Github Actions Pipeline Builder

# Full-Stack CI/CD Pipeline Template
# Copy to .github/workflows/ in your repo

name: Full-Stack CI/CD

on:
  push:
    branches: [main, staging]
  pull_request:
    branches: [main]

env:
  NODE_VERSION: 18

jobs:
  lint-and-typecheck:
    name: Lint & Type Check
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - run: npm ci

      - name: Run ESLint
        run: npm run lint

      - name: Run TypeScript
        run: npm run typecheck

  test:
    name: Test (Node ${{ matrix.node-version }})
    runs-on: ubuntu-latest

    strategy:
      matrix:
        node-version: [16, 18, 20]

    steps:
      - uses: actions/checkout@v3

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - run: npm ci

      - name: Run tests with coverage
        run: npm test -- --coverage

      - name: Upload coverage to Codecov
        uses: codecov/codecov-action@v3
        if: matrix.node-version == 18
        with:
          token: ${{ secrets.CODECOV_TOKEN }}

  build:
    name: Build
    runs-on: ubuntu-latest
    needs: [lint-and-typecheck, test]

    steps:
      - uses: actions/checkout@v3

      - uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - run: npm ci

      - name: Build application
        run: npm run build

      - name: Upload build artifacts
        uses: actions/upload-artifact@v3
        with:
          name: build
          path: dist/

  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    needs: build
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment: staging

    steps:
      - uses: actions/checkout@v3

      - name: Download build artifacts
        uses: actions/download-artifact@v3
        with:
          name: build
          path: dist/

      - name: Deploy to staging
        run: ./scripts/deploy.sh staging
        env:
          API_KEY: ${{ secrets.STAGING_API_KEY }}
          DATABASE_URL: ${{ secrets.STAGING_DATABASE_URL }}

      - name: Run smoke tests
        run: npm run test:smoke -- --url=https://staging.example.com

  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: deploy-staging
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment: production

    steps:
      - uses: actions/checkout@v3

      - name: Download build artifacts
        uses: actions/download-artifact@v3
        with:
          name: build
          path: dist/

      - name: Deploy to production
        run: ./scripts/deploy.sh production
        env:
          API_KEY: ${{ secrets.PRODUCTION_API_KEY }}
          DATABASE_URL: ${{ secrets.PRODUCTION_DATABASE_URL }}

      - name: Run smoke tests
        run: npm run test:smoke -- --url=https://example.com

      - name: Notify Slack on success
        if: success()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "✅ Production deployment successful",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Deployed to Production*\n${{ github.event.head_commit.message }}"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

      - name: Notify Slack on failure
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": "❌ Production deployment failed",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Deployment Failed*\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>"
                  }
                }
              ]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

#!/usr/bin/env node
/**
 * GitHub Actions Usage Analyzer
 *
 * Analyzes workflows to find outdated actions and suggest updates.
 *
 * Usage: npx tsx action_usage_analyzer.ts [workflow-dir]
 *
 * Examples:
 *   npx tsx action_usage_analyzer.ts .github/workflows
 *
 * Dependencies: npm install yaml
 */

import * as fs from 'fs';
import * as path from 'path';
import { parse } from 'yaml';

interface ActionUsage {
  action: string;
  version: string;
  file: string;
  count: number;
}

interface UpdateSuggestion {
  action: string;
  currentVersion: string;
  latestVersion: string;
  breaking: boolean;
  notes?: string;
}

// Known action versions (as of Jan 2024)
const LATEST_VERSIONS: Record<string, { version: string; breaking?: boolean; notes?: string }> = {
  'actions/checkout': {
    version: 'v4',
    breaking: false,
    notes: 'v4 uses Node.js 20'
  },
  'actions/setup-node': {
    version: 'v4',
    breaking: false,
    notes: 'v4 uses Node.js 20'
  },
  'actions/setup-python': {
    version: 'v5',
    breaking: false
  },
  'actions/cache': {
    version: 'v4',
    breaking: false
  },
  'actions/upload-artifact': {
    version: 'v4',
    breaking: true,
    notes: 'v4 changes artifact retention and download behavior'
  },
  'actions/download-artifact': {
    version: 'v4',
    breaking: true,
    notes: 'v4 changes download location and naming'
  },
  'docker/build-push-action': {
    version: 'v5',
    breaking: false
  },
  'docker/login-action': {
    version: 'v3',
    breaking: false
  },
  'codecov/codecov-action': {
    version: 'v4',
    breaking: false
  },
  'slackapi/slack-github-action': {
    version: 'v1.25',
    breaking: false
  }
};

