy a produccion completado"}
Gate de aprobacion — entorno production
CTO
@cto-nutritrack
✓ Aprobado
name: Matrix Compatibility
on: [push, pull_request]
jobs:
test-matrix:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os:
- ubuntu-latest
- macos-latest
node: ["18.x", "20.x"]
pg: ["14", "15"]
exclude:
- os: windows-latest
node: "18.x"
steps:
- uses: actions/checkout@v4
- name: Setup Node ${{ matrix.node }}
uses: actions/setup-node@v4
with:
node-version: ${{ matrix.node }}
cache: "npm"
- name: Iniciar PostgreSQL ${{ matrix.pg }}
uses: ikalnytskyi/action-setup-postgres@v6
with:
postgres-version: ${{ matrix.pg }}
- run: npm ci && npm test
- name: Slack — fallo en matrix
if: failure()
uses: slackapi/slack-github-action@v1
with:
webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
payload: |
{"text": "FALLO en matrix: OS=${{ matrix.os }} Node=${{ matrix.node }}"}
Ejecucion actual — 8 combinaciones (ubuntu + macos, node 18/20, pg 14/15)
✓ 2m 14s
✓ 2m 31s
⚡ 1m 45s
⚡ 1m 52s
✓ 3m 02s
✓ 3m 18s
⚡ 2m 11s
⚡ 2m 28s
Preview notificacion Slack — deploy completado
Deploy a produccion completado con exito para nutritrack-org/nutritrack-app
APROBADO POR
@cto-nutritrack