Minimum CI/CD: every merge to main → artifact → staging → prod. Manual SSH deploy inevitably breaks production.
Stages
- lint + typecheck
- tests
- docker build
- deploy
- smoke test
Secrets
CI variables only; rotate keys quarterly.
Environments
- PR → optional preview
- main → staging
- tag → production
Checklist
- Failed deploy alerts
- Rollback = previous image tag
- DB migrate as separate job
Automation in four steps
- Step 1: lint + test on every PR
- Step 2: docker build on main
- Step 3: deploy staging on merge
- Step 4: prod on tag + smoke script