class ActionUsageAnalyzer {
  private usages: Map<string, ActionUsage[]> = new Map();
  private suggestions: UpdateSuggestion[] = [];

  analyzeDirectory(dir: string): void {
    const files = fs.readdirSync(dir);

    files.forEach(file => {
      if (file.endsWith('.yml') || file.endsWith('.yaml')) {
        this.analyzeFile(path.join(dir, file));
      }
    });
  }

  analyzeFile(filePath: string): void {
    const content = fs.readFileSync(filePath, 'utf-8');

    try {
      const workflow = parse(content);

      if (!workflow?.jobs) return;

      Object.entries(workflow.jobs).forEach(([_, job]: [string, any]) => {
        job.steps?.forEach((step: any) => {
          if (step.uses) {
            this.recordAction(step.uses, filePath);
          }
        });
      });
    } catch (error) {
      console.error(`Failed to parse ${filePath}:`, error);
    }
  }

  private recordAction(usesString: string, file: string): void {
    // Parse action@version format
    const match = usesString.match(/^([^@]+)@(.+)$/);
    if (!match) return;

    const [, action, version] = match;

    if (!this.usages.has(action)) {
      this.usages.set(action, []);
    }

    const existing = this.usages.get(action)!.find(
      u => u.version === version && u.file === file
    );

    if (existing) {
      existing.count++;
    } else {
      this.usages.get(action)!.push({
        action,
        version,
        file,
        count: 1
      });
    }

    // Check if update available
    const latest = LATEST_VERSIONS[action];
    if (latest && version !== latest.version) {
      const existingSuggestion = this.suggestions.find(
        s => s.action === action && s.currentVersion === version
      );

      if (!existingSuggestion) {
        this.suggestions.push({
          action,
          currentVersion: version,
          latestVersion: latest.version,
          breaking: latest.breaking || false,
          notes: latest.notes
        });
      }
    }
  }

  report(): void {
    console.log('\n📊 GitHub Actions Usage Report\n');
    console.log('─'.repeat(70));

    // Group by action
    const actions = Array.from(this.usages.keys()).sort();

    if (actions.length === 0) {
      console.log('No actions found in workflows.');
      return;
    }

    console.log('\nActions Used:\n');

    actions.forEach(action => {
      const usages = this.usages.get(action)!;
      const totalCount = usages.reduce((sum, u) => sum + u.count, 0);

      console.log(`📦 ${action}`);

      // Group by version
      const versionMap = new Map<string, number>();
      usages.forEach(u => {
        versionMap.set(u.version, (versionMap.get(u.version) || 0) + u.count);
      });

      versionMap.forEach((count, version) => {
        const latest = LATEST_VERSIONS[action];
        const isLatest = latest && version === latest.version;
        const icon = isLatest ? '✅' : '⚠️ ';
        console.log(`  ${icon} ${version} (${count} usage${count > 1 ? 's' : ''})`);
      });

      console.log('');
    });

    // Update suggestions
    if (this.suggestions.length > 0) {
      console.log('─'.repeat(70));
      console.log('\n💡 Update Suggestions:\n');

      this.suggestions.forEach(suggestion => {
        const icon = suggestion.breaking ? '🔴' : '🟢';
        console.log(`${icon} ${suggestion.action}`);
        console.log(`  Current: ${suggestion.currentVersion}`);
        console.log(`  Latest:  ${suggestion.latestVersion}`);

        if (suggestion.breaking) {
          console.log('  ⚠️  Breaking changes - review migration guide');
        }

        if (suggestion.notes) {
          console.log(`  ℹ️  ${suggestion.notes}`);
        }

        console.log('');
      });

      console.log('─'.repeat(70));
      console.log('\nTo update an action:');
      console.log('  Replace: uses: actions/checkout@v3');
      console.log('  With:    uses: actions/checkout@v4');
    } else {
      console.log('✅ All actions are up to date!\n');
    }

