Skip to content

Commit 6d54ebb

Browse files
author
BlackRoad Bot
committed
ci: add GitHub Actions workflows
- Security scanning (CodeQL, dependency scan, secret scan) - Auto-deployment to Cloudflare/Railway - Self-healing with auto-rollback - Dependabot for dependency updates Deployed by: Phase 6 GitHub CI/CD automation
1 parent 6e906d9 commit 6d54ebb

4 files changed

Lines changed: 299 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
version: 2
2+
updates:
3+
# npm dependencies
4+
- package-ecosystem: "npm"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
open-pull-requests-limit: 10
10+
reviewers:
11+
- "blackboxprogramming"
12+
labels:
13+
- "dependencies"
14+
- "automated"
15+
commit-message:
16+
prefix: "chore"
17+
include: "scope"
18+
19+
# GitHub Actions
20+
- package-ecosystem: "github-actions"
21+
directory: "/"
22+
schedule:
23+
interval: "weekly"
24+
day: "monday"
25+
open-pull-requests-limit: 5
26+
labels:
27+
- "dependencies"
28+
- "github-actions"
29+
commit-message:
30+
prefix: "ci"
31+
32+
# pip dependencies
33+
- package-ecosystem: "pip"
34+
directory: "/"
35+
schedule:
36+
interval: "weekly"
37+
day: "monday"
38+
open-pull-requests-limit: 10
39+
labels:
40+
- "dependencies"
41+
- "python"
42+
commit-message:
43+
prefix: "chore"

‎.github/workflows/auto-deploy.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
name: 🚀 Auto Deploy
2+
3+
on:
4+
push:
5+
branches: [main, master]
6+
workflow_dispatch:
7+
8+
env:
9+
NODE_VERSION: '20'
10+
11+
jobs:
12+
detect-service:
13+
name: Detect Service Type
14+
runs-on: ubuntu-latest
15+
outputs:
16+
service_type: ${{ steps.detect.outputs.service_type }}
17+
deploy_target: ${{ steps.detect.outputs.deploy_target }}
18+
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@v4
22+
23+
- name: Detect Service Type
24+
id: detect
25+
run: |
26+
if [ -f "next.config.mjs" ] || [ -f "next.config.js" ]; then
27+
echo "service_type=nextjs" >> $GITHUB_OUTPUT
28+
echo "deploy_target=cloudflare" >> $GITHUB_OUTPUT
29+
elif [ -f "Dockerfile" ]; then
30+
echo "service_type=docker" >> $GITHUB_OUTPUT
31+
echo "deploy_target=railway" >> $GITHUB_OUTPUT
32+
elif [ -f "package.json" ]; then
33+
echo "service_type=node" >> $GITHUB_OUTPUT
34+
echo "deploy_target=railway" >> $GITHUB_OUTPUT
35+
elif [ -f "requirements.txt" ]; then
36+
echo "service_type=python" >> $GITHUB_OUTPUT
37+
echo "deploy_target=railway" >> $GITHUB_OUTPUT
38+
else
39+
echo "service_type=static" >> $GITHUB_OUTPUT
40+
echo "deploy_target=cloudflare" >> $GITHUB_OUTPUT
41+
fi
42+
43+
deploy-cloudflare:
44+
name: Deploy to Cloudflare Pages
45+
needs: detect-service
46+
if: needs.detect-service.outputs.deploy_target == 'cloudflare'
47+
runs-on: ubuntu-latest
48+
49+
steps:
50+
- name: Checkout
51+
uses: actions/checkout@v4
52+
53+
- name: Setup Node
54+
uses: actions/setup-node@v4
55+
with:
56+
node-version: ${{ env.NODE_VERSION }}
57+
cache: 'npm'
58+
59+
- name: Install Dependencies
60+
run: npm ci
61+
62+
- name: Build
63+
run: npm run build
64+
env:
65+
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: ${{ secrets.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY }}
66+
67+
- name: Deploy to Cloudflare Pages
68+
uses: cloudflare/wrangler-action@v3
69+
with:
70+
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
71+
accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
72+
command: pages deploy .next --project-name=${{ github.event.repository.name }}
73+
74+
deploy-railway:
75+
name: Deploy to Railway
76+
needs: detect-service
77+
if: needs.detect-service.outputs.deploy_target == 'railway'
78+
runs-on: ubuntu-latest
79+
80+
steps:
81+
- name: Checkout
82+
uses: actions/checkout@v4
83+
84+
- name: Install Railway CLI
85+
run: npm i -g @railway/cli
86+
87+
- name: Deploy to Railway
88+
run: railway up --service ${{ github.event.repository.name }}
89+
env:
90+
RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
91+
92+
health-check:
93+
name: Health Check
94+
needs: [deploy-cloudflare, deploy-railway]
95+
if: always() && (needs.deploy-cloudflare.result == 'success' || needs.deploy-railway.result == 'success')
96+
runs-on: ubuntu-latest
97+
98+
steps:
99+
- name: Wait for Deployment
100+
run: sleep 30
101+
102+
- name: Check Health Endpoint
103+
run: |
104+
URL="${{ secrets.DEPLOY_URL }}/api/health"
105+
curl -f $URL || exit 1
106+
107+
- name: Notify Success
108+
if: success()
109+
run: echo "✅ Deployment successful and healthy!"
110+
111+
- name: Notify Failure
112+
if: failure()
113+
run: |
114+
echo "❌ Deployment health check failed!"
115+
exit 1

