26 Deployment-Strategien – von der Pipeline in die Produktion

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production  # Erstellt "production" falls nicht vorhanden

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.example.com  # Optional: Link im UI
    steps:
      - run: echo "Deploying to staging"

  deploy-production:
    runs-on: ubuntu-latest
    needs: deploy-staging
    environment:
      name: production
      url: https://example.com
    steps:
      - run: echo "Deploying to production"

jobs:
  deploy:
    environment: production
    runs-on: ubuntu-latest
    steps:
      - name: Deploy
        env:
          # Environment Secret (nur in diesem Job verfügbar)
          API_KEY: ${{ secrets.PRODUCTION_API_KEY }}
          # Environment Variable
          API_URL: ${{ vars.PRODUCTION_API_URL }}
        run: ./deploy.sh

jobs:
  deploy:
    environment: production  # Wartet auf Genehmigung
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh

name: Deploy

on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test

  deploy-staging:
    needs: test
    runs-on: ubuntu-latest
    environment:
      name: staging
      url: https://staging.badge-gen.example.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Staging
        run: ./deploy.sh staging

  deploy-production:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://badge-gen.example.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Production
        run: ./deploy.sh production

jobs:
  deploy:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        region: [eu-west-1, us-east-1, ap-southeast-1]
      fail-fast: false  # Andere Regionen weitermachen wenn eine fehlschlägt
    environment:
      name: production-${{ matrix.region }}
      url: https://${{ matrix.region }}.example.com
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to ${{ matrix.region }}
        env:
          AWS_REGION: ${{ matrix.region }}
        run: ./deploy.sh

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      
      - name: Get current deployment
        id: current
        run: |
          CURRENT_SHA=$(curl -s https://example.com/version.txt)
          echo "sha=$CURRENT_SHA" >> $GITHUB_OUTPUT
      
      - name: Deploy new version
        id: deploy
        run: ./deploy.sh
        continue-on-error: true
      
      - name: Health check
        id: health
        if: steps.deploy.outcome == 'success'
        run: |
          for i in {1..5}; do
            if curl -sf https://example.com/health; then
              echo "Health check passed"
              exit 0
            fi
            sleep 10
          done
          echo "Health check failed"
          exit 1
        continue-on-error: true
      
      - name: Rollback if needed
        if: steps.deploy.outcome == 'failure' || steps.health.outcome == 'failure'
        env:
          ROLLBACK_SHA: ${{ steps.current.outputs.sha }}
        run: |
          echo "Rolling back to $ROLLBACK_SHA"
          git checkout $ROLLBACK_SHA
          ./deploy.sh
          exit 1  # Workflow als fehlgeschlagen markieren

# .github/workflows/deploy-pages.yml
name: Deploy to GitHub Pages

on:
  push:
    branches: [main]
  workflow_dispatch:  # Manuelles Triggern erlauben

permissions:
  contents: read
  pages: write
  id-token: write

concurrency:
  group: pages
  cancel-in-progress: false  # Laufende Deployments nicht abbrechen

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
          cache: 'pip'
      
      - name: Install dependencies
        run: pip install -e .
      
      - name: Generate badges
        run: |
          mkdir -p _site/badges
          
          # Repository-Metriken sammeln (vereinfacht)
          badge-gen create \
            --name "build" \
            --value "passing" \
            --color "green" \
            --output _site/badges/build.svg
          
          badge-gen create \
            --name "coverage" \
            --value "87%" \
            --color "yellow" \
            --output _site/badges/coverage.svg
          
          badge-gen create \
            --name "python" \
            --value "3.12" \
            --color "blue" \
            --output _site/badges/python.svg
      
      - name: Create index page
        run: |
          cat > _site/index.html << 'EOF'
          <!DOCTYPE html>
          <html>
          <head><title>badge-gen Badges</title></head>
          <body>
            <h1>Project Badges</h1>
            <p><img src="badges/build.svg" alt="Build Status"></p>
            <p><img src="badges/coverage.svg" alt="Coverage"></p>
            <p><img src="badges/python.svg" alt="Python Version"></p>
          </body>
          </html>
          EOF
      
      - name: Setup Pages
        uses: actions/configure-pages@v5
      
      - name: Upload artifact
        uses: actions/upload-pages-artifact@v3
        with:
          path: _site

  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@v4

permissions:
  contents: read      # Repository lesen
  pages: write        # Pages-Artefakte schreiben
  id-token: write     # OIDC-Token für sichere Authentifizierung

concurrency:
  group: pages
  cancel-in-progress: false

- name: Deploy
  uses: peaceiris/actions-gh-pages@v4
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    publish_dir: ./_site

# .github/workflows/publish.yml
name: Publish to PyPI

on:
  release:
    types: [published]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      
      - name: Install build tools
        run: pip install build
      
      - name: Build distribution
        run: python -m build
      
      - name: Upload dist artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish:
    needs: build
    runs-on: ubuntu-latest
    environment:
      name: pypi
      url: https://pypi.org/project/badge-gen/
    permissions:
      id-token: write  # Erforderlich für Trusted Publishing
    steps:
      - name: Download dist artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

jobs:
  publish-testpypi:
    runs-on: ubuntu-latest
    environment: testpypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/

name: Release

on:
  push:
    tags:
      - 'v*'

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python: ['3.10', '3.11', '3.12']
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}
          cache: 'pip'
      - run: pip install -e .[dev]
      - run: pytest

  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - run: pip install build
      - run: python -m build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  publish-testpypi:
    needs: build
    runs-on: ubuntu-latest
    environment: testpypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1
        with:
          repository-url: https://test.pypi.org/legacy/

  publish-pypi:
    needs: publish-testpypi
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - uses: pypa/gh-action-pypi-publish@release/v1

  github-release:
    needs: publish-pypi
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/
      - name: Create GitHub Release
        uses: ncipollo/release-action@v1
        with:
          artifacts: "dist/*"
          generateReleaseNotes: true

git revert HEAD
git push origin main

# Build-Job
- uses: actions/upload-pages-artifact@v3
  with:
    path: _site

# Deploy-Job
- uses: actions/deploy-pages@v4
# Kein Download nötig – deploy-pages holt das Artefakt automatisch

- name: Debug OIDC
  run: |
    echo "Repository: ${{ github.repository }}"
    echo "Workflow: ${{ github.workflow }}"
    echo "Environment: ${{ github.environment }}"

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false  # Deployments nie abbrechen

# Nur was nötig ist
permissions:
  contents: read
  pages: write
  id-token: write

# NICHT
permissions: write-all

on:
  push:
    branches: [main]
  schedule:
    # Nur Mo-Fr 9-17 Uhr UTC
    - cron: '0 9-17 * * 1-5'

- name: Deploy
  run: ./deploy.sh

- name: Wait for rollout
  run: sleep 60

- name: Smoke test
  run: |
    curl -sf https://example.com/health || exit 1
    curl -sf https://example.com/api/status || exit 1

- name: Notify on failure
  if: failure()
  uses: slackapi/slack-github-action@v1
  with:
    channel-id: 'deployments'
    slack-message: "Deployment failed: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
  env:
    SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}