    // Security notes
    console.log('\n🔒 Security Best Practices:\n');
    console.log('  • Pin actions to specific SHA for security:');
    console.log('    uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1');
    console.log('  • Use Dependabot to auto-update actions:');
    console.log('    Create .github/dependabot.yml with github-actions ecosystem');
    console.log('');
  }

  generateDependabotConfig(): string {
    return `# .github/dependabot.yml
# Auto-update GitHub Actions

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    labels:
      - "dependencies"
      - "github-actions"
`;
  }
}

// CLI entry point
if (require.main === module) {
  const args = process.argv.slice(2);
  const dir = args[0] || '.github/workflows';

  if (!fs.existsSync(dir)) {
    console.error(`❌ Directory not found: ${dir}`);
    console.error('\nUsage: npx tsx action_usage_analyzer.ts [workflow-dir]');
    console.error('Example: npx tsx action_usage_analyzer.ts .github/workflows');
    process.exit(1);
  }

  const analyzer = new ActionUsageAnalyzer();
  analyzer.analyzeDirectory(dir);
  analyzer.report();

  // Offer to create Dependabot config
  if (args.includes('--create-dependabot')) {
    const config = analyzer.generateDependabotConfig();
    const configPath = '.github/dependabot.yml';

    fs.mkdirSync(path.dirname(configPath), { recursive: true });
    fs.writeFileSync(configPath, config);

    console.log(`✅ Created ${configPath}`);
  }
}

export { ActionUsageAnalyzer };

#!/usr/bin/env node
/**
 * GitHub Actions Workflow Validator
 *
 * Validates workflow YAML files for syntax errors and common issues.
 *
 * Usage: npx tsx workflow_validator.ts [workflow-file]
 *
 * Examples:
 *   npx tsx workflow_validator.ts .github/workflows/ci.yml
 *   npx tsx workflow_validator.ts .github/workflows/*.yml
 *
 * Dependencies: npm install yaml
 */

import * as fs from 'fs';
import * as path from 'path';
import { parse } from 'yaml';

interface ValidationIssue {
  file: string;
  line?: number;
  severity: 'error' | 'warning' | 'info';
  message: string;
  suggestion?: string;
}

class WorkflowValidator {
  private issues: ValidationIssue[] = [];

  validateFile(filePath: string): void {
    const content = fs.readFileSync(filePath, 'utf-8');

    try {
      const workflow = parse(content);

      if (!workflow) {
        this.addIssue(filePath, 'error', 'Empty or invalid YAML file');
        return;
      }

      // Required fields
      if (!workflow.name) {
        this.addIssue(filePath, 'warning', 'Missing workflow name');
      }

      if (!workflow.on) {
        this.addIssue(filePath, 'error', 'Missing trigger (on:)');
      }

      if (!workflow.jobs) {
        this.addIssue(filePath, 'error', 'No jobs defined');
        return;
      }

      // Check each job
      Object.entries(workflow.jobs).forEach(([jobName, job]: [string, any]) => {
        this.validateJob(filePath, jobName, job);
      });

      // Check for common issues
      this.checkCommonIssues(filePath, workflow);

    } catch (error: any) {
      this.addIssue(filePath, 'error', `YAML parse error: ${error.message}`);
    }
  }

  private validateJob(file: string, name: string, job: any): void {
    if (!job['runs-on']) {
      this.addIssue(file, 'error', `Job '${name}' missing runs-on`);
    }

    if (!job.steps || job.steps.length === 0) {
      this.addIssue(file, 'error', `Job '${name}' has no steps`);
    }

    // Check each step
    job.steps?.forEach((step: any, index: number) => {
      if (!step.uses && !step.run) {
        this.addIssue(
          file,
          'error',
          `Job '${name}', step ${index + 1}: Must have 'uses' or 'run'`
        );
      }

      if (!step.name) {
        this.addIssue(
          file,
          'info',
          `Job '${name}', step ${index + 1}: Consider adding a name for clarity`
        );
      }
    });
  }

  private checkCommonIssues(file: string, workflow: any): void {
    const content = JSON.stringify(workflow);

    // Check for missing caching
    if (content.includes('npm install') && !content.includes('cache')) {
      this.addIssue(
        file,
        'warning',
        'Using npm install without caching',
        'Add cache: "npm" to actions/setup-node or use actions/cache'
      );
    }