‎.github/workflows/security-scan.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: 🔒 Security Scan
2+
3+
on:
4+
push:
5+
branches: [main, master, dev]
6+
pull_request:
7+
branches: [main, master]
8+
schedule:
9+
- cron: '0 0 * * 0'
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: read
14+
security-events: write
15+
actions: read
16+
17+
jobs:
18+
codeql:
19+
name: CodeQL Analysis
20+
runs-on: ubuntu-latest
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
language: ['javascript', 'typescript', 'python']
25+
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v4
29+
30+
- name: Initialize CodeQL
31+
uses: github/codeql-action/init@v3
32+
with:
33+
languages: ${{ matrix.language }}
34+
35+
- name: Autobuild
36+
uses: github/codeql-action/autobuild@v3
37+
38+
- name: Perform CodeQL Analysis
39+
uses: github/codeql-action/analyze@v3
40+
41+
dependency-scan:
42+
name: Dependency Scan
43+
runs-on: ubuntu-latest
44+
45+
steps:
46+
- name: Checkout
47+
uses: actions/checkout@v4
48+
49+
- name: Run npm audit
50+
if: hashFiles('package.json') != ''
51+
run: npm audit --audit-level=moderate || true
52+
53+
- name: Dependency Review
54+
uses: actions/dependency-review-action@v4
55+
if: github.event_name == 'pull_request'

‎.github/workflows/self-healing.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: 🔧 Self-Healing
2+
3+
on:
4+
schedule:
5+
- cron: '*/30 * * * *' # Every 30 minutes
6+
workflow_dispatch:
7+
workflow_run:
8+
workflows: ["🚀 Auto Deploy"]
9+
types: [completed]
10+
11+
jobs:
12+
monitor:
13+
name: Monitor Deployments
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@v4
19+
20+
- name: Check Health
21+
id: health
22+
run: |
23+
if [ ! -z "${{ secrets.DEPLOY_URL }}" ]; then
24+
STATUS=$(curl -s -o /dev/null -w "%{http_code}" ${{ secrets.DEPLOY_URL }}/api/health || echo "000")
25+
echo "status=$STATUS" >> $GITHUB_OUTPUT
26+
else
27+
echo "status=skip" >> $GITHUB_OUTPUT
28+
fi
29+
30+
- name: Auto-Rollback
31+
if: steps.health.outputs.status != '200' && steps.health.outputs.status != 'skip'
32+
run: |
33+
echo "🚨 Health check failed (Status: ${{ steps.health.outputs.status }})"
34+
echo "Triggering rollback..."
35+
gh workflow run auto-deploy.yml --ref $(git rev-parse HEAD~1)
36+
env:
37+
GH_TOKEN: ${{ github.token }}
38+
39+
- name: Attempt Auto-Fix
40+
if: steps.health.outputs.status != '200' && steps.health.outputs.status != 'skip'
41+
run: |
42+
echo "🔧 Attempting automatic fixes..."
43+
# Check for common issues
44+
if [ -f "package.json" ]; then
45+
npm ci || true
46+
npm run build || true
47+
fi
48+
49+
- name: Create Issue on Failure
50+
if: failure()
51+
uses: actions/github-script@v7
52+
with:
53+
script: |
54+
github.rest.issues.create({
55+
owner: context.repo.owner,
56+
repo: context.repo.repo,
57+
title: '🚨 Self-Healing: Deployment Health Check Failed',
58+
body: `Deployment health check failed.\n\nStatus: ${{ steps.health.outputs.status }}\nWorkflow: ${context.workflow}\nRun: ${context.runId}`,
59+
labels: ['bug', 'deployment', 'auto-generated']
60+
})
61+
62+
dependency-updates:
63+
name: Auto Update Dependencies
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout
68+
uses: actions/checkout@v4
69+
70+
- name: Setup Node
71+
if: hashFiles('package.json') != ''
72+
uses: actions/setup-node@v4
73+
with:
74+
node-version: '20'
75+
76+
- name: Update npm dependencies
77+
if: hashFiles('package.json') != ''
78+
run: |
79+
npm update
80+
if [ -n "$(git status --porcelain)" ]; then
81+
git config user.name "BlackRoad Bot"
82+
git config user.email "bot@blackroad.io"
83+
git add package*.json
84+
git commit -m "chore: auto-update dependencies"
85+
git push
86+
fi

0 commit comments

Comments
 (0)