Octo E-ShopCopilot Demos
Codespaces
Browse the guide

Reference

CI/CD Pipeline

Continuous integration, delivery, and infrastructure workflows for the Octo E-Shop.

Overview

The Octo E-Shop uses GitHub Actions for CI/CD with a progressive deployment model across three environments. The platform consists of 6 microservices deployed to Azure Kubernetes Service (AKS) via Helm charts, with infrastructure provisioned by Terraform.

  1. Code PushContinuous
  2. CI ValidationContinuous
  3. Build & PushContinuous
  4. Deploy DevAutomatic
  5. Deploy StagingApproval
  6. Deploy ProdApproval
Dev deploys automatically on merge; staging and production each require a manual approval gate.

Workflow Inventory

Workflow File Trigger Purpose
CI Pipeline ci.yml PR, push to main/develop Lint, test, build validation
Build & Push build-push.yml Push to main/develop Build Docker images, push to ACR
Deploy deploy.yml Called by Build & Push Helm deploy to AKS environments
Infrastructure infrastructure.yml Manual, Terraform changes Terraform plan/apply
Terraform Deploy terraform-deploy.yml Called by Infrastructure Per-environment Terraform execution
Cluster Setup cluster-setup.yml After Terraform apply Install ESO, ingress-nginx, secrets
Rollback rollback.yml Manual Helm rollback to previous release

Pipeline Flows

1. CI Pipeline (ci.yml)

Runs on every PR and on pushes to main, develop, and feature/**:

  1. Lint & Format — ESLint + Prettier check
  2. Build & Test — Per-service TypeScript build and tests with coverage, using Postgres and Redis service containers (a test summary is posted on PRs)
  3. Docker Build — Build all six service images on PRs (no push)
  4. Security Scan — npm audit for high-severity dependency vulnerabilities
  5. IaC Validation — Terraform validate/fmt plus Helm lint and template render

2. Build & Deploy Pipeline (build-push.yml)

Triggered on pushes to main or develop that touch services/** or shared/**:

  1. Resolve Tag — Generate image tag from git short SHA (branch names sanitized)
  2. Detect Changes — Path filter so only changed services build (all six on manual build_all)
  3. Build & Push — Build changed service images in parallel and push to Azure Container Registry
  4. Scan Images — Trivy vulnerability scan; SARIF results uploaded to GitHub code scanning
  5. Deploy Dev — Automatic Helm deploy to octo-eshop-dev (from main)
  6. Deploy Staging — Helm deploy after a manual approval gate
  7. Deploy Production — Helm deploy after a manual approval gate

3. Infrastructure Pipeline

Manual workflow with environment selection:

  1. Terraform Init — Initialize with Azure Storage backend
  2. Terraform Plan — Generate and display plan
  3. Terraform Apply — Apply changes (requires explicit action parameter)
  4. Cluster Setup — Post-apply: install cluster add-ons

4. Rollback Pipeline

Emergency rollback via Helm:

  1. Select environment and service
  2. Helm rollback to previous release
  3. Verify pod health

Environment Strategy

Environment Branch Deployment Approval
Dev main Automatic on merge None
Staging main After Dev, via approval gate Required
Production main After Staging, via approval gate Required

Pushes to develop build and push images but do not deploy — only main triggers the dev → staging → production chain, gated by the staging and production GitHub Environments.

Secrets Management

Secrets flow through three layers:

  1. Azure Key Vault — Source of truth for all secrets
  2. GitHub Environment Secrets — Synced by Terraform for CI/CD access
  3. Kubernetes Secrets — Injected at deploy time via kubectl or External Secrets Operator

Deployment Details

Image Tagging

  • Images tagged with git short SHA (e.g., d802d86)
  • On main, images also receive the latest tag
  • Branch names sanitized (feature/xyz → feature-xyz) for Docker tag compatibility
  • Tag resolved in a dedicated job before the build matrix

Helm Charts

Each service has its own Helm chart under helm/charts/:

Terminal window
# Deploy a single service
helm upgrade --install user-service ./helm/charts/user-service \
  --namespace octo-eshop-dev \
  -f ./helm/charts/user-service/values-dev.yaml


# Deploy all services
cd helm && helmfile -e dev sync

Health Checks

Kubernetes probes verify service health during rolling updates:

  • Liveness — /health endpoint
  • Readiness — /ready endpoint (checks database connectivity)