devops-ci-cd

# DevOps & CI/CD > This skill assumes a Node.js backend. For Python/Go/Rust, adapt the specifics > but the patterns transfer (test-before-deploy, multi-stage Docker, liveness > vs readiness, automated rollback, secrets hygiene). Example commands use > Fly.io as one concrete PaaS, but the same workflow applies to Railway, > Render, Heroku, AWS, GCP, or any container platform. ## Fail-Fast Rule If any CI step fails, **stop the pipeline and do not deploy**. Never deploy untested code. Never skip health check validation. Never push secrets to git. A broken deploy to production with live traffic and stateful connections is catastrophic. ## Cardinal Rule **Every push to `main` must pass tests and type-checking before reaching production.** A deploy workflow that runs `{{DEPLOY_COMMAND}}` with zero validation is the single highest-risk gap in any infrastructure. ## Audit Baseline: Current State ### deploy.yml (minimal, no tests) ```yaml # ANTI-PATTERN -- {{PROJECT_PATH}}/.github/workflows/deploy.yml name: Deploy on: push: branches: [main] jobs: deploy: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: superfly/flyctl-actions/setup-flyctl@master - run: flyctl deploy --remote-only env: FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }} ``` **Problems:** 1. No `npm ci` -- dependencies not installed 2. No test run -- test suite never executes 3. No `npx tsc --noEmit` -- TypeScript errors not caught 4. No build validat...