spb/ultra-sharp-agent-skills Public

1<!--2Author: Simon-Pierre Boucher3Contact: contact@spboucher.ai4-->56# Patterns — Shipping with CI/CD78## Contents9- GitHub Actions: fail-fast pipeline with artifact promotion10- Environment promotion job11- Canary deploy sketch12- Automated rollback gate13- Migration-before-code ordering14- Gotchas1516## GitHub Actions: fail-fast pipeline with artifact promotion1718```yaml19name: ci20on:21  push:22    branches: [main]23  pull_request:2425concurrency:26  group: ${{ github.workflow }}-${{ github.ref }}27  cancel-in-progress: true          # stale runs waste the <10 min budget2829jobs:30  lint:31    runs-on: ubuntu-24.0432    steps:33      - uses: actions/checkout@v434      - uses: actions/setup-node@v435        with: { node-version: 22, cache: npm }36      - run: npm ci37      - run: npm run lint && npm run typecheck3839  test:40    needs: lint                      # fail-fast ordering41    runs-on: ubuntu-24.0442    strategy:43      matrix: { shard: [1, 2, 3, 4] }   # parallel shards keep wall-clock low44    steps:45      - uses: actions/checkout@v446      - uses: actions/setup-node@v447        with: { node-version: 22, cache: npm }48      - run: npm ci49      - run: npm test -- --shard=${{ matrix.shard }}/45051  build:52    needs: test53    if: github.ref == 'refs/heads/main'54    runs-on: ubuntu-24.0455    permissions: { id-token: write, contents: read }  # OIDC, no long-lived keys56    steps:57      - uses: actions/checkout@v458      - run: docker build -t registry.example.com/svc:${{ github.sha }} .59      - run: docker push registry.example.com/svc:${{ github.sha }}60```6162## Environment promotion job6364```yaml65  deploy-staging:66    needs: build67    environment: staging68    runs-on: ubuntu-24.0469    steps:70      - run: ./deploy.sh registry.example.com/svc:${{ github.sha }} staging7172  deploy-prod:73    needs: deploy-staging74    environment: production        # requires reviewer approval in repo settings75    runs-on: ubuntu-24.0476    steps:77      # SAME artifact — promotion, not rebuild78      - run: ./deploy.sh registry.example.com/svc:${{ github.sha }} production79```8081## Canary deploy sketch8283```bash84# deploy.sh <image> production — canary ramp with health gates85set -euo pipefail86IMAGE=$187for PCT in 5 25 100; do88  set_traffic_split "$IMAGE" "$PCT"89  sleep 120                                   # observation window per step90  ERR=$(error_rate_last_2m)91  if (( $(echo "$ERR > 0.01" | bc -l) )); then  # >1% errors aborts the ramp92    set_traffic_split "$PREVIOUS_IMAGE" 10093    echo "canary failed at ${PCT}% (err=${ERR}), rolled back" >&294    exit 195  fi96done97```9899## Automated rollback gate100101```yaml102      - name: verify and rollback103        run: |104          for i in $(seq 1 30); do105            if curl -fsS https://svc.example.com/healthz; then exit 0; fi106            sleep 10107          done108          ./deploy.sh "$PREVIOUS_SHA" production   # 5 min without health = revert109          exit 1110```111112Record `PREVIOUS_SHA` before deploying — rollback needs a target, not a rebuild.113114## Migration-before-code ordering115116```yaml117  migrate:118    needs: build119    runs-on: ubuntu-24.04120    steps:121      - run: ./run-migrations.sh   # expand-phase only; contract ships a release later122123  deploy-staging:124    needs: migrate                 # code never deploys onto an unmigrated schema125```126127## Gotchas128129- **`cancel-in-progress` on main deploys** can abort a half-finished rollout — scope the concurrency group to PRs, or use a deploy queue for main.130- **Cache poisoning:** keyed only on lockfile hash, a cache never picks up new OS packages; include the base-image tag in the key when builds depend on it.131- **`environment:` protection is the gate; branch protection is not** — a promoted artifact needs its own approval step.132- **OIDC beats stored cloud keys**: `permissions: id-token: write` + cloud trust policy removes the leakable secret entirely.133- **Rollback ≠ redeploy old branch**: it is re-pointing to the previous *artifact*; rebuilding old code can produce a different binary than what ran yesterday.134- **Migrations in the same job as deploy** hide ordering failures — separate jobs make "schema first" visible and retryable.135