GitHub Actions: build → test → push → deploy

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    name: Test (unit + slice)
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_DB: taskflow_test
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        ports: [5432:5432]
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Set up JDK 21
      uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 21
        cache: gradle

    - name: Grant execute permission for gradlew
      run: chmod +x gradlew

    - name: Run unit + slice tests
      run: ./gradlew test
      env:
        SPRING_DATASOURCE_URL: jdbc:postgresql://localhost:5432/taskflow_test
        SPRING_DATASOURCE_USERNAME: test
        SPRING_DATASOURCE_PASSWORD: test

    - name: Upload coverage
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: coverage
        path: build/reports/jacoco/test/

  integration-test:
    name: Integration tests (Testcontainers)
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Set up JDK 21
      uses: actions/setup-java@v4
      with:
        distribution: temurin
        java-version: 21
        cache: gradle

    - name: Run integration tests
      run: ./gradlew test --tests "*IT"

  build-and-push:
    name: Build & Push Docker image
    runs-on: ubuntu-latest
    needs: [test, integration-test]
    permissions:
      contents: read
      packages: write
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log in to GHCR
      if: github.event_name != 'pull_request'
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v5
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=sha,prefix=
          type=ref,event=branch
          type=ref,event=pr
          type=raw,value=latest,enable={{is_default_branch}}

    - name: Build and push
      uses: docker/build-push-action@v5
      with:
        context: .
        push: ${{ github.event_name != 'pull_request' }}
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

  deploy:
    name: Deploy to k8s
    runs-on: ubuntu-latest
    needs: build-and-push
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    environment:
      name: production
      url: https://taskflow.example.com
    steps:
    - name: Checkout
      uses: actions/checkout@v4

    - name: Set up kubectl
      uses: azure/setup-kubectl@v4
      with:
        version: v1.29.0

    - name: Configure kubeconfig
      run: |
        mkdir -p ~/.kube
        echo "${{ secrets.KUBECONFIG }}" | base64 -d > ~/.kube/config

    - name: Update image in deployment
      run: |
        kubectl set image deployment/taskflow \
          taskflow=ghcr.io/${{ github.repository }}:${{ github.sha }} \
          -n taskflow

    - name: Wait for rollout
      run: |
        kubectl rollout status deployment/taskflow -n taskflow --timeout=5m

    - name: Verify deployment
      run: |
        sleep 10
        curl -f https://taskflow.example.com/actuator/health || exit 1

• KUBECONFIG — base64 от ~/.kube/config
• (GITHUB_TOKEN — авто)

Settings → Branches → Branch protection rules → main:

• ✅ Require status checks to pass before merging
• ✅ Require branches to be up to date
• ✅ Include administrators

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to deploy'
        required: true
        type: choice
        options: [dev, staging, production]

- name: Upload JAR
  uses: actions/upload-artifact@v4
  with:
    name: taskflow-jar
    path: build/libs/*.jar
    retention-days: 7

strategy:
  matrix:
    java: [21, 23]
runs-on: ubuntu-latest
steps:
  - uses: actions/setup-java@v4
    with:
      distribution: temurin
      java-version: ${{ matrix.java }}

![CI](https://github.com/USER/REPO/actions/workflows/ci.yml/badge.svg)

---