    // Check for hardcoded secrets
    if (content.match(/['\"]?[A-Za-z0-9]{20,}['\"]?/) && !content.includes('secrets.')) {
      this.addIssue(
        file,
        'warning',
        'Possible hardcoded secret detected',
        'Use ${{ secrets.SECRET_NAME }} instead'
      );
    }

    // Check for npm install vs npm ci
    if (content.includes('npm install') && !content.includes('npm ci')) {
      this.addIssue(
        file,
        'info',
        'Consider using npm ci instead of npm install',
        'npm ci is faster and more reliable in CI environments'
      );
    }

    // Check for checkout action version
    if (content.includes('actions/checkout@v1') || content.includes('actions/checkout@v2')) {
      this.addIssue(
        file,
        'warning',
        'Using outdated actions/checkout version',
        'Update to actions/checkout@v3 or later'
      );
    }

    // Check for missing dependency on job
    Object.entries(workflow.jobs).forEach(([jobName, job]: [string, any]) => {
      if (job.needs && !Array.isArray(job.needs)) {
        const dependency = job.needs as string;
        if (!workflow.jobs[dependency]) {
          this.addIssue(
            file,
            'error',
            `Job '${jobName}' depends on non-existent job '${dependency}'`
          );
        }
      }
    });

    // Check for matrix without strategy
    if (content.includes('matrix.') && !content.includes('strategy:')) {
      this.addIssue(
        file,
        'error',
        'Using matrix variable without strategy.matrix defined'
      );
    }

    // Check for environment secrets without environment
    Object.entries(workflow.jobs).forEach(([jobName, job]: [string, any]) => {
      const jobStr = JSON.stringify(job);
      if (jobStr.includes('secrets.') && !job.environment) {
        this.addIssue(
          file,
          'info',
          `Job '${jobName}' uses secrets but no environment specified`,
          'Consider using environment for better secret management'
        );
      }
    });
  }

  private addIssue(
    file: string,
    severity: ValidationIssue['severity'],
    message: string,
    suggestion?: string
  ): void {
    this.issues.push({ file, severity, message, suggestion });
  }

  report(): void {
    if (this.issues.length === 0) {
      console.log('✅ No issues found!');
      return;
    }

    const errors = this.issues.filter(i => i.severity === 'error');
    const warnings = this.issues.filter(i => i.severity === 'warning');
    const info = this.issues.filter(i => i.severity === 'info');

    console.log(`\n📋 Workflow Validation Report\n`);
    console.log(`Found ${errors.length} errors, ${warnings.length} warnings, ${info.length} suggestions\n`);

    const printIssues = (issues: ValidationIssue[], icon: string) => {
      if (issues.length === 0) return;

      issues.forEach(issue => {
        console.log(`${icon} ${issue.file}`);
        console.log(`  ${issue.message}`);
        if (issue.suggestion) {
          console.log(`  💡 ${issue.suggestion}`);
        }
        console.log('');
      });
    };

    if (errors.length > 0) {
      console.log('🚨 Errors:\n');
      printIssues(errors, '❌');
    }

    if (warnings.length > 0) {
      console.log('⚠️  Warnings:\n');
      printIssues(warnings, '⚠️ ');
    }

    if (info.length > 0) {
      console.log('💡 Suggestions:\n');
      printIssues(info, 'ℹ️ ');
    }

    if (errors.length > 0) {
      process.exit(1);
    }
  }
}

// CLI entry point
if (require.main === module) {
  const args = process.argv.slice(2);

  if (args.length === 0) {
    console.log('Usage: npx tsx workflow_validator.ts <workflow-file>');
    console.log('\nExamples:');
    console.log('  npx tsx workflow_validator.ts .github/workflows/ci.yml');
    console.log('  npx tsx workflow_validator.ts .github/workflows/*.yml');
    process.exit(1);
  }

  const validator = new WorkflowValidator();

  args.forEach(pattern => {
    // Handle glob patterns
    if (pattern.includes('*')) {
      const dir = path.dirname(pattern);
      const files = fs.readdirSync(dir).filter(f => f.endsWith('.yml') || f.endsWith('.yaml'));
      files.forEach(file => {
        validator.validateFile(path.join(dir, file));
      });
    } else {
      if (!fs.existsSync(pattern)) {
        console.error(`❌ File not found: ${pattern}`);
        process.exit(1);
      }
      validator.validateFile(pattern);
    }
  });

  validator.report();
}

export { WorkflowValidator };